Question

I am trying to use the aws sdk for php to create temporary credentials for a user. From what I can gather it should just be a case of adding the sts policy through IAM for my sdk user:

{
  "Statement": [
    {
      "Sid": "Stmt1349820612345",
      "Action": "sts:*",
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

and then instantiating the sts class as shown in the example:

  // Instantiate the class
  $token = new AmazonSTS();

// Generate a new IAM policy
  $policy = new CFPolicy($token, array(
    'Statement' => array(
      array(
        'Sid' => 'SID' . time(),
        'Action' => array(
          's3:ListBucket'
        ),
        'Effect' => 'Allow',
        'Resource' => 'arn:aws:s3:::my-bucket'
      )
    )
  ));

// Fetch the session credentials
  $response = $token->get_federation_token('my-user', array(
    'Policy' => $policy->get_json(),
    'DurationSeconds' => 3600
  ));

  $credentials = $response->body->GetFederatedTokenResult->Credentials
    ->to_array()->getArrayCopy();
  return $credentials;

It works fine when I use the regular temporary credentials token:

$token = new AmazonSTS();
$response = $token->get_session_token();

$credentials = $response->body->GetSessionTokenResult->Credentials->to_array()->getArrayCopy();

Does anyone have a working example of this or can see where I am going wrong?

Answer 1

Finally found this in the s3 docs that works

  $AccessKeyId = (string)$response->
    body->GetFederationTokenResult->Credentials->AccessKeyId;
  $SecretAccessKey = (string)$response->
    body->GetFederationTokenResult->Credentials->SecretAccessKey;
  $SessionToken = (string)$response->
    body->GetFederationTokenResult->Credentials->SessionToken;

So this works

$credentials = $response->body->GetFederationTokenResult->Credentials->to_array()->getArrayCopy();