阿里云OSS的STS授权访问,我的理解就是生成临时key给用户，临时访问oss桶用的

原文：

https://www.cnblogs.com/ou11/p/10133217.html

1.在阿里云控制台-访问控制中创建读写权限策略

https://help.aliyun.com/document_detail/31935.html?spm=5176.doc32069.2.4.AxKPsA%EF%BC%89

新建自定义策略

 

权限策略格式

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "oss:DeleteObject",
                "oss:ListParts",
                "oss:AbortMultipartUpload",
                "oss:PutObject",
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:YourBucketName",
                "acs:oss:*:*:YourBucketName/*"
            ]
        }
    ]
}

 

2.创建角色

新建RAM角色

3.为新增的角色添加自定义权限策略

 

 

 

 

 

 获取到ARN

 

 

4.创建子账号

获取到AccessKeyID和AccessKeySecret

为该用户添加调用STS服务AssumeRole接口的权限

 

 5.服务端调用

添加依赖

<dependency>
    <groupId>com.aliyun</groupId>
    <artifactId>aliyun-java-sdk-sts</artifactId>
    <version>3.0.0</version>
</dependency>
<dependency>
    <groupId>com.aliyun</groupId>
    <artifactId>aliyun-java-sdk-core</artifactId>
    <version>3.5.0</version>
</dependency>

赋予角色方法

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

/**       * 赋予角色       *       * @param accessKeyId       * @param accessKeySecret       * @param roleArn       * @param roleSessionName       * @param policy       * @param seconds       * @param protocolType       * @return       * @author 欧解决       * @date 2018-12-17 17:32:18       **/      public  AssumeRoleResponse assumeRole(              String regionId,              String accessKeyId,              String accessKeySecret,              String roleArn,              String roleSessionName,              String policy,              Long seconds) {          try  {              // 创建一个 Aliyun Acs Client, 用于发起 OpenAPI 请求              IClientProfile profile = DefaultProfile.getProfile(regionId, accessKeyId, accessKeySecret);              DefaultAcsClient client =  new  DefaultAcsClient(profile);              // 创建一个 AssumeRoleRequest 并设置请求参数              final  AssumeRoleRequest request =  new  AssumeRoleRequest();              //POST请求              request.setMethod(MethodType.POST);              //https协议              request.setProtocol(ProtocolType.HTTPS);              //持续时间              request.setDurationSeconds(seconds);              //角色id              request.setRoleArn(roleArn);              //应用程序标识(自己定义)              request.setRoleSessionName(roleSessionName);              //在赋予角色的同时,还赋予其他的权限策略              request.setPolicy(policy);              // 发起请求，并得到response              final  AssumeRoleResponse response = client.getAcsResponse(request);              return  response;          }  catch  (Exception e) {              e.printStackTrace();          }          return  null ;      }

Controller调用

　　@Autowired
　　private OSSProperties ossProperties;
　　@Autowired
　　private StsService stsService;

　　/**
     * 签名授权
     *
     * @return
     * @author 欧解决
     * @date 2018-12-17 15:08:55
     **/
    @GetMapping("/getOssToken")
    public Object getOssToken() {
            AssumeRoleResponse response = stsService.assumeRole(
                    ossProperties.getRegionId(),
                    ossProperties.getAccessKey(),
                    ossProperties.getAccessSecret(),
                    ossProperties.getRoleArn(),
                    "my-session-name",
                    null,
                    3600L
            );
            if (response != null) {
                return new BaseTRo<>(response.getCredentials());
            }
            return new BaseRo(SystemError.ProcessMsg, "OssToken获取失败");
    }

接口返回数据

1 2 3 4 5 6 7 8 9 10

{      "code" :  "0" ,      "msg" :  "" ,      "data" : {          "securityToken" :  "CAIS7gF1q6Ft5B2yfSjIr4vaMc+F2Ilz+7ahTH+IgXgFfuQY3LzdtTz2IHxJfHBhBusev/4+mGlT5/8ZlqNzVplUWEqBZNNxtn6HNrUyJ9ivgde8yJBZor/HcDHhJnyW9cvWZPqDP7G5U/yxalfCuzZuyL/hD1uLVECkNpv74vwOLK5gPG+CYCFBGc1dKyZ7tcYeLgGxD/u2NQPwiWeiZygB+CgE0DMvs/rknJPAs0KE1QalltV4/dqhfsKWCOB3J4p6XtuP2+h7S7HMyiY46WIRqPou1f0bom+W5IDBWgIAuk6cXurJ48BpPNnK5EGq9GovGoABfy0gMkLTYW4gEzdc5wxcZNWl/orL/DmvymDIWe1M/u/JUDpA3NfQTTnxG9xSxTz4lwPeEG9LgoYZzXuDTtmRcl/wQetvjDU7PBC1urYMNtVlyaST3jGfa+WU0zAW57zOBqeBejxui9AE1JCOcg2CDA/u5Mz2Hu79Ci7UTJ0eusw=" ,          "accessKeySecret" :  "FAA1KeGnmMEWjYHaKuL5WP5NSeVVFor7hMHd4VBQ7Uaa" ,          "accessKeyId" :  "STS.NHozu15VRLuJNY9exPrk13yvW" ,          "expiration" :  "2018-12-17T11:52:38Z"      } }