All Products
Search

This Product

    STS authorization

    Document Center

    STS authorization

    Last Updated: Mar 18, 2019

    Basic concepts

    Basic concepts are explained as follows:

    • RAM user

      A RAM user is created based on an Alibaba Cloud primary account. Once created, the RAM user has its own AccessKey and can perform authorized operations in the same way as the primary account. Generally, RAM users can be considered as users with certain permissions or users who are authorized to perform the specified operations.

    • Role

      A role is a virtual concept for certain operation permissions, but it does not have its own logon password or AccessKey. A RAM user can assume a role, in which case the permissions of the RAM user are those of the role.

    • Policy

      Policies are rules that are used to define permissions, for example, rules that allow users to upload or play media files.

    The relationship between a RAM user and a role is equivalent to that between a person and his/her identity. For example, the person is an employee at work, and a father at home. The person is the same person although he/she assumes different roles in different scenarios. When assuming different roles, the person has permissions that have been granted to the roles. “Employee” or “father” cannot act as an entity that performs operations unless such roles are assumed by users. This also indicates that a role may be assumed by multiple users at the same time. The user who assumes a role is automatically granted all permissions of the role.

    Scenarios

    In the previous sections, we used only the RAM user function. RAM users are for long-term normal use. This poses a serious risk if the RAM user permissions cannot be promptly revoked in the case of information disclosure.
    To reslove this issue, you can deploy a server to generate an STS temporary AccessKey. You can customize the validity period of the AccessKey and specify complex policies to provide only minimum permissions to different RAM users.

    Create a RAM user

    1. Log on to the Alibaba Cloud console, and select Resource Access Management.

      If you have not used the Alibaba Cloud console before, activate this service first.

    2. Go to the Users page.RAMGuide2

    3. No user is displayed on the page. Click Create User in the upper-right corner to create a RAM user with the same VOD access permissions as the primary account. Remember to select the Automatically Generate an AccessKey for This User.RAMGuide3

    4. The AccessKey for this RAM user is generated. You must save this AccessKey for future use in this step.RAMGuide4

    5. Return to the “Users” page, where the created RAM user named live_ram_test is displayed. The created RAM user does not have any permissions yet. Click Authorize on the right side and grant the AliyunSTSAssumeRoleAccess permissions to this RAM user.VODAuth

    Create a role

    1. Log on to the RAM console, and choose Roles > Create Role.Create a role (1)

    2. Select the role type. In this example, select User Role.Create a role (2)

    3. Enter the role type information. Use the default settings.Create a role (3)

    4. Configure the basic information about the role.Create a role (4)

    5. Choose Roles,and grant the AliyunVODFullAccess permission to this role.Grant permissions to the role

    Java example

    Everything is now ready for you to use STS to grant access permissions.

    The following provides a simple STS Java example. The calling method is as follows. For more information about the parameters, see STS introduction.

    1. package pop;
    3. import com.aliyuncs.DefaultAcsClient;
    4. import com.aliyuncs.exceptions.ClientException;
    5. import com.aliyuncs.http.MethodType;
    6. import com.aliyuncs.http.ProtocolType;
    7. import com.aliyuncs.profile.DefaultProfile;
    8. import com.aliyuncs.profile.IClientProfile;
    9. import com.aliyuncs.sts.model.v20150401.AssumeRoleRequest;
    10. import com.aliyuncs.sts.model.v20150401.AssumeRoleResponse;
    11. import com.aliyuncs.vod.model.v20170321.CreateUploadVideoRequest;
    12. import com.aliyuncs.vod.model.v20170321.CreateUploadVideoResponse;
    14. /**
    15.  * Created by liulietao on 2017/7/4.
    16.  */
    17. public class TestStsService {
    18.     // Currently, only the "cn-hangzhou" region is available. Do not enter another region value.
    19.     public static final String REGION_CN_HANGZHOU = "cn-hangzhou";
    20.     // Current STS API version
    21.     public static final String STS_API_VERSION = "2015-04-01";
    23.     static AssumeRoleResponse assumeRole(String accessKeyId, String accessKeySecret,
    24.                                          String roleArn, String roleSessionName, String policy,
    25.                                          ProtocolType protocolType) throws ClientException {
    26.         try {
    27.             // Create an Alibaba Cloud ACS client for initiating an OpenAPI request.
    28.             IClientProfile profile = DefaultProfile.getProfile(REGION_CN_HANGZHOU, accessKeyId, accessKeySecret);
    29.             DefaultAcsClient client = new DefaultAcsClient(profile);
    30.             // Create an AssumeRoleRequest and set the request parameters.
    31.             final AssumeRoleRequest request = new AssumeRoleRequest();
    32.             request.setVersion(STS_API_VERSION);
    33.             request.setMethod(MethodType.POST);
    34.             request.setProtocol(protocolType);
    35.             request.setRoleArn(roleArn);
    36.             request.setRoleSessionName(roleSessionName);
    37.             request.setPolicy(policy);
    38.             // Initiate a request and obtain the response.
    39.             final AssumeRoleResponse response = client.getAcsResponse(request);
    40.             return response;
    41.         } catch (ClientException e) {
    42.             throw e;
    43.         }
    44.     }
    46.     public static void main(String[] args) {
    47.         // Only an RAM user can call the AssumeRole operation.
    48.         // The AccessKeys of an Alibaba Cloud primary account cannot be used to initiate an AssumeRole request.
    49.         // Create an RAM user in the RAM console, and create an AccessKey for the user.
    50.         String accessKeyId = Env.AK;
    51.         String accessKeySecret = Env.AS;
    52.         // AssumeRole API request parameters include RoleArn, RoleSessionName, Policy, and DurationSeconds.
    53.         // You need to obtain the RoleArn in the RAM console.
    54.         String roleArn = "acs:ram::example:role/ramtestupload";
    55.         // RoleSessionName is the session name of a temporary Token. You must specify the parameter to identify your account. This parameter is used for audit or for distinguishing the account to which the Token is issued.
    56.         // Pay attention to the length and rule of RoleSessionName. RoleSessionName can contain only hyphens (-),  underscores (_), letters, and numbers, and it cannot contain any spaces.
    57.         // For more information about rules, see the format requirements in the API documentation.
    58.         String roleSessionName = "RamTestUpload";
    59.         // Method for customizing your policy
    60.         String policy = "{\n" +
    61.                 "  \"Version\": \"1\",\n" +
    62.                 "  \"Statement\": [\n" +
    63.                 "    {\n" +
    64.                 "      \"Action\": \"vod:CreateUploadVideo\",\n" +
    65.                 "      \"Resource\": \"*\",\n" +
    66.                 "      \"Effect\": \"Allow\"\n" +
    67.                 "    }\n" +
    68.                 "  ]\n" +
    69.                 "}";
    70.         // You must enter HTTPS here.
    71.         ProtocolType protocolType = ProtocolType.HTTPS;
    72.         try {
    73.             final AssumeRoleResponse response = assumeRole(accessKeyId, accessKeySecret,
    74.                     roleArn, roleSessionName, policy, protocolType);
    75.             System.out.println("Expiration: " + response.getCredentials().getExpiration());
    76.             System.out.println("Access Key Id: " + response.getCredentials().getAccessKeyId());
    77.             System.out.println("Access Key Secret: " + response.getCredentials().getAccessKeySecret());
    78.             System.out.println("Security Token: " + response.getCredentials().getSecurityToken());
    80.             createUploadVideo(response.getCredentials().getAccessKeyId(),
    81.                     response.getCredentials().getAccessKeySecret(),
    82.                     response.getCredentials().getSecurityToken());
    84.         } catch (ClientException e) {
    85.             System.out.println("Failed to get a token.");
    86.             System.out.println("Error code: " + e.getErrCode());
    87.             System.out.println("Error message: " + e.getErrMsg());
    88.         }
    89.     }
    91.     static void createUploadVideo(String accessKeyId, String accessKeySecret, String token) {
    92.         String regionId = "cn-shanghai"; // Region of the VOD service. Enter "cn-shanghai" for any region in China.
    93.         IClientProfile profile = DefaultProfile.getProfile(regionId, accessKeyId, accessKeySecret);
    94.         DefaultAcsClient client = new DefaultAcsClient(profile);
    96.         CreateUploadVideoRequest request = new CreateUploadVideoRequest();
    97.         request.setSecurityToken(token);
    98.         request.setTitle("t1");
    99.         request.setFileName("file1.mp4");
    100.         request.setFileSize(10240L);
    102.         try {
    103.             CreateUploadVideoResponse response = client.getAcsResponse(request);
    104.             System.out.println("CreateUploadVideoRequest, " + request.getUrl());
    105.             System.out.println("CreateUploadVideoRequest, requestId:" + response.getRequestId());
    106.             System.out.println("UploadAddress, " + response.getUploadAddress());
    107.             System.out.println("UploadAuth, " + response.getUploadAuth());
    108.             System.out.println("VideoId, " + response.getVideoId());
    110.         } catch (ClientException e) {
    111.             System.out.println("action, error:" + e);
    112.             e.printStackTrace();
    113.         }
    114.     }
    115. }

    • RoleArn indicates the ID of a role to be assumed. You can select Roles > Role Details to find the role ID.

    • RoleSessionName indicates the name of a temporary credential. Generally, we recommend that you use different application users to distinguish the RoleSessionNames.

    • Policy indicates that a permission restriction is added when the role is assumed.

      Note:

      • The policy that is passed in is used to restrict the permissions of the temporary credential after a role is assumed. Ultimately the permissions obtained through the temporary credential are the intersection of permissions of the role and the policy that has been passed in.
      • When a role is being assumed, the policy is passed in to improve flexibility. For example, the CreateUploadVideo operation can only be used currently.

    • DurationSeconds indicates the validity period in seconds of the temporary credential. The value ranges from 900 to 3600.

    • id and secret indicate the AccessKey of the RAM user to assume a role.
    Free Trial Free Trial