Identity as a Service:Best practices: obtain STS credentials on ACK without static credentials

Step 1: Add a cloud account and a system cloud role in Asset Management

In the IDaaS EIAM console, go to Asset Management > Cloud Identity and add the target Alibaba Cloud account. Follow the console prompts to configure the identity provider, system cloud role, and detection items. Confirm that the cloud account and the system cloud role are both in the Available state.

Step 2: Add the target cloud role that obtains the final STS credentials

In the managed cloud account, go to Cloud Role Management and add the target RAM role. Confirm that the cloud role is in the Enabled and Available state. In RAM, the trust policy of the role trusts the identity provider as guided by the IDaaS console, and the permission policy grants only the resource permissions that your workload requires.

Step 3: Create an M2M client and configure ACK OIDC federated credentials

1. In the left-side navigation pane, click M2M Application.

2. Click Add Application, and select the OIDC with M2M Application type.

3. Enter basic information such as the application name, create the application, and record client_id.

Step 4: Grant PAM feature permissions

1. In the left-side navigation pane, click Permission Center, and then select Feature Permission Management.

2. On the Feature Permission Management page, search for the Privileged Access Management application, and click Authorization Management.

3. Select Application Authorization. In Authorized Application, select the M2M client that you created in Step 3. In Select Permissions, search for and grant "Obtain cloud role access credentials (cloud_account_role:obtain_access_credential)."

Step 5: Grant data permissions for the cloud role

1. In the left-side navigation pane, click Permission Center, and then select Data Permission Management.

2. Add an authorization rule, enter the basic information of the rule, and then create it.

3. Select the authorization rule that you just created and click Permission Management.

4. On the Associate Identity tab, select Application, and then select the M2M client that you created in Step 3.

5. On the Asset Management tab, select Cloud Role, click Add Asset, and select the target cloud role from Step 2 that obtains the final STS token.

Step 6: Download and import the IDaaS SDK

1. Download the latest version of the IDaaS SDK from GitHub. Java and Python are supported.

2. Configure the dependencies as described in the SDK README.

Step 7: Create the SDK configuration file

1. Create client-config.json. By default, place it at ~/.cloud_idaas/client-config.json.

2. On GitHub, find IDaaS Core SDK.

3. In the SDK GitHub repository, open the README.md or README_zh.md file, find the OIDC client-config.json example, and copy the example configuration into the client-config.json file that you just created. The following example shows the configuration:

{
  "idaasInstanceId": "idaas_xxx",
  "clientId": "app_xxx",
  "issuer": "https://xxx/api/v2/iauths_system/oauth2",
  "tokenEndpoint": "https://xxx/api/v2/iauths_system/oauth2/token",
  "scope": "urn:cloud:idaas:pam|cloud_account_role:obtain_access_credential",
  "openApiEndpoint": "eiam.[region_id].aliyuncs.com",
  "developerApiEndpoint": "eiam-developerapi.[region_id].aliyuncs.com",
  "authnConfiguration": {
    "identityType": "CLIENT",
    "authnMethod": "OIDC",
    "applicationFederatedCredentialName": "ack-oidc-credential",
    "clientDeployEnvironment": "KUBERNETES",
    "oidcTokenFilePathEnvVarName": "ALIBABA_CLOUD_OIDC_TOKEN_FILE"
  },
  "httpConfiguration": {
    "connectTimeout": 5000,
    "readTimeout": 10000
  }
}

Step 8: Integrate the code

Follow the SDK quick start to complete the following operations:

1. Initialize the IDaaS Core SDK.

2. Pass in the ARN of the target cloud role to create an Alibaba Cloud credentials provider.

3. Obtain the temporary STS credentials.

    public static void main(String[] args) {
        // 1. Initialize the IDaaS Core SDK
        IDaaSCredentialProviderFactory.init();
        // 2. Create the Alibaba Cloud credentials provider
        AlibabaCloudCredentialsProvider credentialsProvider =
                IDaaSPamAklessCredentialFactory.getAlibabaCloudCredentialsProvider(
                        "acs:ram::123456789:role/your-role-name"
                );
        // 3. Obtain the credentials
        CredentialModel credentials = credentialsProvider.getCredentials();
        System.out.println(credentials.getAccessKeyId());
        System.out.println(credentials.getAccessKeySecret());
        System.out.println(credentials.getSecurityToken());
    }