Rust AWS STS客户端库rusoto_sts使用指南

概述

rusoto_sts是Rusoto项目提供的AWS安全令牌服务（STS）客户端库，用于与AWS STS API进行安全集成。该库允许Rust开发者通过类型安全的方式调用STS服务，管理临时安全凭证和跨账户访问。

安装方法

在Cargo.toml中添加依赖：

[dependencies]
rusoto_sts = "0.48.0"
rusoto_core = "0.48.0"

基本使用方法

1. 创建STS客户端

use rusoto_core::Region;
use rusoto_sts::{Sts, StsClient};

let sts_client = StsClient::new(Region::UsEast1);

2. 获取临时凭证

use rusoto_sts::{GetSessionTokenRequest, Sts};

async fn get_session_token() {
    let request = GetSessionTokenRequest {
        duration_seconds: Some(3600),
        ..Default::default()
    };
    
    match sts_client.get_session_token(request).await {
        Ok(response) => {
            if let Some(credentials) = response.credentials {
                println!("Access Key: {}", credentials.access_key_id);
                println!("Secret Key: {}", credentials.secret_access_key);
                println!("Session Token: {}", credentials.session_token);
            }
        }
        Err(e) => eprintln!("Error getting session token: {}", e),
    }
}

3. 假设角色

use rusoto_sts::{AssumeRoleRequest, Sts};

async fn assume_role() {
    let request = AssumeRoleRequest {
        role_arn: "arn:aws:iam::123456789012:role/ExampleRole".to_string(),
        role_session_name: "example-session".to_string(),
        duration_seconds: Some(3600),
        ..Default::default()
    };
    
    match sts_client.assume_role(request).await {
        Ok(response) => {
            if let Some(credentials) = response.credentials {
                println!("Assumed role credentials obtained");
            }
        }
        Err(e) => eprintln!("Error assuming role: {}", e),
    }
}

4. 获取调用者身份信息

use rusoto_sts::{GetCallerIdentityRequest, Sts};

async fn get_caller_identity() {
    let request = GetCallerIdentityRequest::default();
    
    match sts_client.get_caller_identity(request).await {
        Ok(response) => {
            println!("Account ID: {}", response.account.unwrap_or_default());
            println!("User ID: {}", response.user_id.unwrap_or_default());
            println!("ARN: {}", response.arn.unwrap_or_default());
        }
        Err(e) => eprintln!("Error getting caller identity: {}", e),
    }
}

错误处理示例

use rusoto_core::RusotoError;

async fn handle_sts_errors() {
    let request = GetSessionTokenRequest::default();
    
    match sts_client.get_session_token(request).await {
        Ok(response) => {
            // 处理成功响应
        }
        Err(RusotoError::Service(e)) => {
            eprintln!("STS service error: {}", e);
        }
        Err(RusotoError::Credentials(e)) => {
            eprintln!("Credentials error: {}", e);
        }
        Err(e) => {
            eprintln!("Other error: {}", e);
        }
    }
}

配置选项

rusoto_sts支持多种配置方式：

• 使用环境变量设置AWS凭证
• 使用IAM角色（在EC2实例上）
• 使用共享凭证文件
• 通过代码直接提供凭证

注意事项

1. 确保正确处理临时凭证的过期时间
2. 在生产环境中使用适当的错误处理和重试机制
3. 遵循AWS的安全最佳实践管理凭证
4. 注意API调用的速率限制和配额

这个库提供了完整的STS功能集成，使得在Rust应用中安全地管理AWS访问凭证变得简单可靠。

完整示例代码

use rusoto_core::{Region, RusotoError};
use rusoto_sts::{
    AssumeRoleRequest, GetCallerIdentityRequest, GetSessionTokenRequest, Sts, StsClient,
};

#[tokio::main]
async fn main() {
    // 创建STS客户端
    let sts_client = StsClient::new(Region::UsEast1);
    
    // 示例1: 获取会话令牌
    println!("=== 获取会话令牌 ===");
    match get_session_token(&sts_client).await {
        Ok(_) => println!("成功获取会话令牌"),
        Err(e) => eprintln!("获取会话令牌失败: {}", e),
    }
    
    // 示例2: 假设角色
    println!("\n=== 假设角色 ===");
    match assume_role(&sts_client).await {
        Ok(_) => println!("成功假设角色"),
        Err(e) => eprintln!("假设角色失败: {}", e),
    }
    
    // 示例3: 获取调用者身份
    println!("\n=== 获取调用者身份 ===");
    match get_caller_identity(&sts_client).await {
        Ok(_) => println!("成功获取调用者身份"),
        Err(e) => eprintln!("获取调用者身份失败: {}", e),
    }
    
    // 示例4: 错误处理演示
    println!("\n=== 错误处理演示 ===");
    handle_sts_errors(&sts_client).await;
}

// 获取会话令牌函数
async fn get_session_token(sts_client: &StsClient) -> Result<(), RusotoError<()>> {
    let request = GetSessionTokenRequest {
        duration_seconds: Some(3600), // 设置令牌有效期为1小时
        ..Default::default()
    };
    
    let response = sts_client.get_session_token(request).await?;
    
    if let Some(credentials) = response.credentials {
        println!("访问密钥: {}", credentials.access_key_id);
        println!("秘密密钥: {}", credentials.secret_access_key);
        println!("会话令牌: {}", credentials.session_token);
        println!("过期时间: {:?}", credentials.expiration);
    }
    
    Ok(())
}

// 假设角色函数
async fn assume_role(sts_client: &StsClient) -> Result<(), RusotoError<()>> {
    let request = AssumeRoleRequest {
        role_arn: "arn:aws:iam::123456789012:role/ExampleRole".to_string(),
        role_session_name: "example-session".to_string(),
        duration_seconds: Some(3600), // 设置角色会话有效期为1小时
        ..Default::default()
    };
    
    let response = sts_client.assume_role(request).await?;
    
    if let Some(credentials) = response.credentials {
        println!("获取到假设角色凭证");
        println!("访问密钥: {}", credentials.access_key_id);
        println!("秘密密钥: {}", credentials.secret_access_key);
        println!("会话令牌: {}", credentials.session_token);
    }
    
    Ok(())
}

// 获取调用者身份函数
async fn get_caller_identity(sts_client: &StsClient) -> Result<(), RusotoError<()>> {
    let request = GetCallerIdentityRequest::default();
    
    let response = sts_client.get_caller_identity(request).await?;
    
    println!("账户ID: {}", response.account.unwrap_or_default());
    println!("用户ID: {}", response.user_id.unwrap_or_default());
    println!("ARN: {}", response.arn.unwrap_or_default());
    
    Ok(())
}

// 错误处理函数
async fn handle_sts_errors(sts_client: &StsClient) {
    let request = GetSessionTokenRequest::default();
    
    match sts_client.get_session_token(request).await {
        Ok(response) => {
            if let Some(credentials) = response.credentials {
                println!("成功获取临时凭证");
            }
        }
        Err(RusotoError::Service(e)) => {
            eprintln!("STS服务错误: {}", e);
        }
        Err(RusotoError::Credentials(e)) => {
            eprintln!("凭证错误: {}", e);
        }
        Err(RusotoError::HttpDispatch(e)) => {
            eprintln!("HTTP调度错误: {}", e);
        }
        Err(RusotoError::Unknown(e)) => {
            eprintln!("未知错误: {}", e);
        }
        Err(e) => {
            eprintln!("其他错误: {}", e);
        }
    }
}