This topic describes how to use STS temporary security tokens to enable cross-account back-to-origin requests to a private OSS bucket. The STS method is a more flexible and secure alternative to permanent security tokens, such as an access key, which require complex configuration. This method simplifies permission management and improves resource access security.
By default, ESA can use STS only to make origin requests to private OSS buckets within the same Alibaba Cloud account. To enable cross-account origin requests to a private OSS bucket by using STS, you must manually add a bucket policy in OSS. Follow these steps to configure the policy:
-
Log on to the Alibaba Cloud account that owns the private bucket and go to the OSS console.
-
Choose Buckets > Your target bucket > Permission Control > Bucket Policy. In the Permission Control section, on the Bucket Policy tab, click Authorize.
-
For Authorized User, select other account, and enter the Alibaba Cloud account ID or the RAM user ARN of the Alibaba Cloud account where ESA resides. The RAM user ARN format is
acs:sts::<uid>:*, where<uid>is the account ID of the Alibaba Cloud account. For Authorized Operation, select basic settings > Read-Only (excluding ListObject), and then click OK. -
After adding the grant, you can view the authorization details on the Bucket Policy tab.