AWS Documentation on Java Assuming STS Client not working?

Question

As a prereq see this page.

So I can created a small app that is literally a copy-paste of the code they provide. It does run for the given user, I have changed the global variables to the proper values, and I can assume the STS Role that I want via the AWS CLI. However this code will still not assume the proper role.

I export the code as an executable jar, put it up onto my EC2 instance (basic AWS linux instance), and run it. I do have it output the keys from the STS Credentials which are proper and correct, but as soon as it gets down to the S3 client I get access denied (403).

My roles are as follows:

• The EC2 has no role, but in the credentials file has a user access information (let's call him MyUser)
• MyUser has the ability to assume the STS role and IAM functionality (IAM functionality is not necessary, it's just for testing purposes)
• The STS role is assumable only by MyUser, and allows full access to S3 within the account

AWS Documentation is hit or miss sometimes, but I can't find anyone else experiencing issues with this code. Like I said if I do the same process of assuming the STS role via CLI, I can do that and it works properly which makes this much more confusing.

Thanks in advance to anyone who can help!

Answer 1

The page you linked has wrong code according to their documentation. The AssumeRole method has different example code is incorrect. There is other documentation that solves the issue see this page. The API documentation example has

AssumeRoleResult response = client.assumeRole(request);

Where the AssumeRole function returns a AssumeRoleResult object, which has different credentials than the credentials that return from the GetSessionTokenRequest class. The Credentials returned are different lengths/sizes and for some reason invalid.

THE FIX:

This code shown on their documentation is invalid.

stsClient.assumeRole(roleRequest);
GetSessionTokenRequest getSessionTokenRequest = new GetSessionTokenRequest();
getSessionTokenRequest.setDurationSeconds(900);
GetSessionTokenResult sessionTokenResult = stsClient.getSessionToken(getSessionTokenRequest);
Credentials sessionCredentials = sessionTokenResult.getCredentials();

The code above should be replaced with the following found here.

AssumeRoleResult response = stsClient.assumeRole(roleRequest);
Credentials sessionCredentials = response.getCredentials();