Elastic Compute Service:Grant ECS access to resources of other Alibaba Cloud services by using instance RAM roles

Benefits

You can obtain the following benefits when you use instance RAM roles to obtain temporary access credentials for authentication and access control:

• Enhanced communication security: You can use Security Token Service (STS) tokens instead of AccessKey pairs to access resources, which reduces the risk of AccessKey pair leaks.

• Cross-service access and fine-grained permission management: You can attach instance RAM roles that include different policies to grant ECS instances access only to specific resources based on the principle of least privilege.

• Simplified permission maintenance: You can modify the policies of instance RAM roles that are attached to ECS instances to modify and manage the access permissions of the instances without the need to manage credentials on the instances.

Limits

Take note of the following limits when you attach instance RAM roles to ECS instances:

• You must deploy the ECS instances in virtual private clouds (VPCs).

• You can attach only one instance RAM role to an ECS instance.

Create an instance RAM role and attach the instance RAM role to an ECS instance

Create an instance RAM role and grant the instance RAM role the required permissions to access specific Alibaba Cloud services. For example, to allow the ECS instance to access Object Storage Service (OSS), you must grant the instance RAM role the permissions to read data from and write data to OSS.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs: [ECS RAM Action]",
                "ecs: CreateInstance",
                "ecs: AttachInstanceRamRole",
                "ecs: DetachInstanceRAMRole"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ram:PassRole",
            "Resource": "*"
        }
    ]
}

Use an instance RAM role to obtain temporary access credentials

After applications deployed on an ECS instance obtain temporary access credentials to access other Alibaba Cloud services, the applications leverage the temporary access credentials to call API operations in a secure manner to access or manage data across Alibaba Cloud services. The temporary access credentials are automatically updated on a periodic basis.

Detach or change an instance RAM role

Example: Use instance RAM roles to access other Alibaba Cloud services

In this example, a Python application that is deployed on a Linux ECS instance uses an instance RAM role to download an image from OSS.

1. Complete the preparations.

   1. Create an instance RAM role, attach the AliyunOSSReadOnlyAccess policy to the instance RAM role, and then attach the instance RAM role to a Linux ECS instance.

      For more information, see the Create an instance RAM role and attach the instance RAM role to an ECS instance section of this topic.

   2. Create an OSS bucket in the region where the ECS instance resides and obtain the name and endpoint of the bucket from the Buckets page. For more information, see Create a bucket.

      Important

      If you want to access OSS over the Internet, make sure that the ECS instance can access the Internet. To allow the ECS instance to access the Internet over IPv4, you can modify the public bandwidth configurations of the ECS instance or associate an elastic IP address (EIP) with the ECS instance. For more information, see Modify the public bandwidth configurations of an instance associated with an auto-assigned public IP address or the Associate one or more EIPs with an instance section of the "Associate or disassociate an EIP" topic.

      

      

   3. Upload images to the OSS bucket. For more information, see the Use the OSS console section of the "Simple upload" topic.

2. Connect to the Linux ECS instance and install OSS SDK for Python and the Alibaba Cloud Credentials tool.

   Note

   In this example, an ECS instance that runs an Alibaba Cloud Linux 3 operating system is used. By default, Python 3 is installed on Alibaba Cloud Linux 3. If you use an ECS instance that runs another Linux operating system, change the commands in this section based on the Python version. If you use an ECS instance that runs a Windows operating system, use the procedure described in Installation to install OSS SDK for Python.

   1. Update the pip, setuptools, and wheel tools.

      sudo pip3 install --upgrade pip setuptools wheel

   2. Install the Alibaba Cloud Credentials tool.

      sudo pip3 install alibabacloud_credentials  

   3. Install the python-devel package on which OSS SDK for Python depends.

      sudo yum install python3-devel 

   4. Install OSS SDK for Python.

      sudo pip3 install oss2 

3. Use the temporary access credentials of the instance RAM role to access OSS and download an image.

   Compile Python code. Sample Python code (Replace variables with the actual values):

   import oss2
   from alibabacloud_credentials.client import Client
   from alibabacloud_credentials.models import Config
   from oss2 import CredentialsProvider
   from oss2.credentials import Credentials
   
   class CredentialProviderWarpper(CredentialsProvider):
       def __init__(self, client):
           self.client = client
   
       def get_credentials(self):
           access_key_id = self.client.get_access_key_id()
           access_key_secret = self.client.get_access_key_secret()
           security_token = self.client.get_security_token()
           return Credentials(access_key_id, access_key_secret, security_token)
   
   def download_image_using_instance_role(bucket_name, endpoint, object_key, local_file, role_name):
       config = Config(
           type='ecs_ram_role',      # Specify the type of access credential. Set this parameter to ecs_ram_role. 
           role_name=role_name
       )
       cred = Client(config)
       credentials_provider = CredentialProviderWarpper(cred)
       auth = oss2.ProviderAuth(credentials_provider)
   
       # Initialize the OSS bucket.
       bucket = oss2.Bucket(auth, endpoint, bucket_name)
       # Download the image.
       bucket.get_object_to_file(object_key, local_file)
       print("Image downloaded successfully")
   
   if __name__ == "__main__":  
   
       # Define global variables.
       role_name = 'role_name'  # Specify the name of the instance RAM role.
       bucket_name = 'bucket_name'  # Specify the name of the OSS bucket.
       endpoint = 'http://oss-cn-beijing-internal.aliyuncs.com'  # Specify the endpoint of the OSS bucket.
       object_key = 'testfolder/example.png'  # Specify the path in which the image that you want to download is stored in OSS. The path does not include the bucket name.
       local_file = '/localpath/to/image.png'  # Specify a name for the image and the path in which you want to store the image on the ECS instance.
       download_image_using_instance_role(bucket_name, endpoint, object_key, local_file, role_name)

References

• If your self-managed application is deployed on an ECS instance, you can attach an instance RAM role to the ECS instance and use the instance RAM role to access Key Management Service (KMS) from the instance. For more information, see Use the instance RAM role attached to an ECS instance to securely access KMS.

• If an ECS instance no longer requires specific permissions, you can revoke the permissions from the instance RAM role that is attached to the instance. For more information, see Revoke permissions from a RAM role.

• If you hard code a plaintext AccessKey pair in the code that you use to call API operations of Alibaba Cloud, the AccessKey pair may be leaked due to improper permission management of the code repository. To call the API operations of Alibaba Cloud, we recommend that you use access credentials instead of a hard-coded AccessKey pair. For more information, see Best practices for using an access credential to call API operations and Credential security solutions.