Import the java sts sdk using the maven integration method provided on github, and use version 3.1.1 or higher.

import java.util.TreeMap;
import com.tencent.cloud.CosStsClient;
import com.tencent.cloud.Policy;
import com.tencent.cloud.Response;
import com.tencent.cloud.Statement;
import com.tencent.cloud.cos.util.Jackson;

public class demo {
    public static void main(String[] args) {
        TreeMap<String, Object> config = new TreeMap<String, Object>();
        try {
            The SecretId and SecretKey here represent the permanent identity (such as a root account or sub-account) used to apply for temporary keys. The sub-account must have permissions to operate the bucket.
            String secretId = System.getenv("secretId"); // The user's SecretId. It is recommended to use a sub-account key, follow the principle of least privilege for authorization, and reduce usage risks. For information on obtaining sub-account keys, see https://www.tencentcloud.com/document/product/598/32675.
            String secretKey = System.getenv("secretKey"); // The user's SecretKey. It is recommended to use a sub-account key, follow the principle of least privilege for authorization, and reduce usage risks. For information on obtaining sub-account keys, see https://www.tencentcloud.com/document/product/598/32675.
            // Replace with your TencentCloud api key SecretId
            config.put("secretId", secretId);
            // Replace with your TencentCloud api key SecretKey
            config.put("secretKey", secretKey);

            // Initialize the policy
            Policy policy = new Policy();

            // Set the domain name:
            // If you are using Tencent Cloud cvm, you can set an internal domain name.
            //config.put("host", "sts.internal.tencentcloudapi.com");

            // The validity period of a temporary key, measured in seconds, defaults to 1800 seconds. Currently, the maximum duration is 2 hours (7200 seconds) for a root account and 36 hours (129600 seconds) for a sub-account.
            config.put("durationSeconds", 1800);
            // Replace with your bucket
            config.put("bucket", "examplebucket-1250000000");
            // Replace with the region where your bucket is located
            config.put("region", "ap-chongqing");

            // Start building a statement
            Statement statement = new Statement();
            // The result of the declaration setting is to allow the operation.
            statement.setEffect("allow");
            /**
             * Permissions list for the key. You must specify the permissions required for this temporary key here.
             * For the permissions list, see https://www.tencentcloud.com/document/product/436/30580.
             * The rule is {project}:{interfaceName}
             * project: Product abbreviation. For COS-related authorizations, the value is `cos`. For CI (data processing)-related authorizations, the value is `ci`.
             * To authorize all APIs, use an asterisk (*), for example, `cos:*` and `ci:*`.
             * Add a batch of operation permissions:
             */
            statement.addActions(new String[]{
                    "cos:PutObject",
                    // Form upload, Mini Program upload
                    "cos:PostObject",
                    // Multipart upload
                    "cos:InitiateMultipartUpload",
                    "cos:ListMultipartUploads",
                    "cos:ListParts",
                    "cos:UploadPart",
                    "cos:CompleteMultipartUpload",
                    // Processing-related APIs are generally part of the CI product, and their permissions start with `ci`.
                    // Create an MPS task
                    "ci:CreateMediaJobs",
                    // File compression
                    "ci:CreateFileProcessJobs"
            });

            /**
             * Change this to the allowed path prefix. You can determine the specific upload paths allowed based on your website's user login status.
             * Resource expression rules are categorized into two types: cos (object storage) and ci (data processing).
             * APIs related to data processing and review require ci resource permissions.
             *  cos : qcs::cos:{region}:uid/{appid}:{bucket}/{path}
             *  ci  : qcs::ci:{region}:uid/{appid}:bucket/{bucket}/{path}
             * List several typical {path} authorization scenarios:
             * 1. Allow access to all objects: "*"
             * 2. Allow access to specified objects: "a/a1.txt", "b/b1.txt"
             * 3. Allow access to objects with specified prefixes: "a*", "a/*", "b/*"
             * Specifying "*" grants users access to all resources. Unless required by business needs, follow the principle of least privilege to grant users the appropriate scope of access permissions.
             *
             * Example: Grant all resources under the examplebucket-1250000000 bucket directory to cos and ci. Authorize two Resources.
             */
            statement.addResources(new String[]{
                    "qcs::cos:ap-chongqing:uid/1250000000:examplebucket-1250000000/*",
                    "qcs::ci:ap-chongqing:uid/1250000000:bucket/examplebucket-1250000000/*"});

            // Add a statement to the policy
            // Multiple entries can be added.
            policy.addStatement(statement);
            // To convert a Policy example into a String, you can use any json conversion method. The method described here is the recommended one provided by this SDK.
            config.put("policy", Jackson.toJsonPrettyString(policy));

            Response response = CosStsClient.getCredential(config);
            System.out.println(response.credentials.tmpSecretId);
            System.out.println(response.credentials.tmpSecretKey);
            System.out.println(response.credentials.sessionToken);
        } catch (Exception e) {
            e.printStackTrace();
            throw new IllegalArgumentException("no valid secret !");
        }
    }
}