如何使用 java sdk 创建具有权限的 aws 角色？答案

【问题标题】：How to create aws role with permission using java sdk?如何使用 java sdk 创建具有权限的 aws 角色？
【发布时间】：2020-10-20 01:22:27
【问题描述】：

我正在尝试创建具有特定权限的角色，但没有成功：

这是我的许可：

    String jsonRole = "{" + 
            "    \"Version\": \"2012-10-17\"," + 
            "    \"Statement\": [" + 
            "        {" + 
            "            \"Effect\": \"Allow\"," + 
            "            \"Action\": [" + 
            "                \"s3:PutObject\"," + 
            "                \"s3:GetObject\"," + 
            "                \"s3:GetObjectVersion\"," + 
            "                \"s3:DeleteObject\"," + 
            "                \"s3:DeleteObjectVersion\"" + 
            "            ]," + 
            "            \"Resource\": \"arn:aws:s3:::"+artifactsBucket+"/"+company.getCompanyId()+"/*\"" + 
            "        }" + 
            "    ]" + 
            "}";

以及创建角色的命令：

AmazonIdentityManagement client = AmazonIdentityManagementClientBuilder.standard().build();
CreateRoleRequest request = new CreateRoleRequest().withPath("/companies-bucket-roles/").withRoleName(company.getName()+"-"+consoleUser.getConsoleUserId());

但我不知道如何为角色添加权限。我在文档中一无所获。有什么想法吗？

提前致谢

【问题讨论】：

您使用该文档创建策略，然后将该策略应用于角色。
@jordanm 你有示例或文档链接吗？我需要它来了解如何做
docs.aws.amazon.com/sdk-for-java/v1/developer-guide/…

标签： java amazon-web-services amazon-s3 aws-sdk amazon-iam

【解决方案1】：

如果您想创建角色并添加策略，这是完整的代码：

        String jsonPolicyDocument = "{" + 
                "    \"Version\": \"2012-10-17\"," + 
                "    \"Statement\": [" + 
                "        {" + 
                "            \"Effect\": \"Allow\"," + 
                "            \"Action\": [" + 
                "                \"s3:PutObject\"," + 
                "                \"s3:GetObject\"," + 
                "                \"s3:GetObjectVersion\"," + 
                "                \"s3:DeleteObject\"," + 
                "                \"s3:DeleteObjectVersion\"" + 
                "            ]," + 
                "            \"Resource\": \"arn:aws:s3:::"+artifactsBucket+"/"+company.getCompanyId()+"/*\"" + 
                "        }" + 
                "    ]" + 
                "}";

        String assumeRolePolicyDocument = "{" + 
                "  \"Version\": \"2012-10-17\"," + 
                "  \"Statement\": [" + 
                "    {" + 
                "      \"Effect\": \"Allow\"," + 
                "      \"Principal\": {" + 
                "        \"Federated\": \"cognito-identity.amazonaws.com\"" + 
                "      }," + 
                "      \"Action\": \"sts:AssumeRoleWithWebIdentity\"," + 
                "      \"Condition\": {" + 
                "        \"StringEquals\": {" + 
                "          \"cognito-identity.amazonaws.com:aud\": \""+poolId+"\"" + 
                "        }," + 
                "        \"ForAnyValue:StringLike\": {" + 
                "          \"cognito-identity.amazonaws.com:amr\": \"authenticated\"" + 
                "        }" + 
                "      }" + 
                "    }" + 
                "  ]" + 
                "}";
        
        
        AmazonIdentityManagement client = AmazonIdentityManagementClientBuilder.standard().build();
        // First create a policy
        CreatePolicyRequest policyRequest = new CreatePolicyRequest()
                .withPolicyName("company_" + company.getCompanyId() + "_s3bucket" + "_policy")
                .withPolicyDocument(jsonPolicyDocument)
                .withDescription("Policy created for the company "+company.getCompanyId()+". This policy give access to S3 bucket for this company");

        CreatePolicyResult policyResponse = client.createPolicy(policyRequest);

        String roleName = "company_" + company.getCompanyId() +  "_role";
        CreateRoleRequest request = new CreateRoleRequest()
                .withPath("/"+rolesFolder+"/")
                .withRoleName(roleName)
                .withAssumeRolePolicyDocument(assumeRolePolicyDocument)
                .withDescription("Role created for the company "+company.getCompanyId()+". This Role has for example policy for S3 bucket");
        CreateRoleResult response = client.createRole(request);

        // Attach the policy to the role
        AttachRolePolicyRequest attachRequest =  new AttachRolePolicyRequest()
                .withRoleName(roleName)
                .withPolicyArn(policyResponse.getPolicy().getArn());

        AttachRolePolicyResult attachRolePolicyResult = client.attachRolePolicy(attachRequest);


        logger.info(attachRolePolicyResult);

【讨论】：