AWS身份池是一种为AWS资源提供临时安全凭据的服务,可以实现对不同身份的用户进行身份验证和授权。在使用身份池时,有两种不同的方法可供选择:使用认证ID和身份池ID,或者使用Cognito身份提供程序。
使用认证ID和身份池ID的方法:
import boto3
# 定义认证ID和身份池ID
identity_pool_id = 'IDENTITY_POOL_ID'
developer_provider_name = 'DEVELOPER_PROVIDER_NAME'
# 创建CognitoIdentityClient
client = boto3.client('cognito-identity')
# 获取身份ID
identities = client.get_id(AccountId='ACCOUNT_ID', IdentityPoolId=identity_pool_id)
identity_id = identities['IdentityId']
# 获取身份凭证
credentials = client.get_credentials_for_identity(IdentityId=identity_id)
access_key = credentials['Credentials']['AccessKeyId']
secret_key = credentials['Credentials']['SecretKey']
session_token = credentials['Credentials']['SessionToken']
使用Cognito身份提供程序的方法:
import boto3
# 定义身份池ID和身份池的身份提供程序
identity_pool_id = 'IDENTITY_POOL_ID'
provider_name = 'cognito-idp.{0}.amazonaws.com/{1}'.format(aws_region, user_pool_id)
# 创建CognitoIdentityProviderClient
client = boto3.client('cognito-idp')
# 获取用户令牌
token = get_user_access_token()
# 获取身份凭证
response = client.get_id(IdentityPoolId=identity_pool_id, Logins={provider_name: token})
identity_id = response['IdentityId']
credentials = client.get_credentials_for_identity(IdentityId=identity_id)
access_key = credentials['Credentials']['AccessKeyId']
secret_key = credentials['Credentials']['SecretKey']
session_token = credentials['Credentials']['SessionToken']