Examples with AssumeRoleRequest com.amazonaws.services.securitytoken.model.AssumeRoleRequest used on opensource projects

Example 31 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project knime-cloud by knime.

the class AmazonCredentialHelper method getCredential.

/**
 * @param connectionInformation CloudConnectionInformation to create credentials for
 * @return {@link AWSCredentials} for the given {@link CloudConnectionInformation}
 * @throws Exception
 */
public static AWSCredentials getCredential(final CloudConnectionInformation connectionInformation) throws Exception {
    final AWSSecurityTokenServiceClientBuilder builder = AWSSecurityTokenServiceClientBuilder.standard().withRegion(connectionInformation.getHost());
    if (!connectionInformation.useKeyChain()) {
        AWSCredentials credentials;
        credentials = getCredentials(connectionInformation);
        builder.withCredentials(new AWSStaticCredentialsProvider(credentials));
    }
    final AWSSecurityTokenService stsClient = builder.build();
    final AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest().withRoleArn(buildARN(connectionInformation)).withDurationSeconds(3600).withRoleSessionName("KNIME_S3_Connection");
    final AssumeRoleResult assumeResult = stsClient.assumeRole(assumeRoleRequest);
    final BasicSessionCredentials credentials = new BasicSessionCredentials(assumeResult.getCredentials().getAccessKeyId(), assumeResult.getCredentials().getSecretAccessKey(), assumeResult.getCredentials().getSessionToken());
    return credentials;
}

Example 32 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project aws-doc-sdk-examples by awsdocs.

the class MakingRequestsWithIAMTempCredentials method main.

public static void main(String[] args) {
    String clientRegion = "*** Client region ***";
    String roleARN = "*** ARN for role to be assumed ***";
    String roleSessionName = "*** Role session name ***";
    String bucketName = "*** Bucket name ***";
    try {
        // Creating the STS client is part of your trusted code. It has
        // the security credentials you use to obtain temporary security credentials.
        AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder.standard().withCredentials(new ProfileCredentialsProvider()).withRegion(clientRegion).build();
        // Obtain credentials for the IAM role. Note that you cannot assume the role of an AWS root account;
        // Amazon S3 will deny access. You must use credentials for an IAM user or an IAM role.
        AssumeRoleRequest roleRequest = new AssumeRoleRequest().withRoleArn(roleARN).withRoleSessionName(roleSessionName);
        AssumeRoleResult roleResponse = stsClient.assumeRole(roleRequest);
        Credentials sessionCredentials = roleResponse.getCredentials();
        // Create a BasicSessionCredentials object that contains the credentials you just retrieved.
        BasicSessionCredentials awsCredentials = new BasicSessionCredentials(sessionCredentials.getAccessKeyId(), sessionCredentials.getSecretAccessKey(), sessionCredentials.getSessionToken());
        // Provide temporary security credentials so that the Amazon S3 client
        // can send authenticated requests to Amazon S3. You create the client
        // using the sessionCredentials object.
        AmazonS3 s3Client = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(awsCredentials)).withRegion(clientRegion).build();
        // Verify that assuming the role worked and the permissions are set correctly
        // by getting a set of object keys from the bucket.
        ObjectListing objects = s3Client.listObjects(bucketName);
        System.out.println("No. of Objects: " + objects.getObjectSummaries().size());
    } catch (AmazonServiceException e) {
        // The call was transmitted successfully, but Amazon S3 couldn't process
        // it, so it returned an error response.
        e.printStackTrace();
    } catch (SdkClientException e) {
        // Amazon S3 couldn't be contacted for a response, or the client
        // couldn't parse the response from Amazon S3.
        e.printStackTrace();
    }
}

Example 33 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project athenz by yahoo.

the class ZTSClient method getAssumeRoleRequest.

AssumeRoleRequest getAssumeRoleRequest(String account, String roleName) {
    // assume the target role to get the credentials for the client
    // aws format is arn:aws:iam::<account-id>:role/<role-name>
    final String arn = "arn:aws:iam::" + account + ":role/" + roleName;
    AssumeRoleRequest req = new AssumeRoleRequest();
    req.setRoleArn(arn);
    req.setRoleSessionName(roleName);
    return req;
}

Example 34 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project athenz by yahoo.

the class CloudStore method assumeAWSRole.

public AWSTemporaryCredentials assumeAWSRole(String account, String roleName, String principal) {
    if (!awsEnabled) {
        throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, "AWS Support not enabled");
    }
    AssumeRoleRequest req = getAssumeRoleRequest(account, roleName, principal);
    AWSTemporaryCredentials tempCreds = null;
    try {
        AWSSecurityTokenServiceClient client = getTokenServiceClient();
        AssumeRoleResult res = client.assumeRole(req);
        Credentials awsCreds = res.getCredentials();
        tempCreds = new AWSTemporaryCredentials().setAccessKeyId(awsCreds.getAccessKeyId()).setSecretAccessKey(awsCreds.getSecretAccessKey()).setSessionToken(awsCreds.getSessionToken()).setExpiration(Timestamp.fromMillis(awsCreds.getExpiration().getTime()));
    } catch (Exception ex) {
        LOGGER.error("CloudStore: assumeAWSRole - unable to assume role: " + ex.getMessage());
        return null;
    }
    return tempCreds;
}

Example 35 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project ice by Netflix.

the class AwsUtils method getAssumedCredentials.

/**
 * Get assumes IAM credentials.
 * @param accountId
 * @param assumeRole
 * @return assumes IAM credentials
 */
public static Credentials getAssumedCredentials(String accountId, String assumeRole, String externalId) {
    AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest().withRoleArn("arn:aws:iam::" + accountId + ":role/" + assumeRole).withRoleSessionName(assumeRole.substring(0, Math.min(assumeRole.length(), 32)));
    if (!StringUtils.isEmpty(externalId))
        assumeRoleRequest.setExternalId(externalId);
    AssumeRoleResult roleResult = securityClient.assumeRole(assumeRoleRequest);
    return roleResult.getCredentials();
}