Passing sts policy.

[silicology1]

How can I have a s3 policy and get the credentials in sts?

/*
 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0.
 */

 #![allow(clippy::result_large_err)]

 use aws_config::meta::region::RegionProviderChain;
 use aws_sdk_sts::{meta::PKG_VERSION, Client, Error};
 use aws_types::region::Region;
 use aws_types::sdk_config::SdkConfig;
 use clap::Parser;
 

use aws_sdk_sts::operation::assume_role::AssumeRoleInput;

async fn assume_role_with_policy(region: Region, role_arn: String, session_name: Option<String>, policy: &str) -> Result<(), Error> {
    let sdk_config = SdkConfig::builder().region(region.clone()).build();
    let client = Client::new(&sdk_config);

    AssumeRoleInput::builder()
    .role_arn(role_arn)
    .policy(policy.to_string())
    .duration_seconds(3600) // Set your desired duration
    .build();


     let req = client.get_caller_identity();
     let resp = req.send().await;
     match resp {
        Ok(e) => {
            println!("UserID :               {}", e.user_id().unwrap_or_default());
            println!("Account:               {}", e.account().unwrap_or_default());
            println!("Arn    :               {}", e.arn().unwrap_or_default());
        }
        Err(e) => println!("{:?}", e),
    }
    Ok(())
}

fn main() {
  let endpoint = "";
  let access_key_id: "Your api key";
  let secret_access_key:  "Your api secret";
   
    let bucket_name = "your-bucket-name";
    let directory = "your-directory";

    let policy = generate_policy(bucket_name, directory);

    tokio::runtime::Runtime::new().unwrap().block_on(async {
        assume_role_with_policy(region, role_arn, session_name, &policy).await.unwrap();
    });
}

fn generate_policy(bucket_name: &str, directory: &str) -> String {
    format!(
        r#"{{
            "Version": "2012-10-17",
            "Statement": [
                {{
                    "Effect": "Allow",
                    "Action": [
                        "s3:PutObject",
                        "s3:AbortMultipartUpload"
                    ],
                    "Resource": [
                        "arn:aws:s3:::{}/*"
                    ]
                }}
            ]
        }}"#,
        bucket_name
    )
}

Here is the javascript code:

const {STSClient, AssumeRoleCommand} = require('@aws-sdk/client-sts')
​
const stsClient = new STSClient({
    endpoint: 'https://endpoint.4everland.co',
    region: 'us-west-1',
    credentials: {
        accessKeyId: 'Your api key.',
        secretAccessKey:  'Your api secret.',
    }
});
​
const params = {
    RoleSessionName: "only-put-object",
    DurationSeconds: 3600,
    Policy: `{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:AbortMultipartUpload"
            ],
            "Resource": [
                "arn:aws:s3:::your-bucket-name/your-directory/*"
            ]
        }
    ]
}`
};
​
​
stsClient.send(new AssumeRoleCommand(params)).then(function (data) {
    console.log(data.Credentials)
});

[rcoh]

I think you want AssumeRoleProvider. You can pass the policy here.

Then you can use the resulting provider as your credential provider. You want something like:

let conf = aws_config::defaults(BehaviorVersion::latest()).credentials_provider(assume_role_provider).load().await;
// use `conf` to configure an SDK