Object Storage Service:Use temporary access credentials provided by STS to access OSS

Prerequisites

A bucket is created. For more information, see Create a bucket.

Step 1: Create a RAM user

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. Configure the Logon Name and Display Name parameters.

5. In the Access Mode section, select OpenAPI Access. Then, click OK.

6. Complete security verification as prompted.

7. Copy the AccessKey pair of the RAM user.

Step 2: Grant the RAM user the permissions to call the AssumeRole operation

After you create the RAM user, you must grant the RAM user the permissions to call the STS API operation by assuming a RAM role.

1. On the Users page, find the RAM user that you created and click Add Permissions in the Actions column.

2. In the Add Permissions panel, click the System Policy tab and select the AliyunSTSAssumeRoleAccess policy.

   Note

   The RAM user is attached the AliyunSTSAssumeRoleAccess policy to call the AssumeRole operation of STS. The permissions of the AliyunSTSAssumeRoleAccess policy are independent of the permissions required to obtain temporary access credentials and initiate OSS requests by using temporary access credentials.

   

3. Click OK.

Step 3: Create a RAM role

Create a RAM role to declare the permissions of the RAM role when the RAM role is assumed.

1. In the left-side navigation pane, choose Identities > Roles.

2. Click Create Role. In the Create Role panel, set Select Trusted Entity to Alibaba Cloud Account and click Next.

3. In the Create Role panel, set RAM Role Name to RamOssTest and Select Trusted Alibaba Cloud Account to Current Alibaba Cloud Account.

4. Click OK. After the role is created, click Close.

5. On the Roles page, enter RamOssTest in the search box and click RamOssTest in the search result.

6. Click Copy on the right side of the RamOssTest page to save the Alibaba Cloud Resource Name (ARN) of the role.

Step 4: Grant the RAM role the permissions to upload objects to OSS

Attach one or more policies to the RAM role to grant the RAM role the permissions to perform operations on OSS resources when the RAM role is assumed. For example, if you want a RAM user to assume this RAM role and upload only objects to a specific OSS bucket, you must attach a policy that grants write permissions to the RAM role.

1. Create a custom policy to grant the role the permissions to upload objects.

   1. In the left-side navigation pane, choose Permissions > Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Policy page, click JSON. Edit the script in the policy editor to grant the role the permissions to upload objects to the src and dest directories in the examplebucket bucket. The following code provides an example on how to grant the role the permissions.

      Warning

      The following example is for reference only. You must configure fine-grained RAM policies based on your requirements to avoid granting excessive permissions to users. For more information about how to configure fine-grained RAM policies, see Example 9: Use RAM or STS to authorize users to access OSS resources.

      {
          "Version": "1",
          "Statement": [
           {
                 "Effect": "Allow",
                 "Action": [
                   "oss:PutObject"
                 ],
                 "Resource": [
                   "acs:oss:*:*:examplebucket/src/*",
                   "acs:oss:*:*:examplebucket/dest/*"
                 ]
           }
          ]
      }

   4. Click Next to edit policy information.

   5. In the Basic Information section, set Name to RamTestPolicy and click OK.

2. Attach the custom policy to the RamOssTest role.

   1. In the left-side navigation pane, choose Identities > Roles.

   2. On the Roles page, find the RamOssTest role.

   3. Click Grant Permission in the Actions column of the RamOssTest role.

   4. In the Grant Permission panel, click the Custom Policy tab and select the RamTestPolicy policy.

   5. Click OK.

Step 5: Use the RAM user to assume the RAM role to obtain temporary access credentials

After you grant the RAM user the permissions to upload objects to OSS, the RAM user assumes the RAM role to obtain temporary access credentials. Temporary access credentials include security token (SecurityToken), temporary access key pair (AccessKey ID and AccessKey secret), and validity period (Expiration).

Step 6: Use the temporary access credentials to upload objects to OSS

Before the validity period (Expiration) of the temporary access credentials expires, use the temporary access credentials to upload an local file to OSS.

The following sample code provides an example on how to use OSS SDK for Java 3.12.0 to upload a local file named exampletest.txt from D:\\localpath to the src directory in a bucket named examplebucket:

import com.aliyun.oss.OSS;
import com.aliyun.oss.OSSClientBuilder;
import com.aliyun.oss.OSSException;
import com.aliyun.oss.model.PutObjectRequest;
import com.aliyuncs.exceptions.ClientException;

import java.io.File;

public class Demo {
    public static void main(String[] args) throws ClientException {
// Specify the endpoint of the region in which the bucket is located. In this example, the endpoint of the China (Hangzhou) region is used. Example: https://oss-cn-hangzhou.aliyuncs.com. Specify your actual endpoint. 
 String endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
// Obtain the temporary AccessKey pair generated in Step 5 from environment variables. 
String accessKeyId = System.getenv("OSS_ACCESS_KEY_ID");
String accessKeySecret = System.getenv("OSS_ACCESS_KEY_SECRET");
// Obtain the security token generated in Step 5 from environment variables. 
String securityToken = System.getenv("OSS_SESSION_TOKEN");

// Create an OSSClient instance. 
OSS ossClient = new OSSClientBuilder().build(endpoint, accessKeyId, accessKeySecret, securityToken);
// Upload the exampletest.txt file to the src directory of the examplebucket bucket. 
PutObjectRequest putObjectRequest = new PutObjectRequest("examplebucket", "src/exampletest.txt", new File("D:\\localpath\\exampletest.txt"));

// ObjectMetadata metadata = new ObjectMetadata();
// Specify the storage class when you upload the file. 
// metadata.setHeader(OSSHeaders.OSS_STORAGE_CLASS, StorageClass.Standard.toString());
// Specify the access control list (ACL) when you upload the file. 
// metadata.setObjectAcl(CannedAccessControlList.Private);
// putObjectRequest.setMetadata(metadata);

try {
     // Upload the local file. 
     ossClient.putObject(putObjectRequest);
    } catch (OSSException oe) {
        System.out.println("Caught an OSSException, which means your request made it to OSS, "
                + "but was rejected with an error response for some reason.");
        System.out.println("Error Message:" + oe.getErrorMessage());
        System.out.println("Error Code:" + oe.getErrorCode());
        System.out.println("Request ID:" + oe.getRequestId());
        System.out.println("Host ID:" + oe.getHostId());
    } finally {
        if (ossClient != null) {
            ossClient.shutdown();
        }
    }
}
}

For more information about the storage class that you can specify for an object when you upload the object, see Overview. For more information about the ACL that you can specify for an object when you upload the object, see Object ACLs.

For more information about how to obtain the URL of an uploaded object, see Share objects with object URLs.

FAQ

References

You can upload data directly to OSS from clients by using temporary access credentials from STS. For more information, see Overview.