Object Storage Service:Use temporary credentials from STS to access OSS

Java

import com.aliyun.oss.*;
import com.aliyun.oss.common.auth.CredentialsProvider;
import com.aliyun.oss.common.auth.DefaultCredentialProvider;
import com.aliyun.oss.common.comm.SignVersion;
import com.aliyun.oss.model.PutObjectRequest;
import com.aliyun.oss.model.PutObjectResult;
import java.io.File;

public class Demo {
    public static void main(String[] args) throws Exception {
        // Use the temporary credentials from step 1.5 — not a RAM user's credentials
        // The temporary AccessKey ID starts with STS.
        String accessKeyId = "yourSTSAccessKeyID";
        String accessKeySecret = "yourSTSAccessKeySecret";
        String stsToken = "yourSecurityToken";

        CredentialsProvider credentialsProvider = new DefaultCredentialProvider(accessKeyId, accessKeySecret, stsToken);
        ClientBuilderConfiguration clientBuilderConfiguration = new ClientBuilderConfiguration();
        // Use V4 signature
        clientBuilderConfiguration.setSignatureVersion(SignVersion.V4);

        OSS ossClient = OSSClientBuilder.create()
                // Endpoint of the region where the bucket is located, e.g., https://oss-cn-hangzhou.aliyuncs.com
                .endpoint("endpoint")
                .credentialsProvider(credentialsProvider)
                .clientConfiguration(clientBuilderConfiguration)
                // Region ID, e.g., cn-hangzhou
                .region("region")
                .build();

        try {
            // Upload exampletest.txt to examplebucket
            PutObjectRequest putObjectRequest = new PutObjectRequest(
                "examplebucket",
                "exampletest.txt",
                new File("D:\\localpath\\exampletest.txt")
            );
            PutObjectResult result = ossClient.putObject(putObjectRequest);
        } catch (OSSException oe) {
            System.out.println("OSS error — request reached OSS but was rejected:");
            System.out.println("Error Message: " + oe.getErrorMessage());
            System.out.println("Error Code: " + oe.getErrorCode());
            System.out.println("Request ID: " + oe.getRequestId());
            System.out.println("Host ID: " + oe.getHostId());
        } catch (ClientException ce) {
            System.out.println("Client error — could not reach OSS:");
            System.out.println("Error Message: " + ce.getMessage());
        } finally {
            if (ossClient != null) {
                ossClient.shutdown();
            }
        }
    }
}

Python

OSS SDK for Python is available in two versions. Version 2.0 is a complete rewrite of 1.0 with streamlined authentication, retry logic, and error handling, plus more flexible configuration options.

import alibabacloud_oss_v2 as oss

def main():
    # Use the temporary credentials from step 1.5 — not a RAM user's credentials
    # The temporary AccessKey ID starts with STS.
    sts_access_key_id = 'yourSTSAccessKeyID'
    sts_access_key_secret = 'yourSTSAccessKeySecret'
    sts_security_token = 'yourSecurityToken'

    credentials_provider = oss.credentials.StaticCredentialsProvider(
        access_key_id=sts_access_key_id,
        access_key_secret=sts_access_key_secret,
        security_token=sts_security_token,
    )

    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider
    # Region where the bucket is located, e.g., cn-hangzhou
    cfg.region = 'cn-hangzhou'

    client = oss.Client(cfg)

    # Upload a local file to examplebucket
    local_file_path = 'D:\\localpath\\exampletest.txt'
    with open(local_file_path, 'rb') as file:
        data = file.read()

    result = client.put_object(oss.PutObjectRequest(
        bucket='examplebucket',
        key='exampletest.txt',
        body=data,
    ))

    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' content md5: {result.content_md5},'
          f' etag: {result.etag},'
          f' hash crc64: {result.hash_crc64},'
          f' version id: {result.version_id},'
    )

if __name__ == "__main__":
    main()

# -*- coding: utf-8 -*-
import oss2

# Endpoint of the region where the bucket is located, e.g., https://oss-cn-hangzhou.aliyuncs.com
endpoint = 'https://oss-cn-hangzhou.aliyuncs.com'
# Use the temporary credentials from step 1.5 — not a RAM user's credentials
sts_access_key_id = 'yourAccessKeyId'
sts_access_key_secret = 'yourAccessKeySecret'
bucket_name = 'examplebucket'
object_name = 'examplebt.txt'
security_token = 'yourSecurityToken'

auth = oss2.StsAuth(sts_access_key_id, sts_access_key_secret, security_token)
bucket = oss2.Bucket(auth, endpoint, bucket_name)
result = bucket.put_object(object_name, "hello world")
print(result.status)

Go

OSS SDK for Go is available in two versions. Version 2.0 is a complete rewrite of 1.0 with streamlined authentication, retry logic, and error handling, plus more flexible configuration options.

package main

import (
	"context"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
)

func main() {
	// Region where the bucket is located, e.g., cn-hangzhou
	region := "cn-hangzhou"

	// Use the temporary credentials from step 1.5 — not a RAM user's credentials
	// The temporary AccessKey ID starts with STS.
	accessKeyID := "yourSTSAccessKeyID"
	accessKeySecret := "yourSTSAccessKeySecret"
	stsToken := "yourSecurityToken"

	provider := credentials.NewStaticCredentialsProvider(accessKeyID, accessKeySecret, stsToken)

	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(provider).
		WithRegion(region)

	client := oss.NewClient(cfg)

	localFile := "D:\\localpath\\exampletest.txt"

	putRequest := &oss.PutObjectRequest{
		Bucket:       oss.Ptr("examplebucket"),
		Key:          oss.Ptr("exampletest.txt"),
		StorageClass: oss.StorageClassStandard,
		Acl:          oss.ObjectACLPrivate,
		Metadata: map[string]string{
			"yourMetadataKey1": "yourMetadataValue1",
		},
	}

	result, err := client.PutObjectFromFile(context.TODO(), putRequest, localFile)
	if err != nil {
		log.Fatalf("failed to put object from file %v", err)
	}
	log.Printf("put object from file result:%#v\n", result)
}

package main

import (
    "fmt"
    "github.com/aliyun/aliyun-oss-go-sdk/oss"
    "os"
)

func main() {
    // Read temporary credentials from environment variables
    // Set OSS_ACCESS_KEY_ID, OSS_ACCESS_KEY_SECRET, and OSS_SESSION_TOKEN before running
    provider, err := oss.NewEnvironmentVariableCredentialsProvider()
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    // Endpoint of the region where the bucket is located, e.g., https://oss-cn-hangzhou.aliyuncs.com
    client, err := oss.New("yourEndpoint", "", "", oss.SetCredentialsProvider(&provider))
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    bucketName := "examplebucket"
    objectName := "exampledir/exampleobject.txt"
    filepath := "D:\\localpath\\examplefile.txt"

    bucket, err := client.Bucket(bucketName)
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    err = bucket.PutObjectFromFile(objectName, filepath)
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    fmt.Println("upload success")
}

Node.js

This example requires Axios.

const axios = require("axios");
const OSS = require("ali-oss");

const getToken = async () => {
  // Fetch temporary credentials from the application server (running step 1.5)
  await axios.get("http://localhost:8000/sts").then((token) => {
    const client = new OSS({
      // Region where the bucket is located, e.g., oss-cn-hangzhou
      region: 'oss-cn-hangzhou',
      // Use the temporary credentials from step 1.5
      accessKeyId: token.data.AccessKeyId,
      accessKeySecret: token.data.AccessKeySecret,
      stsToken: token.data.SecurityToken,
      authorizationV4: true,
      bucket: "examplebucket",
      // Automatically refresh credentials before they expire
      refreshSTSToken: async () => {
        const refreshToken = await axios.get("http://localhost:8000/sts");
        return {
          accessKeyId: refreshToken.data.AccessKeyId,
          accessKeySecret: refreshToken.data.AccessKeySecret,
          stsToken: refreshToken.data.SecurityToken,
        };
      },
    });
    // Upload an object using the temporary credentials
    client.put('exampleobject.jpg', 'D:\\example.jpg')
      .then((res) => { console.log(res) })
      .catch(e => console.log(e))
  });
};
getToken()

php

<?php
if (is_file(__DIR__ . 'autoload.php')) {
    require_once __DIR__ . 'autoload.php';
}
if (is_file(__DIR__ . '/vendor/autoload.php')) {
    require_once __DIR__ . '/vendor/autoload.php';
}

use OSS\Credentials\StaticCredentialsProvider;
use OSS\OssClient;
use OSS\Core\OssException;

try {
    // Use the temporary credentials from step 1.5 — not a RAM user's credentials
    // The temporary AccessKey ID starts with STS.
    $accessKeyId = 'yourSTSAccessKeyID';
    $accessKeySecret = 'yourSTSAccessKeySecret';
    $securityToken = 'yourSecurityToken';

    $provider = new StaticCredentialsProvider($accessKeyId, $accessKeySecret, $securityToken);

    // Endpoint of the region where the bucket is located, e.g., https://oss-cn-hangzhou.aliyuncs.com
    $endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
    $bucket = "examplebucket";
    $object = "exampletest.txt";
    $localFilePath = "D:\\localpath\\exampletest.txt";

    $options = array(
        OssClient::OSS_HEADERS => array(
            'x-oss-object-acl' => 'private',
            'x-oss-meta-info' => 'yourinfo'
        ),
    );

    $config = array(
        "provider" => $provider,
        "endpoint" => $endpoint,
        "signatureVersion" => OssClient::OSS_SIGNATURE_VERSION_V4,
        // Region where the bucket is located, e.g., cn-hangzhou
        "region" => "cn-hangzhou"
    );

    $ossClient = new OssClient($config);
    $ossClient->putObject($bucket, $object, $localFilePath, $options);
} catch (OssException $e) {
    printf($e->getMessage() . "\n");
    return;
}

Ruby

require 'aliyun/sts'
require 'aliyun/oss'

client = Aliyun::OSS::Client.new(
  # Endpoint of the region where the bucket is located, e.g., https://oss-cn-hangzhou.aliyuncs.com
  endpoint: 'https://oss-cn-hangzhou.aliyuncs.com',
  # Use the temporary credentials from step 1.5 — not a RAM user's credentials
  access_key_id: 'token.access_key_id',
  access_key_secret: 'token.access_key_secret',
  sts_token: 'token.security_token'
)
bucket = client.get_bucket('examplebucket')
bucket.put_object('exampleobject.txt', :file => 'D:\test.txt')