com.amazonaws.auth

Class STSAssumeRoleSessionCredentialsProvider

java.lang.Object

com.amazonaws.auth.STSAssumeRoleSessionCredentialsProvider

All Implemented Interfaces:

AWSCredentialsProvider, AWSSessionCredentialsProvider

@ThreadSafe
public class STSAssumeRoleSessionCredentialsProvider
extends Object
implements AWSSessionCredentialsProvider

AWSCredentialsProvider implementation that uses the AWS Security Token Service to assume a Role and create temporary, short-lived sessions to use for authentication.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	STSAssumeRoleSessionCredentialsProvider.Builder Provides a builder pattern to avoid combinatorial explosion of the number of parameters that are passed to constructors.

Field Summary

Fields

Modifier and Type	Field and Description
static int	DEFAULT_DURATION_SECONDS Default duration for started sessions.

Constructor Summary

Constructors

Constructor and Description
STSAssumeRoleSessionCredentialsProvider(AWSCredentialsProvider longLivedCredentialsProvider, String roleArn, String roleSessionName) Constructs a new STSAssumeRoleSessionCredentialsProvider, which will use the specified credentials provider (which vends long lived AWS credentials) to make a request to the AWS Security Token Service (STS), usess the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.
STSAssumeRoleSessionCredentialsProvider(AWSCredentialsProvider longLivedCredentialsProvider, String roleArn, String roleSessionName, ClientConfiguration clientConfiguration) Constructs a new STSAssumeRoleSessionCredentialsProvider, which will use the specified credentials provider (which vends long lived AWS credentials) to make a request to the AWS Security Token Service (STS), uses the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.
STSAssumeRoleSessionCredentialsProvider(AWSCredentials longLivedCredentials, String roleArn, String roleSessionName) Constructs a new STSAssumeRoleSessionCredentialsProvider, which will use the specified long lived AWS credentials to make a request to the AWS Security Token Service (STS), uses the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.
STSAssumeRoleSessionCredentialsProvider(AWSCredentials longLivedCredentials, String roleArn, String roleSessionName, ClientConfiguration clientConfiguration) Constructs a new STSAssumeRoleSessionCredentialsProvider, which will use the specified long lived AWS credentials to make a request to the AWS Security Token Service (STS), uses the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.
STSAssumeRoleSessionCredentialsProvider(String roleArn, String roleSessionName) Constructs a new STSAssumeRoleSessionCredentialsProvider, which makes a request to the AWS Security Token Service (STS), uses the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.

Method Summary

Methods

Modifier and Type	Method and Description
AWSSessionCredentials	getCredentials()
void	refresh()
void	setSTSClientEndpoint(String endpoint) Deprecated. This method may be removed in a future major version. Create multiple providers if you need to work with multiple STS endpoints.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

DEFAULT_DURATION_SECONDS

public static final int DEFAULT_DURATION_SECONDS

Default duration for started sessions.

See Also:

Constant Field Values

Constructor Detail

STSAssumeRoleSessionCredentialsProvider

public STSAssumeRoleSessionCredentialsProvider(String roleArn,
                                       String roleSessionName)

Constructs a new STSAssumeRoleSessionCredentialsProvider, which makes a request to the AWS Security Token Service (STS), uses the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.

Parameters:

roleArn - The ARN of the Role to be assumed.

roleSessionName - An identifier for the assumed role session.

STSAssumeRoleSessionCredentialsProvider

public STSAssumeRoleSessionCredentialsProvider(AWSCredentials longLivedCredentials,
                                       String roleArn,
                                       String roleSessionName)

Constructs a new STSAssumeRoleSessionCredentialsProvider, which will use the specified long lived AWS credentials to make a request to the AWS Security Token Service (STS), uses the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.

Parameters:

longLivedCredentials - The main AWS credentials for a user's account.

roleArn - The ARN of the Role to be assumed.

roleSessionName - An identifier for the assumed role session.

STSAssumeRoleSessionCredentialsProvider

public STSAssumeRoleSessionCredentialsProvider(AWSCredentials longLivedCredentials,
                                       String roleArn,
                                       String roleSessionName,
                                       ClientConfiguration clientConfiguration)

Constructs a new STSAssumeRoleSessionCredentialsProvider, which will use the specified long lived AWS credentials to make a request to the AWS Security Token Service (STS), uses the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.

Parameters:

longLivedCredentials - The main AWS credentials for a user's account.

roleArn - The ARN of the Role to be assumed.

roleSessionName - An identifier for the assumed role session.

clientConfiguration - Client configuration connection parameters.

STSAssumeRoleSessionCredentialsProvider

public STSAssumeRoleSessionCredentialsProvider(AWSCredentialsProvider longLivedCredentialsProvider,
                                       String roleArn,
                                       String roleSessionName)

Constructs a new STSAssumeRoleSessionCredentialsProvider, which will use the specified credentials provider (which vends long lived AWS credentials) to make a request to the AWS Security Token Service (STS), usess the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.

Parameters:

longLivedCredentialsProvider - Credentials provider for the main AWS credentials for a user's account.

roleArn - The ARN of the Role to be assumed.

roleSessionName - An identifier for the assumed role session.

STSAssumeRoleSessionCredentialsProvider

public STSAssumeRoleSessionCredentialsProvider(AWSCredentialsProvider longLivedCredentialsProvider,
                                       String roleArn,
                                       String roleSessionName,
                                       ClientConfiguration clientConfiguration)

Constructs a new STSAssumeRoleSessionCredentialsProvider, which will use the specified credentials provider (which vends long lived AWS credentials) to make a request to the AWS Security Token Service (STS), uses the provided roleArn to assume a role and then request short lived session credentials, which will then be returned by this class's getCredentials() method.

Parameters:

longLivedCredentialsProvider - Credentials provider for the main AWS credentials for a user's account.

roleArn - The ARN of the Role to be assumed.

roleSessionName - An identifier for the assumed role session.

clientConfiguration - Client configuration connection parameters.

Method Detail

setSTSClientEndpoint

@Deprecated
public void setSTSClientEndpoint(String endpoint)

Deprecated. This method may be removed in a future major version. Create multiple providers if you need to work with multiple STS endpoints.

Sets the AWS Security Token Service (STS) endpoint where session credentials are retrieved from.

The default AWS Security Token Service (STS) endpoint ("sts.amazonaws.com") works for all accounts that are not for China (Beijing) region or GovCloud. You only need to change the endpoint to "sts.cn-north-1.amazonaws.com.cn" when you are requesting session credentials for services in China(Beijing) region or "sts.us-gov-west-1.amazonaws.com" for GovCloud.

Setting this invalidates existing session credentials.

getCredentials

public AWSSessionCredentials getCredentials()

Specified by:

getCredentials in interface AWSCredentialsProvider

Specified by:

getCredentials in interface AWSSessionCredentialsProvider

refresh

public void refresh()

Specified by:

refresh in interface AWSCredentialsProvider