Identity as a Service:Best practice: obtain STS credentials on ACK without static credentials

Step 1: Add a cloud account and system cloud role in Asset Management

In the IDaaS EIAM console, go to Asset Management > Cloud Identity and add the target Alibaba Cloud account. Follow the console prompts to configure the identity provider, system cloud role, and detection items, and confirm that both the cloud account and the system cloud role are in the Available state.

Step 2: Add the target cloud role that obtains the final STS credentials

In Cloud Role Management for the managed cloud account, add the target RAM role. Confirm that the cloud role is in the Enabled and Available state. On the RAM side, the role's trust policy trusts the corresponding identity provider as guided by the IDaaS console, and the role's permission policy grants only the resource permissions that your workload requires.

Step 3: Create an M2M client and configure ACK OIDC federated credentials

1. In the left-side navigation pane, click M2M Application.

2. Click Add Application, and select the OIDC with M2M Application type.

3. Enter the application name and other basic information, complete the creation, and record the client_id.

Step 4: Grant PAM feature permissions

1. In the left-side navigation pane, click Permission Center, and then select Feature Permission Management.

2. On the Feature Permission Management page, search for the Privileged Access Management application, and click Authorization Management.

3. Select Application Authorization. In Authorized Application, select the M2M client that you created in Step 3. In Select Permissions, search for and grant Obtain cloud role access credentials (cloud_account_role:obtain_access_credential).

Step 5: Grant data permissions for the cloud role

1. In the left-side navigation pane, click Permission Center, and then select Data Permission Management.

2. Add an authorization rule, enter its basic information, and then complete the creation.

3. Select the authorization rule that you created, and click Permission Management.

4. On the Associate Identity tab, select Application, and then select the M2M client that you created in Step 3.

5. On the Asset Management tab, select Cloud Role, click Add Asset, and select the target cloud role from Step 2 that obtains the final STS token.

Step 6: Download and import the IDaaS SDK

1. On GitHub, get the latest version of the IDaaS SDK. Only Java and Python are currently supported.

2. Configure the dependencies as described in the SDK README.md.

Step 7: Create the SDK configuration file

1. Create a client-config.json file. By default, you can place it at ~/.cloud_idaas/client-config.json.

2. On GitHub, find the IDaaS Core SDK.

3. In the SDK's GitHub repository, review the README.md file, find the OIDC client-config.json example, and copy it into the client-config.json file that you created. The following example shows the configuration:

{
  "idaasInstanceId": "idaas_xxx",
  "clientId": "app_xxx",
  "issuer": "https://xxx/api/v2/iauths_system/oauth2",
  "tokenEndpoint": "https://xxx/api/v2/iauths_system/oauth2/token",
  "scope": "urn:cloud:idaas:pam|cloud_account_role:obtain_access_credential",
  "openApiEndpoint": "eiam.[region_id].aliyuncs.com",
  "developerApiEndpoint": "eiam-developerapi.[region_id].aliyuncs.com",
  "authnConfiguration": {
    "identityType": "CLIENT",
    "authnMethod": "OIDC",
    "applicationFederatedCredentialName": "ack-oidc-credential",
    "clientDeployEnvironment": "KUBERNETES",
    "oidcTokenFilePathEnvVarName": "ALIBABA_CLOUD_OIDC_TOKEN_FILE"
  },
  "httpConfiguration": {
    "connectTimeout": 5000,
    "readTimeout": 10000
  }
}

Step 8: Integrate the code

Complete the following operations by referring to the SDK quick start:

1. Initialize the IDaaS Core SDK.

2. Pass in the target cloud role ARN to create the Alibaba Cloud credentials provider.

3. Obtain the temporary STS credentials.

    public static void main(String[] args) {
        // 1. Initialize the IDaaS Core SDK
        IDaaSCredentialProviderFactory.init();
        // 2. Create the Alibaba Cloud credentials provider
        AlibabaCloudCredentialsProvider credentialsProvider =
                IDaaSPamAklessCredentialFactory.getAlibabaCloudCredentialsProvider(
                        "acs:ram::123456789:role/your-role-name"
                );
        // 3. Obtain the credentials
        CredentialModel credentials = credentialsProvider.getCredentials();
        System.out.println(credentials.getAccessKeyId());
        System.out.println(credentials.getAccessKeySecret());
        System.out.println(credentials.getSecurityToken());
    }