3.2.8.7. 访问 S3 资源

流程

1. 以下是假设 Role with STS 获得临时访问和 secret 密钥来访问 S3 资源的示例。

   [roo@host01 ~]# cat test-assume-role.sh
   #!/bin/bash
   export AWS_CA_BUNDLE="/etc/pki/ca-trust/source/anchors/cert.pem"
   unset AWS_ACCESS_KEY_ID
   unset AWS_SECRET_ACCESS_KEY
   unset AWS_SESSION_TOKEN
   KC_ACCESS_TOKEN=$(curl -k -q -L -X POST
   "https://keycloak-sso.apps.ocp.example.com/auth/realms/ceph/protocol/openid-connect/
   token" \
   -H 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode 'client_id=ceph' \
   --data-urlencode 'grant_type=password' \
   --data-urlencode 'client_secret=XXXXXXXXXXXXXXXXXXXXXXX' \
   --data-urlencode 'scope=openid' \
   --data-urlencode "<varname>SSOUSERNAME</varname>" \
   --data-urlencode "<varname>SSOPASSWORD</varname>" | jq -r .access_token)
   echo ${KC_ACCESS_TOKEN}
   IDM_ASSUME_ROLE_CREDS=$(aws sts assume-role-with-web-identity --role-arn
   "arn:aws:iam:::role/$3" --role-session-name testbr
   --endpoint=https://cephproxy1.example.com:8443
   --web-identity-token="$KC_ACCESS_TOKEN")
   echo "aws sts assume-role-with-web-identity --role-arn "arn:aws:iam:::role/$3"
   --role-session-name testb --endpoint=https://cephproxy1.example.com:8443
   --web-identity-token="$KC_ACCESS_TOKEN""
   echo $IDM_ASSUME_ROLE_CREDS
   export AWS_ACCESS_KEY_ID=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r
   .Credentials.AccessKeyId)
   export AWS_SECRET_ACCESS_KEY=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r
   .Credentials.SecretAccessKey)
   export AWS_SESSION_TOKEN=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r
   .Credentials.SessionToken)

2. 运行脚本。

   Example

   [root@host01 ~]# source ./test-assume-role.sh s3admin passw0rd rgwadmins
   [root@host01 ~]# aws s3 mb s3://testbucket
   [root@host01 ~]# aws s3 ls