文件 AWS 開發套件範例 GitHub 儲存庫中有更多可用的 [AWS SDK 範例](https://github.com/awsdocs/aws-doc-sdk-examples)。
本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
# AWS STS 使用 AWS SDKs程式碼範例
下列程式碼範例示範如何使用 AWS Security Token Service 搭配 AWS 軟體開發套件 (SDK)。
*Actions* 是大型程式的程式碼摘錄，必須在內容中執行。雖然動作會告訴您如何呼叫個別服務函數，但您可以在其相關情境中查看內容中的動作。
*案例*是向您展示如何呼叫服務中的多個函數或與其他 AWS 服務組合來完成特定任務的程式碼範例。
**其他資源**
+ **[AWS STS 使用者指南](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html)** – 有關 的詳細資訊 AWS STS。
+ **[AWS STS API 參考](https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html)** – 所有可用 AWS STS 動作的詳細資訊。
+ **[AWS 開發人員中心](https://aws.amazon.com/developer/code-examples/?awsf.sdk-code-examples-product=product%23iam)** – 您可以依類別或全文搜尋篩選的程式碼範例。
+ **[AWS SDK 範例](https://github.com/awsdocs/aws-doc-sdk-examples)** – GitHub 儲存庫使用慣用語言的完整程式碼。包含設定和執行程式碼的指示。
**Contents**
+ [基本概念](sts_code_examples_basics.md)
+ [動作](sts_code_examples_actions.md)
+ [`AssumeRole`](sts_example_sts_AssumeRole_section.md)
+ [`AssumeRoleWithWebIdentity`](sts_example_sts_AssumeRoleWithWebIdentity_section.md)
+ [`DecodeAuthorizationMessage`](sts_example_sts_DecodeAuthorizationMessage_section.md)
+ [`GetFederationToken`](sts_example_sts_GetFederationToken_section.md)
+ [`GetSessionToken`](sts_example_sts_GetSessionToken_section.md)
+ [案例](sts_code_examples_scenarios.md)
+ [擔任需要 MFA 字符的 IAM 角色](sts_example_sts_Scenario_AssumeRoleMfa_section.md)
+ [為聯合身分使用者建構 URL](sts_example_sts_Scenario_ConstructFederatedUrl_section.md)
+ [獲取需要 MFA 字符的工作階段字符](sts_example_sts_Scenario_SessionTokenMfa_section.md)
# AWS STS 使用 AWS SDKs的基本範例
下列程式碼範例示範如何 AWS Security Token Service 搭配 AWS SDKs 使用 的基本概念。
**Contents**
+ [動作](sts_code_examples_actions.md)
+ [`AssumeRole`](sts_example_sts_AssumeRole_section.md)
+ [`AssumeRoleWithWebIdentity`](sts_example_sts_AssumeRoleWithWebIdentity_section.md)
+ [`DecodeAuthorizationMessage`](sts_example_sts_DecodeAuthorizationMessage_section.md)
+ [`GetFederationToken`](sts_example_sts_GetFederationToken_section.md)
+ [`GetSessionToken`](sts_example_sts_GetSessionToken_section.md)
# AWS STS 使用 AWS SDKs的動作
下列程式碼範例示範如何使用 AWS SDKs執行個別 AWS STS 動作。每個範例均包含 GitHub 的連結，您可以在連結中找到設定和執行程式碼的相關說明。
這些摘錄會呼叫 AWS STS API，是必須在內容中執行之大型程式的程式碼摘錄。您可以在 [AWS STS 使用 AWS SDKs案例](sts_code_examples_scenarios.md) 中查看內容中的動作。
下列範例僅包含最常使用的動作。如需完整清單，請參閱《[AWS Security Token Service API 參考](https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html)》。
**Topics**
+ [`AssumeRole`](sts_example_sts_AssumeRole_section.md)
+ [`AssumeRoleWithWebIdentity`](sts_example_sts_AssumeRoleWithWebIdentity_section.md)
+ [`DecodeAuthorizationMessage`](sts_example_sts_DecodeAuthorizationMessage_section.md)
+ [`GetFederationToken`](sts_example_sts_GetFederationToken_section.md)
+ [`GetSessionToken`](sts_example_sts_GetSessionToken_section.md)
# `AssumeRole` 搭配 AWS SDK 或 CLI 使用
下列程式碼範例示範如何使用 `AssumeRole`。
動作範例是大型程式的程式碼摘錄，必須在內容中執行。您可以在下列程式碼範例的內容中看到此動作：
+ [擔任需要 MFA 字符的 IAM 角色](sts_example_sts_Scenario_AssumeRoleMfa_section.md)
+ [為聯合身分使用者建構 URL](sts_example_sts_Scenario_ConstructFederatedUrl_section.md)
------
#### [ .NET ]
**適用於 .NET 的 SDK**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/STS#code-examples)中設定和執行。
```
using System;
using System.Threading.Tasks;
using Amazon;
using Amazon.SecurityToken;
using Amazon.SecurityToken.Model;
namespace AssumeRoleExample
{
class AssumeRole
{
///
/// This example shows how to use the AWS Security Token
/// Service (AWS STS) to assume an IAM role.
///
/// NOTE: It is important that the role that will be assumed has a
/// trust relationship with the account that will assume the role.
///
/// Before you run the example, you need to create the role you want to
/// assume and have it trust the IAM account that will assume that role.
///
/// See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html
/// for help in working with roles.
///
// A region property may be used if the profile or credentials loaded do not specify a region,
// or to use a specific region.
private static readonly RegionEndpoint REGION = RegionEndpoint.USWest2;
static async Task Main()
{
// Create the SecurityToken client and then display the identity of the
// default user.
var roleArnToAssume = "arn:aws:iam::123456789012:role/testAssumeRole";
var client = new Amazon.SecurityToken.AmazonSecurityTokenServiceClient(REGION);
// Get and display the information about the identity of the default user.
var callerIdRequest = new GetCallerIdentityRequest();
var caller = await client.GetCallerIdentityAsync(callerIdRequest);
Console.WriteLine($"Original Caller: {caller.Arn}");
// Create the request to use with the AssumeRoleAsync call.
var assumeRoleReq = new AssumeRoleRequest()
{
DurationSeconds = 1600,
RoleSessionName = "Session1",
RoleArn = roleArnToAssume
};
var assumeRoleRes = await client.AssumeRoleAsync(assumeRoleReq);
// Now create a new client based on the credentials of the caller assuming the role.
var client2 = new AmazonSecurityTokenServiceClient(credentials: assumeRoleRes.Credentials, REGION);
// Get and display information about the caller that has assumed the defined role.
var caller2 = await client2.GetCallerIdentityAsync(callerIdRequest);
Console.WriteLine($"AssumedRole Caller: {caller2.Arn}");
}
}
}
```
+ 如需 API 詳細資訊，請參閱 *適用於 .NET 的 AWS SDK API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/goto/DotNetSDKV3/sts-2011-06-15/AssumeRole)。
------
#### [ Bash ]
**AWS CLI 使用 Bash 指令碼**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples)中設定和執行。
```
###############################################################################
# function iecho
#
# This function enables the script to display the specified text only if
# the global variable $VERBOSE is set to true.
###############################################################################
function iecho() {
if [[ $VERBOSE == true ]]; then
echo "$@"
fi
}
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function sts_assume_role
#
# This function assumes a role in the AWS account and returns the temporary
# credentials.
#
# Parameters:
# -n role_session_name -- The name of the session.
# -r role_arn -- The ARN of the role to assume.
#
# Returns:
# [access_key_id, secret_access_key, session_token]
# And:
# 0 - If successful.
# 1 - If an error occurred.
###############################################################################
function sts_assume_role() {
local role_session_name role_arn response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function sts_assume_role"
echo "Assumes a role in the AWS account and returns the temporary credentials:"
echo " -n role_session_name -- The name of the session."
echo " -r role_arn -- The ARN of the role to assume."
echo ""
}
while getopts n:r:h option; do
case "${option}" in
n) role_session_name=${OPTARG} ;;
r) role_arn=${OPTARG} ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
response=$(aws sts assume-role \
--role-session-name "$role_session_name" \
--role-arn "$role_arn" \
--output text \
--query "Credentials.[AccessKeyId, SecretAccessKey, SessionToken]")
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports create-role operation failed.\n$response"
return 1
fi
echo "$response"
return 0
}
```
+ 如需 API 詳細資訊，請參閱《AWS CLI 命令參考》**中的 [AssumeRole](https://docs.aws.amazon.com/goto/aws-cli/sts-2011-06-15/AssumeRole)。
------
#### [ C\$1\$1 ]
**適用於 C\$1\$1 的 SDK**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/sts#code-examples)中設定和執行。
```
bool AwsDoc::STS::assumeRole(const Aws::String &roleArn,
const Aws::String &roleSessionName,
const Aws::String &externalId,
Aws::Auth::AWSCredentials &credentials,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::STS::STSClient sts(clientConfig);
Aws::STS::Model::AssumeRoleRequest sts_req;
sts_req.SetRoleArn(roleArn);
sts_req.SetRoleSessionName(roleSessionName);
sts_req.SetExternalId(externalId);
const Aws::STS::Model::AssumeRoleOutcome outcome = sts.AssumeRole(sts_req);
if (!outcome.IsSuccess()) {
std::cerr << "Error assuming IAM role. " <<
outcome.GetError().GetMessage() << std::endl;
}
else {
std::cout << "Credentials successfully retrieved." << std::endl;
const Aws::STS::Model::AssumeRoleResult result = outcome.GetResult();
const Aws::STS::Model::Credentials &temp_credentials = result.GetCredentials();
// Store temporary credentials in return argument.
// Note: The credentials object returned by assumeRole differs
// from the AWSCredentials object used in most situations.
credentials.SetAWSAccessKeyId(temp_credentials.GetAccessKeyId());
credentials.SetAWSSecretKey(temp_credentials.GetSecretAccessKey());
credentials.SetSessionToken(temp_credentials.GetSessionToken());
}
return outcome.IsSuccess();
}
```
+ 如需 API 詳細資訊，請參閱 *適用於 C\$1\$1 的 AWS SDK API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/goto/SdkForCpp/sts-2011-06-15/AssumeRole)。
------
#### [ CLI ]
**AWS CLI**
**擔任角色**
下列 `assume-role` 命令會為 IAM 角色 `s3-access-example` 擷取一組短期憑證。
```
aws sts assume-role \
--role-arn arn:aws:iam::123456789012:role/xaccounts3access \
--role-session-name s3-access-example
```
輸出：
```
{
"AssumedRoleUser": {
"AssumedRoleId": "AROA3XFRBF535PLBIFPI4:s3-access-example",
"Arn": "arn:aws:sts::123456789012:assumed-role/xaccounts3access/s3-access-example"
},
"Credentials": {
"SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
"SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=",
"Expiration": "2016-03-15T00:05:07Z",
"AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"
}
}
```
該命令的輸出包含存取金鑰、私密金鑰以及可用來向 AWS進行驗證的工作階段字符。
對於 AWS CLI 使用，您可以設定與角色相關聯的具名設定檔。當您使用設定檔時，CLI AWS 會呼叫 assume-role 並為您管理登入資料。如需詳細資訊，請參閱《[CLI 使用者指南》中的在 AWS CLI 中使用 IAM 角色](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《AWS CLI 命令參考》**中的 [AssumeRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html)。
------
#### [ Java ]
**SDK for Java 2.x**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/sts#code-examples)中設定和執行。
```
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.sts.StsClient;
import software.amazon.awssdk.services.sts.model.AssumeRoleRequest;
import software.amazon.awssdk.services.sts.model.StsException;
import software.amazon.awssdk.services.sts.model.AssumeRoleResponse;
import software.amazon.awssdk.services.sts.model.Credentials;
import java.time.Instant;
import java.time.ZoneId;
import java.time.format.DateTimeFormatter;
import java.time.format.FormatStyle;
import java.util.Locale;
/**
* To make this code example work, create a Role that you want to assume.
* Then define a Trust Relationship in the AWS Console. You can use this as an
* example:
*
* {
* "Version":"2012-10-17",
* "Statement": [
* {
* "Effect": "Allow",
* "Principal": {
* "AWS": ""
* },
* "Action": "sts:AssumeRole"
* }
* ]
* }
*
* For more information, see "Editing the Trust Relationship for an Existing
* Role" in the AWS Directory Service guide.
*
* Also, set up your development environment, including your credentials.
*
* For information, see this documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class AssumeRole {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
roleArn - The Amazon Resource Name (ARN) of the role to assume (for example, arn:aws:iam::000008047983:role/s3role).\s
roleSessionName - An identifier for the assumed role session (for example, mysession).\s
""";
if (args.length != 2) {
System.out.println(usage);
System.exit(1);
}
String roleArn = args[0];
String roleSessionName = args[1];
Region region = Region.US_EAST_1;
StsClient stsClient = StsClient.builder()
.region(region)
.build();
assumeGivenRole(stsClient, roleArn, roleSessionName);
stsClient.close();
}
public static void assumeGivenRole(StsClient stsClient, String roleArn, String roleSessionName) {
try {
AssumeRoleRequest roleRequest = AssumeRoleRequest.builder()
.roleArn(roleArn)
.roleSessionName(roleSessionName)
.build();
AssumeRoleResponse roleResponse = stsClient.assumeRole(roleRequest);
Credentials myCreds = roleResponse.credentials();
// Display the time when the temp creds expire.
Instant exTime = myCreds.expiration();
String tokenInfo = myCreds.sessionToken();
// Convert the Instant to readable date.
DateTimeFormatter formatter = DateTimeFormatter.ofLocalizedDateTime(FormatStyle.SHORT)
.withLocale(Locale.US)
.withZone(ZoneId.systemDefault());
formatter.format(exTime);
System.out.println("The token " + tokenInfo + " expires on " + exTime);
} catch (StsException e) {
System.err.println(e.getMessage());
System.exit(1);
}
}
}
```
+ 如需 API 詳細資訊，請參閱 *AWS SDK for Java 2.x API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/goto/SdkForJavaV2/sts-2011-06-15/AssumeRole)。
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/sts#code-examples)中設定和執行。
建立用戶端。
```
import { STSClient } from "@aws-sdk/client-sts";
// Set the AWS Region.
const REGION = "us-east-1";
// Create an AWS STS service client object.
export const client = new STSClient({ region: REGION });
```
擔任 IAM 角色。
```
import { AssumeRoleCommand } from "@aws-sdk/client-sts";
import { client } from "../libs/client.js";
export const main = async () => {
try {
// Returns a set of temporary security credentials that you can use to
// access Amazon Web Services resources that you might not normally
// have access to.
const command = new AssumeRoleCommand({
// The Amazon Resource Name (ARN) of the role to assume.
RoleArn: "ROLE_ARN",
// An identifier for the assumed role session.
RoleSessionName: "session1",
// The duration, in seconds, of the role session. The value specified
// can range from 900 seconds (15 minutes) up to the maximum session
// duration set for the role.
DurationSeconds: 900,
});
const response = await client.send(command);
console.log(response);
} catch (err) {
console.error(err);
}
};
```
+ 如需 API 詳細資訊，請參閱 *適用於 JavaScript 的 AWS SDK API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sts/command/AssumeRoleCommand)。
**SDK for JavaScript (v2)**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/sts#code-examples)中設定和執行。
```
// Load the AWS SDK for Node.js
const AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
var roleToAssume = {
RoleArn: "arn:aws:iam::123456789012:role/RoleName",
RoleSessionName: "session1",
DurationSeconds: 900,
};
var roleCreds;
// Create the STS service object
var sts = new AWS.STS({ apiVersion: "2011-06-15" });
//Assume Role
sts.assumeRole(roleToAssume, function (err, data) {
if (err) console.log(err, err.stack);
else {
roleCreds = {
accessKeyId: data.Credentials.AccessKeyId,
secretAccessKey: data.Credentials.SecretAccessKey,
sessionToken: data.Credentials.SessionToken,
};
stsGetCallerIdentity(roleCreds);
}
});
//Get Arn of current identity
function stsGetCallerIdentity(creds) {
var stsParams = { credentials: creds };
// Create STS service object
var sts = new AWS.STS(stsParams);
sts.getCallerIdentity({}, function (err, data) {
if (err) {
console.log(err, err.stack);
} else {
console.log(data.Arn);
}
});
}
```
+ 如需 API 詳細資訊，請參閱 *適用於 JavaScript 的 AWS SDK API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/sts-2011-06-15/AssumeRole)。
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**範例 1：傳回一組臨時登入資料 （存取金鑰、私密金鑰和工作階段字符），可用於存取請求使用者通常無法存取 AWS 的資源一小時。傳回的憑證擁有所擔任角色之存取政策和提供的政策所允許的許可 (您無法使用提供的政策來授予超過所擔任角色之存取政策所定義的許可)。**
```
Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -Policy "...JSON policy..." -DurationInSeconds 3600
```
**範例 2：傳回一組臨時憑證，有效期為一小時，這些憑證擁有所擔任角色之存取政策中定義的相同許可。**
```
Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600
```
**範例 3：傳回一組臨時憑證，提供序號，以及與用於執行 cmdlet 之使用者憑證相關聯的 MFA 產生的權杖。**
```
Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 -SerialNumber "GAHT12345678" -TokenCode "123456"
```
**範例 4：傳回一組臨時憑證，這些臨時憑證擔任了客戶帳戶中定義的角色。對於第三方可以擔任的每個角色，客戶帳戶必須使用識別符來建立角色，必須在每次擔任角色時在 -ExternalId 參數中傳遞該識別符。**
```
Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 -ExternalId "ABC123"
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V4)》**中的 [AssumeRole](https://docs.aws.amazon.com/powershell/v4/reference)。
**Tools for PowerShell V5**
**範例 1：傳回一組臨時登入資料 （存取金鑰、私密金鑰和工作階段字符），可用於存取請求使用者通常無法存取 AWS 的資源一小時。傳回的憑證擁有所擔任角色之存取政策和提供的政策所允許的許可 (您無法使用提供的政策來授予超過所擔任角色之存取政策所定義的許可)。**
```
Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -Policy "...JSON policy..." -DurationInSeconds 3600
```
**範例 2：傳回一組臨時憑證，有效期為一小時，這些憑證擁有所擔任角色之存取政策中定義的相同許可。**
```
Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600
```
**範例 3：傳回一組臨時憑證，提供序號，以及與用於執行 cmdlet 之使用者憑證相關聯的 MFA 產生的權杖。**
```
Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 -SerialNumber "GAHT12345678" -TokenCode "123456"
```
**範例 4：傳回一組臨時憑證，這些臨時憑證擔任了客戶帳戶中定義的角色。對於第三方可以擔任的每個角色，客戶帳戶必須使用識別符來建立角色，必須在每次擔任角色時在 -ExternalId 參數中傳遞該識別符。**
```
Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 -ExternalId "ABC123"
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V5)》**中的 [AssumeRole](https://docs.aws.amazon.com/powershell/v5/reference)。
------
#### [ Python ]
**適用於 Python 的 SDK (Boto3)**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/sts#code-examples)中設定和執行。
擔任需要 MFA 字符的 IAM 角色，並使用暫時性憑證列出該帳戶的 Amazon S3 儲存貯體。
```
def list_buckets_from_assumed_role_with_mfa(
assume_role_arn, session_name, mfa_serial_number, mfa_totp, sts_client
):
"""
Assumes a role from another account and uses the temporary credentials from
that role to list the Amazon S3 buckets that are owned by the other account.
Requires an MFA device serial number and token.
The assumed role must grant permission to list the buckets in the other account.
:param assume_role_arn: The Amazon Resource Name (ARN) of the role that
grants access to list the other account's buckets.
:param session_name: The name of the STS session.
:param mfa_serial_number: The serial number of the MFA device. For a virtual MFA
device, this is an ARN.
:param mfa_totp: A time-based, one-time password issued by the MFA device.
:param sts_client: A Boto3 STS instance that has permission to assume the role.
"""
response = sts_client.assume_role(
RoleArn=assume_role_arn,
RoleSessionName=session_name,
SerialNumber=mfa_serial_number,
TokenCode=mfa_totp,
)
temp_credentials = response["Credentials"]
print(f"Assumed role {assume_role_arn} and got temporary credentials.")
s3_resource = boto3.resource(
"s3",
aws_access_key_id=temp_credentials["AccessKeyId"],
aws_secret_access_key=temp_credentials["SecretAccessKey"],
aws_session_token=temp_credentials["SessionToken"],
)
print(f"Listing buckets for the assumed role's account:")
for bucket in s3_resource.buckets.all():
print(bucket.name)
```
+ 如需 API 詳細資訊，請參閱 *AWS SDK for Python (Boto3) API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/goto/boto3/sts-2011-06-15/AssumeRole)。
------
#### [ Ruby ]
**SDK for Ruby**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples)中設定和執行。
```
# Creates an AWS Security Token Service (AWS STS) client with specified credentials.
# This is separated into a factory function so that it can be mocked for unit testing.
#
# @param key_id [String] The ID of the access key used by the STS client.
# @param key_secret [String] The secret part of the access key used by the STS client.
def create_sts_client(key_id, key_secret)
Aws::STS::Client.new(access_key_id: key_id, secret_access_key: key_secret)
end
# Gets temporary credentials that can be used to assume a role.
#
# @param role_arn [String] The ARN of the role that is assumed when these credentials
# are used.
# @param sts_client [AWS::STS::Client] An AWS STS client.
# @return [Aws::AssumeRoleCredentials] The credentials that can be used to assume the role.
def assume_role(role_arn, sts_client)
credentials = Aws::AssumeRoleCredentials.new(
client: sts_client,
role_arn: role_arn,
role_session_name: 'create-use-assume-role-scenario'
)
@logger.info("Assumed role '#{role_arn}', got temporary credentials.")
credentials
end
```
+ 如需 API 詳細資訊，請參閱 *適用於 Ruby 的 AWS SDK API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/goto/SdkForRubyV3/sts-2011-06-15/AssumeRole)。
------
#### [ Rust ]
**適用於 Rust 的 SDK**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/sts/#code-examples)中設定和執行。
```
async fn assume_role(config: &SdkConfig, role_name: String, session_name: Option) {
let provider = aws_config::sts::AssumeRoleProvider::builder(role_name)
.session_name(session_name.unwrap_or("rust_sdk_example_session".into()))
.configure(config)
.build()
.await;
let local_config = aws_config::from_env()
.credentials_provider(provider)
.load()
.await;
let client = Client::new(&local_config);
let req = client.get_caller_identity();
let resp = req.send().await;
match resp {
Ok(e) => {
println!("UserID : {}", e.user_id().unwrap_or_default());
println!("Account: {}", e.account().unwrap_or_default());
println!("Arn : {}", e.arn().unwrap_or_default());
}
Err(e) => println!("{:?}", e),
}
}
```
+ 如需 API 詳細資訊，請參閱《適用於 Rust 的AWS SDK API 參考》**中的 [AssumeRole](https://docs.rs/aws-sdk-sts/latest/aws_sdk_sts/client/struct.Client.html#method.assume_role)。
------
#### [ Swift ]
**適用於 Swift 的 SDK**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples)中設定和執行。
```
import AWSSTS
public func assumeRole(role: IAMClientTypes.Role, sessionName: String)
async throws -> STSClientTypes.Credentials
{
let input = AssumeRoleInput(
roleArn: role.arn,
roleSessionName: sessionName
)
do {
let output = try await stsClient.assumeRole(input: input)
guard let credentials = output.credentials else {
throw ServiceHandlerError.authError
}
return credentials
} catch {
print("Error assuming role: ", dump(error))
throw error
}
}
```
+ 如需 API 詳細資訊，請參閱 *《適用於 Swift 的AWS SDK API 參考》*中的 [AssumeRole](https://sdk.amazonaws.com/swift/api/awssts/latest/documentation/awssts/stsclient/assumerole(input:))。
------
# 搭配使用 `AssumeRoleWithWebIdentity` 與 CLI
下列程式碼範例示範如何使用 `AssumeRoleWithWebIdentity`。
------
#### [ CLI ]
**AWS CLI**
**取得使用 Web Identity (OAuth 2."0) 驗證之角色的短期憑證**
下列 `assume-role-with-web-identity` 命令會為 IAM 角色 `app1` 擷取一組短期憑證。使用指定 Web 身分提供程式提供的 Web 身分權杖來驗證身分。兩個額外的政策會套用至工作階段，進一步限制使用者可以執行的動作。傳回的憑證會在產生後一小時過期。
```
aws sts assume-role-with-web-identity \
--duration-seconds 3600 \
--role-session-name "app1" \
--provider-id "www.amazon.com" \
--policy-arns "arn:aws:iam::123456789012:policy/q=webidentitydemopolicy1","arn:aws:iam::123456789012:policy/webidentitydemopolicy2" \
--role-arn arn:aws:iam::123456789012:role/FederatedWebIdentityRole \
--web-identity-token "Atza%7CIQEBLjAsAhRFiXuWpUXuRvQ9PZL3GMFcYevydwIUFAHZwXZXXXXXXXXJnrulxKDHwy87oGKPznh0D6bEQZTSCzyoCtL_8S07pLpr0zMbn6w1lfVZKNTBdDansFBmtGnIsIapjI6xKR02Yc_2bQ8LZbUXSGm6Ry6_BG7PrtLZtj_dfCTj92xNGed-CrKqjG7nPBjNIL016GGvuS5gSvPRUxWES3VYfm1wl7WTI7jn-Pcb6M-buCgHhFOzTQxod27L9CqnOLio7N3gZAGpsp6n1-AJBOCJckcyXe2c6uD0srOJeZlKUm2eTDVMf8IehDVI0r1QOnTV6KzzAI3OY87Vd_cVMQ"
```
輸出：
```
{
"SubjectFromWebIdentityToken": "amzn1.account.AF6RHO7KZU5XRVQJGXK6HB56KR2A",
"Audience": "client.5498841531868486423.1548@apps.example.com",
"AssumedRoleUser": {
"Arn": "arn:aws:sts::123456789012:assumed-role/FederatedWebIdentityRole/app1",
"AssumedRoleId": "AROACLKWSDQRAOEXAMPLE:app1"
},
"Credentials": {
"AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
"SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
"SessionToken": "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE",
"Expiration": "2020-05-19T18:06:10+00:00"
},
"Provider": "www.amazon.com"
}
```
如需詳細資訊，請參閱《AWS IAM 使用者指南》**中的[請求臨時安全憑證](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity)。
+ 如需 API 詳細資訊，請參閱《*AWS CLI 命令參考*》中的 [AssumeRoleWithWebIdentity](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role-with-web-identity.html)。
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**範例 1：針對已使用 Login with Amazon 身分提供程式進行身分驗證的使用者，傳回一組臨時憑證，有效期為一小時。憑證會擔任與角色 ARN 所識別角色相關聯的存取政策。或者，您可以將 JSON 政策傳遞至 -Policy 參數，以進一步改進存取許可 (您授予的許可不得超過與角色相關聯的許可中可用的許可)。提供給 -WebIdentityToken 的值是身分提供程式傳回的唯一使用者識別符。**
```
Use-STSWebIdentityRole -DurationInSeconds 3600 -ProviderId "www.amazon.com" -RoleSessionName "app1" -RoleArn "arn:aws:iam::123456789012:role/FederatedWebIdentityRole" -WebIdentityToken "Atza...DVI0r1"
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V4)》**中的 [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/powershell/v4/reference)。
**Tools for PowerShell V5**
**範例 1：針對已使用 Login with Amazon 身分提供程式進行身分驗證的使用者，傳回一組臨時憑證，有效期為一小時。憑證會擔任與角色 ARN 所識別角色相關聯的存取政策。或者，您可以將 JSON 政策傳遞至 -Policy 參數，以進一步改進存取許可 (您授予的許可不得超過與角色相關聯的許可中可用的許可)。提供給 -WebIdentityToken 的值是身分提供程式傳回的唯一使用者識別符。**
```
Use-STSWebIdentityRole -DurationInSeconds 3600 -ProviderId "www.amazon.com" -RoleSessionName "app1" -RoleArn "arn:aws:iam::123456789012:role/FederatedWebIdentityRole" -WebIdentityToken "Atza...DVI0r1"
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V5)》**中的 [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/powershell/v5/reference)。
------
# 搭配使用 `DecodeAuthorizationMessage` 與 CLI
下列程式碼範例示範如何使用 `DecodeAuthorizationMessage`。
------
#### [ CLI ]
**AWS CLI**
**對回應請求時傳回的編碼授權訊息進行解碼**
以下 `decode-authorization-message` 範例將編碼訊息中與請求授權狀態相關的更多資訊進行解碼，以回應 Amazon Web Services 請求。
```
aws sts decode-authorization-message \
--encoded-message EXAMPLEWodyRNrtlQARDip-eTA6i6DrlUhHhPQrLWB_lAbl5pAKxl9mPDLexYcGBreyIKQC1BGBIpBKr3dFDkwqeO7e2NMk5j_hmzAiChJN-8oy3EwiCjkUW5fdRNjcRvscGlUo_MhqHqHpR-Ojau7BMjOTWwOtHPhV_Zaz87yENdipr745EjQwRd5LaoL3vN8_5ZfA9UiBMKDgVh1gjqZJFUiQoubv78V1RbHNYnK44ElGKmUWYa020I1y6TNS9LXoNmc62GzkfGvoPGhD13br5tXEOo1rAm3vsPewRDFNkYL-4_1MWWezhRNEpqvXBDXLI9xEux7YYkRtjd45NJLFzZynBUubV8NHOevVuighd1Mvz3OiA-1_oPSe4TBtjfN9s7kjU1z70WpVbUgrLVp1xXTK1rf9Ea7t8shPd-3VzKhjS5tLrweFxNOKwV2GtT76B_fRp8HTYz-pOu3FZjwYStfvTb3GHs3-6rLribGO9jZOktkfE6vqxlFzLyeDr4P2ihC1wty9tArCvvGzIAUNmARQJ2VVWPxioqgoqCzMaDMZEO7wkku7QeakEVZdf00qlNLMmcaVZb1UPNqD-JWP5pwe_mAyqh0NLw-r1S56YC_90onj9A80sNrHlI-tIiNd7tgNTYzDuPQYD2FMDBnp82V9eVmYGtPp5NIeSpuf3fOHanFuBZgENxZQZ2dlH3xJGMTtYayzZrRXjiq_SfX9zeBbpCvrD-0AJK477RM84vmtCrsUpJgx-FaoPIb8LmmKVBLpIB0iFhU9sEHPqKHVPi6jdxXqKaZaFGvYVmVOiuQdNQKuyk0p067POFrZECLjjOtNPBOZCcuEKEXAMPLE
```
輸出：
```
{
"DecodedMessage": "{\"allowed\":false,\"explicitDeny\":true,\"matchedStatements\":{\"items\":[{\"statementId\":\"VisualEditor0\",\"effect\":\"DENY\",\"principals\":{\"items\":[{\"value\":\"AROA123456789EXAMPLE\"}]},\"principalGroups\":{\"items\":[]},\"actions\":{\"items\":[{\"value\":\"ec2:RunInstances\"}]},\"resources\":{\"items\":[{\"value\":\"*\"}]},\"conditions\":{\"items\":[]}}]},\"failures\":{\"items\":[]},\"context\":{\"principal\":{\"id\":\"AROA123456789EXAMPLE:Ana\",\"arn\":\"arn:aws:sts::111122223333:assumed-role/Developer/Ana\"},\"action\":\"RunInstances\",\"resource\":\"arn:aws:ec2:us-east-1:111122223333:instance/*\",\"conditions\":{\"items\":[{\"key\":\"ec2:MetadataHttpPutResponseHopLimit\",\"values\":{\"items\":[{\"value\":\"2\"}]}},{\"key\":\"ec2:InstanceMarketType\",\"values\":{\"items\":[{\"value\":\"on-demand\"}]}},{\"key\":\"aws:Resource\",\"values\":{\"items\":[{\"value\":\"instance/*\"}]}},{\"key\":\"aws:Account\",\"values\":{\"items\":[{\"value\":\"111122223333\"}]}},{\"key\":\"ec2:AvailabilityZone\",\"values\":{\"items\":[{\"value\":\"us-east-1f\"}]}},{\"key\":\"ec2:ebsOptimized\",\"values\":{\"items\":[{\"value\":\"false\"}]}},{\"key\":\"ec2:IsLaunchTemplateResource\",\"values\":{\"items\":[{\"value\":\"false\"}]}},{\"key\":\"ec2:InstanceType\",\"values\":{\"items\":[{\"value\":\"t2.micro\"}]}},{\"key\":\"ec2:RootDeviceType\",\"values\":{\"items\":[{\"value\":\"ebs\"}]}},{\"key\":\"aws:Region\",\"values\":{\"items\":[{\"value\":\"us-east-1\"}]}},{\"key\":\"ec2:MetadataHttpEndpoint\",\"values\":{\"items\":[{\"value\":\"enabled\"}]}},{\"key\":\"aws:Service\",\"values\":{\"items\":[{\"value\":\"ec2\"}]}},{\"key\":\"ec2:InstanceID\",\"values\":{\"items\":[{\"value\":\"*\"}]}},{\"key\":\"ec2:MetadataHttpTokens\",\"values\":{\"items\":[{\"value\":\"required\"}]}},{\"key\":\"aws:Type\",\"values\":{\"items\":[{\"value\":\"instance\"}]}},{\"key\":\"ec2:Tenancy\",\"values\":{\"items\":[{\"value\":\"default\"}]}},{\"key\":\"ec2:Region\",\"values\":{\"items\":[{\"value\":\"us-east-1\"}]}},{\"key\":\"aws:ARN\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-1:111122223333:instance/*\"}]}}]}}}"
}
```
如需詳細資訊，請參閱 *AWS IAM User Guide* 中的 [Policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html)。
+ 如需 API 詳細資訊，請參閱《*AWS CLI 命令參考*》中的 [DecodeAuthorizationMessage](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/decode-authorization-message.html)。
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**範例 1：解碼回應請求時傳回的所提供編碼訊息內容中包含的額外資訊。會對額外資訊進行編碼，因為授權狀態的詳細資訊可能構成請求該動作的使用者不應看到的特權資訊。**
```
Convert-STSAuthorizationMessage -EncodedMessage "...encoded message..."
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V4)》**中的 [DecodeAuthorizationMessage](https://docs.aws.amazon.com/powershell/v4/reference)。
**Tools for PowerShell V5**
**範例 1：解碼回應請求時傳回的所提供編碼訊息內容中包含的額外資訊。會對額外資訊進行編碼，因為授權狀態的詳細資訊可能構成請求該動作的使用者不應看到的特權資訊。**
```
Convert-STSAuthorizationMessage -EncodedMessage "...encoded message..."
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V5)》**中的 [DecodeAuthorizationMessage](https://docs.aws.amazon.com/powershell/v5/reference)。
------
# 搭配使用 `GetFederationToken` 與 CLI
下列程式碼範例示範如何使用 `GetFederationToken`。
------
#### [ CLI ]
**AWS CLI**
**使用 IAM 使用者存取金鑰憑證傳回一組臨時安全憑證**
以下 `get-federation-token` 範例會為使用者傳回一組臨時安全憑證 (包括存取金鑰 ID、私密存取金鑰和安全權杖)。必須使用 IAM 使用者的長期安全憑證來呼叫 `GetFederationToken` 操作。
```
aws sts get-federation-token \
--name Bob \
--policy file://myfile.json \
--policy-arns arn=arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \
--duration-seconds 900
```
`myfile.json` 的內容：
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "elasticloadbalancing:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:ListMetrics",
"cloudwatch:GetMetricStatistics",
"cloudwatch:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "autoscaling:Describe*",
"Resource": "*"
}
]
}
```
輸出：
```
{
"Credentials": {
"AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
"SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
"SessionToken": "EXAMPLEpZ2luX2VjEGoaCXVzLXdlc3QtMiJIMEYCIQC/W9pL5ArQyDD5JwFL3/h5+WGopQ24GEXweNctwhi9sgIhAMkg+MZE35iWM8s4r5Lr25f9rSTVPFH98G42QQunWMTfKq0DCOP//////////wEQAxoMNDUyOTI1MTcwNTA3Igxuy3AOpuuoLsk3MJwqgQPg8QOd9HuoClUxq26wnc/nm+eZLjHDyGf2KUAHK2DuaS/nrGSEXAMPLE",
"Expiration": "2023-12-20T02:06:07+00:00"
},
"FederatedUser": {
"FederatedUserId": "111122223333:Bob",
"Arn": "arn:aws:sts::111122223333:federated-user/Bob"
},
"PackedPolicySize": 36
}
```
如需詳細資訊，請參閱《AWS IAM 使用者指南》**中的[請求臨時安全憑證](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken)。
+ 如需 API 詳細資訊，請參閱《*AWS CLI 命令參考*》中的 [GetFederationToken](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html)。
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**範例 1：使用 "Bob" 作為聯合身分使用者的名稱，請求有效期為一小時的聯合權杖。此名稱可用於參考資源型政策 (例如 Amazon S3 儲存貯體政策) 中的聯合身分使用者名稱。提供的 JSON 格式的 IAM 政策用於縮小 IAM 使用者可用的許可範圍。提供的政策授予的許可不得超過授予給請求使用者的許可，根據傳遞的政策和 IAM 使用者政策的交集，聯合身分使用者的最終許可是最具限制性的集合。**
```
Get-STSFederationToken -Name "Bob" -Policy "...JSON policy..." -DurationInSeconds 3600
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V4)》**中的 [GetFederationToken](https://docs.aws.amazon.com/powershell/v4/reference)。
**Tools for PowerShell V5**
**範例 1：使用 "Bob" 作為聯合身分使用者的名稱，請求有效期為一小時的聯合權杖。此名稱可用於參考資源型政策 (例如 Amazon S3 儲存貯體政策) 中的聯合身分使用者名稱。提供的 JSON 格式的 IAM 政策用於縮小 IAM 使用者可用的許可範圍。提供的政策授予的許可不得超過授予給請求使用者的許可，根據傳遞的政策和 IAM 使用者政策的交集，聯合身分使用者的最終許可是最具限制性的集合。**
```
Get-STSFederationToken -Name "Bob" -Policy "...JSON policy..." -DurationInSeconds 3600
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V5)》**中的 [GetFederationToken](https://docs.aws.amazon.com/powershell/v5/reference)。
------
# `GetSessionToken` 搭配 AWS SDK 或 CLI 使用
下列程式碼範例示範如何使用 `GetSessionToken`。
動作範例是大型程式的程式碼摘錄，必須在內容中執行。您可以在下列程式碼範例的內容中看到此動作：
+ [獲取需要 MFA 字符的工作階段字符](sts_example_sts_Scenario_SessionTokenMfa_section.md)
------
#### [ CLI ]
**AWS CLI**
**為 IAM 身分取得一組短期憑證**
下列 `get-session-token` 命令會為進行呼叫的 IAM 身分擷取一組短期憑證。產生的憑證可用於政策要求多重要素驗證 (MFA) 的請求。憑證會在產生後的 15 分鐘過期。
```
aws sts get-session-token \
--duration-seconds 900 \
--serial-number "YourMFADeviceSerialNumber" \
--token-code 123456
```
輸出：
```
{
"Credentials": {
"AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
"SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
"SessionToken": "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE",
"Expiration": "2020-05-19T18:06:10+00:00"
}
}
```
如需詳細資訊，請參閱《AWS IAM 使用者指南》**中的[請求臨時安全憑證](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken)。
+ 如需 API 詳細資訊，請參閱《AWS CLI 命令參考》**中的 [GetSessionToken](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-session-token.html)。
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**範例 1：傳回 `Amazon.RuntimeAWSCredentials` 執行個體，其中包含有效期為設定時間段的臨時憑證。從目前 Shell 預設值中推斷出用於請求臨時憑證的憑證。若要指定其他憑證，請使用 -ProfileName 或 -AccessKey/-SecretKey 參數。**
```
Get-STSSessionToken
```
**輸出：**
```
AccessKeyId Expiration SecretAccessKey SessionToken
----------- ---------- --------------- ------------
EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN.....
```
**範例 2：傳回 `Amazon.RuntimeAWSCredentials` 執行個體，其中包含有效期為一小時的臨時憑證。從指定的設定檔中取得用於提出請求的憑證。**
```
Get-STSSessionToken -DurationInSeconds 3600 -ProfileName myprofile
```
**輸出：**
```
AccessKeyId Expiration SecretAccessKey SessionToken
----------- ---------- --------------- ------------
EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN.....
```
**範例 3：使用在設定檔 'myprofilename' 中指定其憑證的帳戶關聯的 MFA 裝置識別碼和裝置提供的值，傳回 `Amazon.RuntimeAWSCredentials` 執行個體，其中包含有效期為一小時的臨時憑證。**
```
Get-STSSessionToken -DurationInSeconds 3600 -ProfileName myprofile -SerialNumber YourMFADeviceSerialNumber -TokenCode 123456
```
**輸出：**
```
AccessKeyId Expiration SecretAccessKey SessionToken
----------- ---------- --------------- ------------
EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN.....
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V4)》**中的 [GetSessionToken](https://docs.aws.amazon.com/powershell/v4/reference)。
**Tools for PowerShell V5**
**範例 1：傳回 `Amazon.RuntimeAWSCredentials` 執行個體，其中包含有效期為設定時間段的臨時憑證。從目前 Shell 預設值中推斷出用於請求臨時憑證的憑證。若要指定其他憑證，請使用 -ProfileName 或 -AccessKey/-SecretKey 參數。**
```
Get-STSSessionToken
```
**輸出：**
```
AccessKeyId Expiration SecretAccessKey SessionToken
----------- ---------- --------------- ------------
EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN.....
```
**範例 2：傳回 `Amazon.RuntimeAWSCredentials` 執行個體，其中包含有效期為一小時的臨時憑證。從指定的設定檔中取得用於提出請求的憑證。**
```
Get-STSSessionToken -DurationInSeconds 3600 -ProfileName myprofile
```
**輸出：**
```
AccessKeyId Expiration SecretAccessKey SessionToken
----------- ---------- --------------- ------------
EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN.....
```
**範例 3：使用在設定檔 'myprofilename' 中指定其憑證的帳戶關聯的 MFA 裝置識別碼和裝置提供的值，傳回 `Amazon.RuntimeAWSCredentials` 執行個體，其中包含有效期為一小時的臨時憑證。**
```
Get-STSSessionToken -DurationInSeconds 3600 -ProfileName myprofile -SerialNumber YourMFADeviceSerialNumber -TokenCode 123456
```
**輸出：**
```
AccessKeyId Expiration SecretAccessKey SessionToken
----------- ---------- --------------- ------------
EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN.....
```
+ 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V5)》**中的 [GetSessionToken](https://docs.aws.amazon.com/powershell/v5/reference)。
------
#### [ Python ]
**適用於 Python 的 SDK (Boto3)**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/sts#code-examples)中設定和執行。
透過傳遞 MFA 字符取得工作階段字符，並使用它列出該帳戶的 Amazon S3 儲存貯體。
```
def list_buckets_with_session_token_with_mfa(mfa_serial_number, mfa_totp, sts_client):
"""
Gets a session token with MFA credentials and uses the temporary session
credentials to list Amazon S3 buckets.
Requires an MFA device serial number and token.
:param mfa_serial_number: The serial number of the MFA device. For a virtual MFA
device, this is an Amazon Resource Name (ARN).
:param mfa_totp: A time-based, one-time password issued by the MFA device.
:param sts_client: A Boto3 STS instance that has permission to assume the role.
"""
if mfa_serial_number is not None:
response = sts_client.get_session_token(
SerialNumber=mfa_serial_number, TokenCode=mfa_totp
)
else:
response = sts_client.get_session_token()
temp_credentials = response["Credentials"]
s3_resource = boto3.resource(
"s3",
aws_access_key_id=temp_credentials["AccessKeyId"],
aws_secret_access_key=temp_credentials["SecretAccessKey"],
aws_session_token=temp_credentials["SessionToken"],
)
print(f"Buckets for the account:")
for bucket in s3_resource.buckets.all():
print(bucket.name)
```
+ 如需 API 詳細資訊，請參閱 *AWS SDK for Python (Boto3) API Reference* 中的 [GetSessionToken](https://docs.aws.amazon.com/goto/boto3/sts-2011-06-15/GetSessionToken)。
------
# AWS STS 使用 AWS SDKs案例
下列程式碼範例示範如何在 AWS SDKs中 AWS STS 實作常見案例。這些案例說明如何透過在 中呼叫多個函數 AWS STS 或與其他函數結合，來完成特定任務 AWS 服務。每個案例均包含完整原始碼的連結，您可在連結中找到如何設定和執行程式碼的相關指示。
案例的目標是獲得中等水平的經驗，協助您了解內容中的服務動作。
**Topics**
+ [擔任需要 MFA 字符的 IAM 角色](sts_example_sts_Scenario_AssumeRoleMfa_section.md)
+ [為聯合身分使用者建構 URL](sts_example_sts_Scenario_ConstructFederatedUrl_section.md)
+ [獲取需要 MFA 字符的工作階段字符](sts_example_sts_Scenario_SessionTokenMfa_section.md)
# 使用 SDK 搭配 擔任需要 MFA 字符 AWS STS 的 IAM 角色 AWS
下列程式碼範例示範如何擔任需要 MFA 權杖的角色。
**警告**
為避免安全風險，在開發專用軟體或使用真實資料時，請勿使用 IAM 使用者進行身分驗證。相反地，搭配使用聯合功能和身分提供者，例如 [AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)。
+ 建立一個可授予許可的 IAM 角色，以列出 Amazon S3 儲存貯體。
+ 建立 IAM 使用者，該使用者只有在提供 MFA 憑證時才具有擔任該角色的許可。
+ 為使用者註冊 MFA 裝置。
+ 擔任角色並使用暫時性憑證列出 S3 儲存貯體。
------
#### [ Python ]
**適用於 Python 的 SDK (Boto3)**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/sts#code-examples)中設定和執行。
建立 IAM 使用者，註冊 MFA 裝置，並建立一個可授予許可以列出 S3 儲存貯體的角色。使用者只有擔任該角色的權利。
```
def setup(iam_resource):
"""
Creates a new user with no permissions.
Creates a new virtual MFA device.
Displays the QR code to seed the device.
Asks for two codes from the MFA device.
Registers the MFA device for the user.
Creates an access key pair for the user.
Creates a role with a policy that lets the user assume the role and requires MFA.
Creates a policy that allows listing Amazon S3 buckets.
Attaches the policy to the role.
Creates an inline policy for the user that lets the user assume the role.
For demonstration purposes, the user is created in the same account as the role,
but in practice the user would likely be from another account.
Any MFA device that can scan a QR code will work with this demonstration.
Common choices are mobile apps like LastPass Authenticator,
Microsoft Authenticator, or Google Authenticator.
:param iam_resource: A Boto3 AWS Identity and Access Management (IAM) resource
that has permissions to create users, roles, and policies
in the account.
:return: The newly created user, user key, virtual MFA device, and role.
"""
user = iam_resource.create_user(UserName=unique_name("user"))
print(f"Created user {user.name}.")
virtual_mfa_device = iam_resource.create_virtual_mfa_device(
VirtualMFADeviceName=unique_name("mfa")
)
print(f"Created virtual MFA device {virtual_mfa_device.serial_number}")
print(
f"Showing the QR code for the device. Scan this in the MFA app of your "
f"choice."
)
with open("qr.png", "wb") as qr_file:
qr_file.write(virtual_mfa_device.qr_code_png)
webbrowser.open(qr_file.name)
print(f"Enter two consecutive code from your MFA device.")
mfa_code_1 = input("Enter the first code: ")
mfa_code_2 = input("Enter the second code: ")
user.enable_mfa(
SerialNumber=virtual_mfa_device.serial_number,
AuthenticationCode1=mfa_code_1,
AuthenticationCode2=mfa_code_2,
)
os.remove(qr_file.name)
print(f"MFA device is registered with the user.")
user_key = user.create_access_key_pair()
print(f"Created access key pair for user.")
print(f"Wait for user to be ready.", end="")
progress_bar(10)
role = iam_resource.create_role(
RoleName=unique_name("role"),
AssumeRolePolicyDocument=json.dumps(
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {"AWS": user.arn},
"Action": "sts:AssumeRole",
"Condition": {"Bool": {"aws:MultiFactorAuthPresent": True}},
}
],
}
),
)
print(f"Created role {role.name} that requires MFA.")
policy = iam_resource.create_policy(
PolicyName=unique_name("policy"),
PolicyDocument=json.dumps(
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "arn:aws:s3:::*",
}
],
}
),
)
role.attach_policy(PolicyArn=policy.arn)
print(f"Created policy {policy.policy_name} and attached it to the role.")
user.create_policy(
PolicyName=unique_name("user-policy"),
PolicyDocument=json.dumps(
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": role.arn,
}
],
}
),
)
print(
f"Created an inline policy for {user.name} that lets the user assume "
f"the role."
)
print("Give AWS time to propagate these new resources and connections.", end="")
progress_bar(10)
return user, user_key, virtual_mfa_device, role
```
說明如果沒有 MFA 字符，不允許擔任角色。
```
def try_to_assume_role_without_mfa(assume_role_arn, session_name, sts_client):
"""
Shows that attempting to assume the role without sending MFA credentials results
in an AccessDenied error.
:param assume_role_arn: The Amazon Resource Name (ARN) of the role to assume.
:param session_name: The name of the STS session.
:param sts_client: A Boto3 STS instance that has permission to assume the role.
"""
print(f"Trying to assume the role without sending MFA credentials...")
try:
sts_client.assume_role(RoleArn=assume_role_arn, RoleSessionName=session_name)
raise RuntimeError("Expected AccessDenied error.")
except ClientError as error:
if error.response["Error"]["Code"] == "AccessDenied":
print("Got AccessDenied.")
else:
raise
```
擔任可授予許可以列出 S3 儲存貯體的角色，傳遞所需 MFA 字符，並顯示可列出的儲存貯體。
```
def list_buckets_from_assumed_role_with_mfa(
assume_role_arn, session_name, mfa_serial_number, mfa_totp, sts_client
):
"""
Assumes a role from another account and uses the temporary credentials from
that role to list the Amazon S3 buckets that are owned by the other account.
Requires an MFA device serial number and token.
The assumed role must grant permission to list the buckets in the other account.
:param assume_role_arn: The Amazon Resource Name (ARN) of the role that
grants access to list the other account's buckets.
:param session_name: The name of the STS session.
:param mfa_serial_number: The serial number of the MFA device. For a virtual MFA
device, this is an ARN.
:param mfa_totp: A time-based, one-time password issued by the MFA device.
:param sts_client: A Boto3 STS instance that has permission to assume the role.
"""
response = sts_client.assume_role(
RoleArn=assume_role_arn,
RoleSessionName=session_name,
SerialNumber=mfa_serial_number,
TokenCode=mfa_totp,
)
temp_credentials = response["Credentials"]
print(f"Assumed role {assume_role_arn} and got temporary credentials.")
s3_resource = boto3.resource(
"s3",
aws_access_key_id=temp_credentials["AccessKeyId"],
aws_secret_access_key=temp_credentials["SecretAccessKey"],
aws_session_token=temp_credentials["SessionToken"],
)
print(f"Listing buckets for the assumed role's account:")
for bucket in s3_resource.buckets.all():
print(bucket.name)
```
銷毀為示範所建立的資源。
```
def teardown(user, virtual_mfa_device, role):
"""
Removes all resources created during setup.
:param user: The demo user.
:param role: The demo role.
"""
for attached in role.attached_policies.all():
policy_name = attached.policy_name
role.detach_policy(PolicyArn=attached.arn)
attached.delete()
print(f"Detached and deleted {policy_name}.")
role.delete()
print(f"Deleted {role.name}.")
for user_pol in user.policies.all():
user_pol.delete()
print("Deleted inline user policy.")
for key in user.access_keys.all():
key.delete()
print("Deleted user's access key.")
for mfa in user.mfa_devices.all():
mfa.disassociate()
virtual_mfa_device.delete()
user.delete()
print(f"Deleted {user.name}.")
```
使用先前定義的函數執行此案例。
```
def usage_demo():
"""Drives the demonstration."""
print("-" * 88)
print(
f"Welcome to the AWS Security Token Service assume role demo, "
f"starring multi-factor authentication (MFA)!"
)
print("-" * 88)
iam_resource = boto3.resource("iam")
user, user_key, virtual_mfa_device, role = setup(iam_resource)
print(f"Created {user.name} and {role.name}.")
try:
sts_client = boto3.client(
"sts", aws_access_key_id=user_key.id, aws_secret_access_key=user_key.secret
)
try_to_assume_role_without_mfa(role.arn, "demo-sts-session", sts_client)
mfa_totp = input("Enter the code from your registered MFA device: ")
list_buckets_from_assumed_role_with_mfa(
role.arn,
"demo-sts-session",
virtual_mfa_device.serial_number,
mfa_totp,
sts_client,
)
finally:
teardown(user, virtual_mfa_device, role)
print("Thanks for watching!")
```
+ 如需 API 詳細資訊，請參閱 *AWS SDK for Python (Boto3) API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/goto/boto3/sts-2011-06-15/AssumeRole)。
------
# 使用 AWS SDK AWS STS 為聯合身分使用者使用 建構 URL
以下程式碼範例顯示做法：
+ 建立可對目前帳戶的 Amazon S3 資源授予唯讀存取權的 IAM 角色。
+ 從 AWS 聯合端點取得安全字符。
+ 建構可用來使用聯合憑證存取主控台的 URL。
------
#### [ Python ]
**適用於 Python 的 SDK (Boto3)**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/sts#code-examples)中設定和執行。
建立可對目前帳戶的 S3 資源授予唯讀存取權的角色。
```
def setup(iam_resource):
"""
Creates a role that can be assumed by the current user.
Attaches a policy that allows only Amazon S3 read-only access.
:param iam_resource: A Boto3 AWS Identity and Access Management (IAM) instance
that has the permission to create a role.
:return: The newly created role.
"""
role = iam_resource.create_role(
RoleName=unique_name("role"),
AssumeRolePolicyDocument=json.dumps(
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {"AWS": iam_resource.CurrentUser().arn},
"Action": "sts:AssumeRole",
}
],
}
),
)
role.attach_policy(PolicyArn="arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess")
print(f"Created role {role.name}.")
print("Give AWS time to propagate these new resources and connections.", end="")
progress_bar(10)
return role
```
從 AWS 聯合端點取得安全字符，並建構可用於使用聯合憑證存取主控台的 URL。
```
def construct_federated_url(assume_role_arn, session_name, issuer, sts_client):
"""
Constructs a URL that gives federated users direct access to the AWS Management
Console.
1. Acquires temporary credentials from AWS Security Token Service (AWS STS) that
can be used to assume a role with limited permissions.
2. Uses the temporary credentials to request a sign-in token from the
AWS federation endpoint.
3. Builds a URL that can be used in a browser to navigate to the AWS federation
endpoint, includes the sign-in token for authentication, and redirects to
the AWS Management Console with permissions defined by the role that was
specified in step 1.
:param assume_role_arn: The role that specifies the permissions that are granted.
The current user must have permission to assume the role.
:param session_name: The name for the STS session.
:param issuer: The organization that issues the URL.
:param sts_client: A Boto3 STS instance that can assume the role.
:return: The federated URL.
"""
response = sts_client.assume_role(
RoleArn=assume_role_arn, RoleSessionName=session_name
)
temp_credentials = response["Credentials"]
print(f"Assumed role {assume_role_arn} and got temporary credentials.")
session_data = {
"sessionId": temp_credentials["AccessKeyId"],
"sessionKey": temp_credentials["SecretAccessKey"],
"sessionToken": temp_credentials["SessionToken"],
}
aws_federated_signin_endpoint = "https://signin.aws.amazon.com/federation"
# Make a request to the AWS federation endpoint to get a sign-in token.
# The requests.get function URL-encodes the parameters and builds the query string
# before making the request.
response = requests.get(
aws_federated_signin_endpoint,
params={
"Action": "getSigninToken",
"SessionDuration": str(datetime.timedelta(hours=12).seconds),
"Session": json.dumps(session_data),
},
)
signin_token = json.loads(response.text)
print(f"Got a sign-in token from the AWS sign-in federation endpoint.")
# Make a federated URL that can be used to sign into the AWS Management Console.
query_string = urllib.parse.urlencode(
{
"Action": "login",
"Issuer": issuer,
"Destination": "https://console.aws.amazon.com/",
"SigninToken": signin_token["SigninToken"],
}
)
federated_url = f"{aws_federated_signin_endpoint}?{query_string}"
return federated_url
```
銷毀為示範所建立的資源。
```
def teardown(role):
"""
Removes all resources created during setup.
:param role: The demo role.
"""
for attached in role.attached_policies.all():
role.detach_policy(PolicyArn=attached.arn)
print(f"Detached {attached.policy_name}.")
role.delete()
print(f"Deleted {role.name}.")
```
使用先前定義的函數執行此案例。
```
def usage_demo():
"""Drives the demonstration."""
print("-" * 88)
print(f"Welcome to the AWS Security Token Service federated URL demo.")
print("-" * 88)
iam_resource = boto3.resource("iam")
role = setup(iam_resource)
sts_client = boto3.client("sts")
try:
federated_url = construct_federated_url(
role.arn, "AssumeRoleDemoSession", "example.org", sts_client
)
print(
"Constructed a federated URL that can be used to connect to the "
"AWS Management Console with role-defined permissions:"
)
print("-" * 88)
print(federated_url)
print("-" * 88)
_ = input(
"Copy and paste the above URL into a browser to open the AWS "
"Management Console with limited permissions. When done, press "
"Enter to clean up and complete this demo."
)
finally:
teardown(role)
print("Thanks for watching!")
```
+ 如需 API 詳細資訊，請參閱 *AWS SDK for Python (Boto3) API Reference* 中的 [AssumeRole](https://docs.aws.amazon.com/goto/boto3/sts-2011-06-15/AssumeRole)。
------
# AWS STS 使用 AWS SDK 透過 取得需要 MFA 字符的工作階段字符
下列程式碼範例示範如何獲取需要 MFA 權杖的工作階段字符。
**警告**
為避免安全風險，在開發專用軟體或使用真實資料時，請勿使用 IAM 使用者進行身分驗證。相反地，搭配使用聯合功能和身分提供者，例如 [AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)。
+ 建立一個可授予許可的 IAM 角色，以列出 Amazon S3 儲存貯體。
+ 建立 IAM 使用者，該使用者只有在提供 MFA 憑證時才具有擔任該角色的許可。
+ 為使用者註冊 MFA 裝置。
+ 提供 MFA 憑證以取得工作階段權杖，並使用暫時性憑證列出 S3 儲存貯體。
------
#### [ Python ]
**適用於 Python 的 SDK (Boto3)**
GitHub 上提供更多範例。尋找完整範例，並了解如何在 [AWS 程式碼範例儲存庫](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/sts#code-examples)中設定和執行。
建立 IAM 使用者，註冊 MFA 裝置，並建立角色，授予許可以便在使用 MFA 憑證時讓使用者僅列出 S3 儲存貯體。
```
def setup(iam_resource):
"""
Creates a new user with no permissions.
Creates a new virtual multi-factor authentication (MFA) device.
Displays the QR code to seed the device.
Asks for two codes from the MFA device.
Registers the MFA device for the user.
Creates an access key pair for the user.
Creates an inline policy for the user that lets the user list Amazon S3 buckets,
but only when MFA credentials are used.
Any MFA device that can scan a QR code will work with this demonstration.
Common choices are mobile apps like LastPass Authenticator,
Microsoft Authenticator, or Google Authenticator.
:param iam_resource: A Boto3 AWS Identity and Access Management (IAM) resource
that has permissions to create users, MFA devices, and
policies in the account.
:return: The newly created user, user key, and virtual MFA device.
"""
user = iam_resource.create_user(UserName=unique_name("user"))
print(f"Created user {user.name}.")
virtual_mfa_device = iam_resource.create_virtual_mfa_device(
VirtualMFADeviceName=unique_name("mfa")
)
print(f"Created virtual MFA device {virtual_mfa_device.serial_number}")
print(
f"Showing the QR code for the device. Scan this in the MFA app of your "
f"choice."
)
with open("qr.png", "wb") as qr_file:
qr_file.write(virtual_mfa_device.qr_code_png)
webbrowser.open(qr_file.name)
print(f"Enter two consecutive code from your MFA device.")
mfa_code_1 = input("Enter the first code: ")
mfa_code_2 = input("Enter the second code: ")
user.enable_mfa(
SerialNumber=virtual_mfa_device.serial_number,
AuthenticationCode1=mfa_code_1,
AuthenticationCode2=mfa_code_2,
)
os.remove(qr_file.name)
print(f"MFA device is registered with the user.")
user_key = user.create_access_key_pair()
print(f"Created access key pair for user.")
print(f"Wait for user to be ready.", end="")
progress_bar(10)
user.create_policy(
PolicyName=unique_name("user-policy"),
PolicyDocument=json.dumps(
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "arn:aws:s3:::*",
"Condition": {"Bool": {"aws:MultiFactorAuthPresent": True}},
}
],
}
),
)
print(
f"Created an inline policy for {user.name} that lets the user list buckets, "
f"but only when MFA credentials are present."
)
print("Give AWS time to propagate these new resources and connections.", end="")
progress_bar(10)
return user, user_key, virtual_mfa_device
```
透過傳遞 MFA 字符獲取暫時性工作階段憑證，並使用憑證列出該帳戶的 S3 儲存貯體。
```
def list_buckets_with_session_token_with_mfa(mfa_serial_number, mfa_totp, sts_client):
"""
Gets a session token with MFA credentials and uses the temporary session
credentials to list Amazon S3 buckets.
Requires an MFA device serial number and token.
:param mfa_serial_number: The serial number of the MFA device. For a virtual MFA
device, this is an Amazon Resource Name (ARN).
:param mfa_totp: A time-based, one-time password issued by the MFA device.
:param sts_client: A Boto3 STS instance that has permission to assume the role.
"""
if mfa_serial_number is not None:
response = sts_client.get_session_token(
SerialNumber=mfa_serial_number, TokenCode=mfa_totp
)
else:
response = sts_client.get_session_token()
temp_credentials = response["Credentials"]
s3_resource = boto3.resource(
"s3",
aws_access_key_id=temp_credentials["AccessKeyId"],
aws_secret_access_key=temp_credentials["SecretAccessKey"],
aws_session_token=temp_credentials["SessionToken"],
)
print(f"Buckets for the account:")
for bucket in s3_resource.buckets.all():
print(bucket.name)
```
銷毀為示範所建立的資源。
```
def teardown(user, virtual_mfa_device):
"""
Removes all resources created during setup.
:param user: The demo user.
:param role: The demo MFA device.
"""
for user_pol in user.policies.all():
user_pol.delete()
print("Deleted inline user policy.")
for key in user.access_keys.all():
key.delete()
print("Deleted user's access key.")
for mfa in user.mfa_devices.all():
mfa.disassociate()
virtual_mfa_device.delete()
user.delete()
print(f"Deleted {user.name}.")
```
使用先前定義的函數執行此案例。
```
def usage_demo():
"""Drives the demonstration."""
print("-" * 88)
print(
f"Welcome to the AWS Security Token Service assume role demo, "
f"starring multi-factor authentication (MFA)!"
)
print("-" * 88)
iam_resource = boto3.resource("iam")
user, user_key, virtual_mfa_device = setup(iam_resource)
try:
sts_client = boto3.client(
"sts", aws_access_key_id=user_key.id, aws_secret_access_key=user_key.secret
)
try:
print("Listing buckets without specifying MFA credentials.")
list_buckets_with_session_token_with_mfa(None, None, sts_client)
except ClientError as error:
if error.response["Error"]["Code"] == "AccessDenied":
print("Got expected AccessDenied error.")
mfa_totp = input("Enter the code from your registered MFA device: ")
list_buckets_with_session_token_with_mfa(
virtual_mfa_device.serial_number, mfa_totp, sts_client
)
finally:
teardown(user, virtual_mfa_device)
print("Thanks for watching!")
```
+ 如需 API 詳細資訊，請參閱 *AWS SDK for Python (Boto3) API Reference* 中的 [GetSessionToken](https://docs.aws.amazon.com/goto/boto3/sts-2011-06-15/GetSessionToken)。
------