Alibaba Cloud CLI:Configure advanced Alibaba Cloud CLI credentials (OIDC / CloudSSO / External / CredentialsURI / BearerToken)

Prerequisites

• You have created an ACK or ACS cluster and enabled the RRSA feature for ACK or ACS.

• You have created a RAM role for the OIDC identity provider, and the trust policy allows the role to be assumed by the OIDC identity provider that is automatically created by the cluster in the format of ack-rrsa-{cluster-id}.

• You have associated the pod's service account with the RAM role by using RRSA.

Configure the credential

aliyun configure set \
  --mode OIDC \
  --profile OIDCProfile \
  --oidc-provider-arn $ALIBABA_CLOUD_OIDC_PROVIDER_ARN \
  --oidc-token-file $ALIBABA_CLOUD_OIDC_TOKEN_FILE \
  --ram-role-arn $ALIBABA_CLOUD_ROLE_ARN \
  --role-session-name "rrsa-pod" \
  --region cn-shanghai

Run aliyun sts get-caller-identity in the pod to verify the credentials.

Credential refresh

The cluster automatically rotates the OIDC token file in the pod. The CLI calls the STS AssumeRoleWithOIDC API with the latest token to refresh the credential. No user action is required.

Prerequisites

• Your enterprise has deployed CloudSSO and configured a user directory and access configurations.

• The CloudSSO user has been assigned at least one access configuration.

• You have the CloudSSO logon URL from your administrator, typically in the format https://signin-<region>.alibabacloudsso.com/<directory-name>/login. Obtain the user portal URL.

Configure the credential

1. Run the following command to start the configuration. Replace <ProfileName> with a custom profile name, such as SSOProfile.

   aliyun configure --mode CloudSSO --profile <ProfileName>

2. As prompted, enter the SignIn Url.

   Configuring profile 'SSOProfile' in 'CloudSSO' authenticate mode...
   CloudSSO Sign In Url []: https://signin-<region>.alibabacloudsso.com/<directory-name>/login

3. Follow the browser prompts to complete CloudSSO logon. After logging in, close the browser.

   Note

   If no browser opens, copy the SignIn url and User code from the CLI output and paste them into a browser.

   The following is a sample prompt:

   If the browser does not open automatically, use the following URL to complete the login process:
   
   SignIn url: https://signin-****.alibabacloudsso.com/device/code
   User code: CGKM-LIXZ

4. After successful logon, the CLI lists the accounts you can access. Enter the number of the target account.

   Now you can login to your account with SSO configuration in the browser.
   You have successfully logged in.
   Please choose an account:
   1. <RD Management Account>
   2. <other-account-name>
   Please input the account number: 1

5. The CLI lists available access configurations. Enter the number of the configuration you want to use.

   Please choose an access configuration:
   1. <access-configuration1>
   2. <access-configuration2>
   Please input the access configuration number: 2

6. Set the default region and language. For example:

   Default Region Id []: cn-shanghai
   Default Language [zh|en] en: en

   Set the default region to where your resources reside. Available regions are listed in Regions and availability zones.

7. The terminal displays Configure Done and a welcome message, indicating success.

Run aliyun sts get-caller-identity to verify the credential.

Credential refresh

CloudSSO credentials do not automatically refresh. After expiration, run aliyun configure --mode CloudSSO --profile <ProfileName> again to reconfigure.

Prerequisites

• You have a program or script that outputs a credential in the following JSON format to stdout:

  AccessKey

  {
    "mode": "AK",
    "access_key_id": "<yourAccessKeyID>",
    "access_key_secret": "<yourAccessKeySecret>"
  }

  STS token

  {
    "mode": "StsToken",
    "access_key_id": "<yourAccessKeyID>",
    "access_key_secret": "<yourAccessKeySecret>",
    "sts_token": "<yourSecurityToken>"
  }

• The program must exit with status code 0.

Configure the credential

aliyun configure set \
  --mode External \
  --profile ExternalProfile \
  --process-command "/path/to/credential-helper" \
  --region cn-shanghai

aliyun configure set `
  --mode External `
  --profile ExternalProfile `
  --process-command "/path/to/credential-helper" `
  --region cn-shanghai

aliyun configure --mode External --profile <ProfileName>

Run aliyun sts get-caller-identity to verify the credential.

Credential refresh

The CLI does not cache or refresh External credentials. It re-executes the program each time a credential is needed.

Prerequisites

You have an HTTP(S) endpoint that returns credentials with HTTP 200 in the following JSON format:

{
  "Code": "Success",
  "AccessKeyId": "<yourAccessKeyID>",
  "AccessKeySecret": "<yourAccessKeySecret>",
  "SecurityToken": "<yourSecurityToken>"
}

Configure the credential

Credential refresh

After the credential expires, the CLI automatically sends a new GET request to the endpoint. Your endpoint must return a valid STS token for each request.

Prerequisites

• You have a Bearer Token from the target service.

• You have installed the CLI plugin for the target product: aliyun plugin install --name <plugin-name>.

Configure the credential

aliyun configure set \
  --mode BearerToken \
  --profile BearerProfile \
  --bearer-token <your-bearer-token> \
  --region cn-shanghai

aliyun configure set \
  --mode BearerToken \
  --profile BearerProfile \
  --bearer-token <your-bearer-token> \
  --bearer-token-header-key <custom-header-name> \
  --region cn-shanghai

Verify the credential by calling an API through the product plugin:

aliyun <command> <sub-command> --profile BearerProfile

Environment variables

The BearerToken method supports these environment variables: