Making Requests Using Federated User Temporary Credentials - AWS SDK for Java

The following Java code example lists keys in the specified bucket. In the code example, you first obtain temporary security credentials for a two hour session for your federated user (User1) and use them to send authenticated requests to Amazon S3.

When requesting temporary credentials for others, for added security, you use the security credentials of an IAM user who has permissions to request temporary security credentials. You can also limit the access permissions of this IAM user to ensure that the IAM user grants only the minimum application specific permissions when requesting temporary security credentials. This sample only lists objects in a specific bucket. Therefore, first create an IAM user with the following policy attached.

{
  "Statement":[{
      "Action":["s3:ListBucket",
        "sts:GetFederationToken*"
      ],
      "Effect":"Allow",
      "Resource":"*"
    }
  ]
}

The policy allows the IAM user to request temporary security credentials and access permission to only list your AWS resources. For more information about how to create an IAM user, go to Set Up a Group, Grant Permissions, and Add Users in the AWS Identity and Access Management Getting Started Guide.

You can now use the IAM user security credentials to test the following example. The example sends authenticated request to Amazon S3 using temporary security credentials. The example specifies the following policy when requesting temporary security credentials for the federated user (User1) which restricts access to list objects in a specific bucket (YourBucketName). You must update the policy and provide your own existing bucket name.

{
  "Statement":[
    {
      "Sid":"1",
      "Action":["s3:ListBucket"],
      "Effect":"Allow", 
      "Resource":"arn:aws:s3:::YourBucketName"
    }
  ]
}

You must update the following sample and provide the bucket name that you specified in the preceding federated user access policy.

import java.io.IOException;
import com.amazonaws.auth.BasicSessionCredentials;
import com.amazonaws.auth.PropertiesCredentials;
import com.amazonaws.auth.policy.Policy;
import com.amazonaws.auth.policy.Resource;
import com.amazonaws.auth.policy.Statement;
import com.amazonaws.auth.policy.Statement.Effect;
import com.amazonaws.auth.policy.actions.S3Actions;
import com.amazonaws.services.s3.AmazonS3Client;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient;
import com.amazonaws.services.securitytoken.model.Credentials;
import com.amazonaws.services.securitytoken.model.GetFederationTokenRequest;
import com.amazonaws.services.securitytoken.model.GetFederationTokenResult;
import com.amazonaws.services.s3.model.ObjectListing;

public class S3Sample {
	private static String bucketName = "*** Specify bucket name ***";
    public static void main(String[] args) throws IOException {
        PropertiesCredentials credentials = new PropertiesCredentials(
                S3Sample.class.getResourceAsStream("AwsCredentials.properties"));
        
        AWSSecurityTokenServiceClient stsClient = 
                        new AWSSecurityTokenServiceClient(credentials);

        GetFederationTokenRequest getFederationTokenRequest = 
                                         new GetFederationTokenRequest();
        getFederationTokenRequest.setDurationSeconds(7200);
        getFederationTokenRequest.setName("User1");
        
        // Define the policy and add to the request.
        Policy policy = new Policy();
        policy.withStatements(new Statement(Effect.Allow)
            .withActions(S3Actions.ListObjects) 
            .withResources(new Resource("arn:aws:s3:::ExampleBucket"))); 

        getFederationTokenRequest.setPolicy(policy.toJson());
 
        // Get the temporary security credentials.
        GetFederationTokenResult federationTokenResult = 
                        stsClient.getFederationToken(getFederationTokenRequest);
        Credentials sessionCredentials = federationTokenResult.getCredentials();
 
        // Package the session credentials as a BasicSessionCredentials
        // object for an S3 client object to use.
        BasicSessionCredentials basicSessionCredentials = 
              new BasicSessionCredentials(sessionCredentials.getAccessKeyId(), 
        		                          sessionCredentials.getSecretAccessKey(), 
        		                          sessionCredentials.getSessionToken());
        AmazonS3Client s3 = new AmazonS3Client(basicSessionCredentials);

        
        // Test. For example, send ListBucket request using the temporary security credentials. 
        ObjectListing objects = s3.listObjects(bucketName);
        System.out.println("No. of Objects = " + objects.getObjectSummaries().size());
    }
}