This topic describes instance identities and how to use instance identities. This topic also provides examples on how to use instance identities with custom parameters specified and unspecified.
Background information
Instance identities are part of the metadata of instances and can be used to identify and differentiate instances. They provide an important trust foundation to control application permissions and activate software. Instance identities are generated in real time and dynamically change with instances.
Each instance identity consists of an instance identity document (document) and an instance identity signature (signature).
The instance identity document is used to describe information of an instance and contains instance properties described in the following table.
Property | Description | Changeable |
---|---|---|
account-id | The ID of the Alibaba Cloud account to which the instance belongs. | No |
instance-id | The ID of the instance. | No |
mac | The media access control (MAC) address of the primary elastic network interface (ENI) of the instance. | No |
region-id | The ID of the region where the instance resides. | No |
serial-number | The serial number of the instance. | No |
zone-id | The ID of the zone where the instance resides. | No |
instance-type | The instance type. | Yes. This property changes when the instance type of the instance is changed.
For more information, see Overview of instance upgrade and downgrade. |
image-id | The ID of the image used by the instance. | Yes. This property changes when the system disk of the instance is replaced.
For more information, see Replace the system disk (public images). |
private-ip | The private IP address of the instance. | Yes. This property changes when the private IP address of the instance in a virtual
private cloud (VPC) is changed.
For more information, see Modify a private IP address. |
The instance identity signature is encrypted by using the PKCS #7 standard and is secure and reliable.
You can specify the audience parameter in the instance identity signature. The value of the audience parameter can be a random string, a timestamp, regularly changing data, or data generated by a specific algorithm. After the audience parameter is specified, it is difficult for other users to guess the value of the audience parameter even if they have obtained information about the identity document and the identity signature. This effectively prevents fraudulent use of signatures.
If you specify the audience parameter, you must simultaneously set the instance identity document and signature.
For example, if you specify the audience parameter when you obtain the identity signature, you must add the audience value to the end of the dynamically obtained instance identity document in the following
format before you verify the signature by using OpenSSL: "audience":"Value of audience"
. Separate multiple values with commas (,).
In the following scenarios, you can use instance identities (instance-identity
) for authentication, authorization, or identifying runtime environment.
- Software is traditionally activated by using a single serial number for a single device. This practice is not suitable for using software on the cloud because software is used at varying points in time and in different scenarios. You can use instance identities for user authorization when you publish application software in Alibaba Cloud Marketplace. For more information, see Example 1: Use instance identities without specifying the audience parameter.
- When you write sensitive data to an instance, you can use instance identities to ensure that you are writing the sensitive data to the exact instance that you want to use.
- Scenarios where you want to confirm the source of the instance.
Use instance identities
OpenSSL is required if you want to use instance identities. If you do not have OpenSSL configured in your instance, you must go to the OpenSSL official website to download and install OpenSSL. The following example demonstrates how to use instance identities on a Linux instance that runs CentOS 7.4.
Example 1: Use instance identities without specifying the audience parameter
The following example demonstrates how to use instance identities as an application software seller if an image is published to Alibaba Cloud Marketplace.
Example 2: Use instance identities while specifying the audience parameter
The following example demonstrates how to use instance identities as an application software seller if an image is published to Alibaba Cloud Marketplace. You can specify the audience parameter to identify the instance and implement policy control at the application server to allow authenticated users to use the software. This can protect the authorization code (license) against unauthorized use. The value of the audience parameter can be a random string, a timestamp, regularly changing data, or data generated by a specific algorithm.