• 给角色创建一条自定义策略或者系统策略都行

• 给角色绑定我们刚才自定义的 policy

• 让 ram 有权调用角色，这样 ram  子账号就有了角色对应的产品策略，所以要让角色和 ram 关联

• 1、最后一部利用服务端的代码，填入我门刚才建立 ram 、角色时得到的所有信息，就能生成 sts 令牌
• 2、rolearn 就是我们在创建角色时控制台看到的。
• 3、rolesession 就是角色名称

public class StsServiceSample {public static void main(String[] args) {String endpoint = "sts.aliyuncs.com";String accessKeyId = "<access-key-id>";String accessKeySecret = "<access-key-secret>";String roleArn = "<role-arn>";String roleSessionName = "session-name";String policy = "{\n" +"    \"Version\": \"1\", \n" +"    \"Statement\": [\n" +"        {\n" +"            \"Action\": [\n" +"                \"oss:*\"\n" +"            ], \n" +"            \"Resource\": [\n" +"                \"acs:oss:*:*:*\" \n" +"            ], \n" +"            \"Effect\": \"Allow\"\n" +"        }\n" +"    ]\n" +"}";try {// 添加endpoint（直接使用STS endpoint，前两个参数留空，无需添加region ID）DefaultProfile.addEndpoint("", "", "Sts", endpoint);// 构造default profile（参数留空，无需添加region ID）IClientProfile profile = DefaultProfile.getProfile("", accessKeyId, accessKeySecret);// 用profile构造clientDefaultAcsClient client = new DefaultAcsClient(profile);final AssumeRoleRequest request = new AssumeRoleRequest();request.setMethod(MethodType.POST);request.setRoleArn(roleArn);request.setRoleSessionName(roleSessionName);request.setPolicy(policy); // Optionalfinal AssumeRoleResponse response = client.getAcsResponse(request);System.out.println("Expiration: " + response.getCredentials().getExpiration());System.out.println("Access Key Id: " + response.getCredentials().getAccessKeyId());System.out.println("Access Key Secret: " + response.getCredentials().getAccessKeySecret());System.out.println("Security Token: " + response.getCredentials().getSecurityToken());System.out.println("RequestId: " + response.getRequestId());} catch (ClientException e) {System.out.println("Failed：");System.out.println("Error code: " + e.getErrCode());System.out.println("Error message: " + e.getErrMsg());System.out.println("RequestId: " + e.getRequestId());}}
}