Configure endpoints and credentials - Simple Message Queue (formerly MNS)

To make SMQ requests by using the Java SDK, you must configure an endpoint and access credentials. Alibaba Cloud services use access credentials to verify your identity and access permissions. You can select different types of access credentials based on the authentication and authorization requirements of your use case. This topic describes how to configure endpoints, temporary access credentials, and long-term access credentials.

Configure an endpoint

Configure the public or internal endpoint information for SMQ in the aliyun-mns.properties file, which is usually located at ${user.home}/.aliyun-mns.properties.

On Linux and macOS, the aliyun-mns.properties file is located at ~/.aliyun-mns.properties.

On Windows, the aliyun-mns.properties file is located at %USERPROFILE%\.aliyun-mns.properties.

The aliyun-mns.properties file is configured as follows:

mns.accountendpoint=http://120228xxxxxxx.mns.cn-xxxxxx.aliyuncs.com

You can find endpoint information for SMQ in the Endpoint section on the Queue Details/Topic Details page in the console.

Configure access credentials

You can choose from the following types of access credentials.

Long-term access credentials: For optimal security, we recommend using temporary access credentials instead of long-term ones. However, for scenarios that prioritize convenience, long-term credentials can avoid the need for frequent refreshes. To improve security, rotate your long-term credentials every three months. If your credentials are leaked or no longer in use, disable or delete them immediately to prevent security risks.
Temporary access credentials: These are recommended for scenarios that require high security, such as temporarily authorizing an application to access SMQ. They have a limited validity period, which reduces the risk of credential leakage. In addition, they support permission control to effectively prevent excessive permissions.

Use long-term access credentials

When you are ready to use the Java SDK in your application or service to access the SMQ service for a long period, you can configure long-term access credentials in the following ways.

Configure an AccessKey pair for a RAM user: If you need long-term access to your SMQ, you can access your SMQ by using the AccessKey pair of a RAM user.

Obtain the AccessKey pair of the RAM user.
For more information, see Create an AccessKey pair for a RAM user.
Important
To reduce the risk of an AccessKey pair leak, we recommend rotating any AccessKey pair that is more than three months old. If an AccessKey pair is no longer needed, disable and delete it promptly.
Configure the AccessKey pair of the RAM user.
Environment variables
1. Configure environment variables.
  macOS
  Open the terminal.
  Run the following command:
  nano ~/.bash_profile
  Add the AccessKey pair of the RAM user to the end of the file.
  export ALIBABA_CLOUD_ACCESS_KEY_ID=LTA**** export ALIBABA_CLOUD_ACCESS_KEY_SECRET=moiEs****
  Press Ctrl+X, press the Y key to confirm, and then press Enter to save and exit the file.
  Run the following command to apply the changes:
  source ~/.bash_profile
  Run the following commands to verify the configuration:
  echo $ALIBABA_CLOUD_ACCESS_KEY_ID echo $ALIBABA_CLOUD_ACCESS_KEY_SECRET
  A successful response looks like this:
  LTA**** moiEs****
  Linux
  Open the terminal.
  Run the following command:
  sudo vim /etc/profile
  Add the AccessKey pair of the RAM user to the end of the file.
  export ALIBABA_CLOUD_ACCESS_KEY_ID=LTA**** export ALIBABA_CLOUD_ACCESS_KEY_SECRET=moiEs****
  Press the ESC key to exit edit mode, enter :wq, and then press Enter to save and exit the file.
  Run the following command to apply the changes:
  source /etc/profile
  Run the following commands to verify the configuration:
  echo $ALIBABA_CLOUD_ACCESS_KEY_ID echo $ALIBABA_CLOUD_ACCESS_KEY_SECRET
  A successful response looks like this:
  LTA**** moiEs****
  Windows
  Graphical user interface
  These steps show how to set the AccessKey pair of a RAM user as environment variables in the Windows 10 GUI.
  On your desktop, right-click This PC and select Properties > Advanced system settings > Environment Variables. In the dialog box that appears, under User variables or System variables, click New.
  Add the following environment variables.
  Parameter
  Value
  ALIBABA_CLOUD_ACCESS_KEY_ID
  LTA****
  ALIBABA_CLOUD_ACCESS_KEY_SECRET
  moiEs****
  Run the following commands to verify the configuration:
  echo %ALIBABA_CLOUD_ACCESS_KEY_ID% echo %ALIBABA_CLOUD_ACCESS_KEY_SECRET%
  A successful response looks like this:
  LTA**** moiEs****
  Command prompt
  Open Command Prompt.
  Run the following commands to configure the AccessKey pair of the RAM user:
  set ALIBABA_CLOUD_ACCESS_KEY_ID=LTA**** set ALIBABA_CLOUD_ACCESS_KEY_SECRET=moiEs****
  Run the following commands to apply the changes permanently:
  setx ALIBABA_CLOUD_ACCESS_KEY_ID "%ALIBABA_CLOUD_ACCESS_KEY_ID%" setx ALIBABA_CLOUD_ACCESS_KEY_SECRET "%ALIBABA_CLOUD_ACCESS_KEY_SECRET%"
  Run the following commands to verify the configuration:
  echo %ALIBABA_CLOUD_ACCESS_KEY_ID% echo %ALIBABA_CLOUD_ACCESS_KEY_SECRET%
  A successful response looks like this:
  LTA**** moiEs****
  Windows PowerShell
  Press Win + X.
  Set the AccessKey pair of the RAM user.
  For the current session only
  From the pop-up menu, select Windows PowerShell.
  Add the following environment variables for the current session:
  $env:ALIBABA_CLOUD_ACCESS_KEY_ID = "LTA****" $env:ALIBABA_CLOUD_ACCESS_KEY_SECRET = "moiEs****"
  For all new sessions
  From the pop-up menu, select Windows PowerShell.
  Add the following environment variables for all new sessions:
  [System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_ID', 'LTA****', [System.EnvironmentVariableTarget]::User) [System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_SECRET', 'moiEs****', [System.EnvironmentVariableTarget]::User)
  For all users
  From the pop-up menu, select Windows PowerShell (Administrator).
  Add the following environment variables for all users:
  [System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_ID', 'LTA****', [System.EnvironmentVariableTarget]::Machine) [System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_SECRET', 'moiEs****', [System.EnvironmentVariableTarget]::Machine)
  Run the following commands to verify the configuration:
  Get-ChildItem env:ALIBABA_CLOUD_ACCESS_KEY_ID Get-ChildItem env:ALIBABA_CLOUD_ACCESS_KEY_SECRET
  A successful response looks like this:
  LTA**** moiEs****
2. Load the AccessKey pair from the environment variables.
```
// Configure credentials by using the AccessKey pair of the RAM user from the environment variables.
CloudAccount account = new CloudAccount(ServiceSettings.getMNSAccountEndpoint());
```
Embed in code
Warning
Hard-coding credentials in your code can lead to security risks. If the credentials are leaked, an attacker can use them to access your SMQ resources. As a best practice, load credentials from environment variables or use other secure methods.
```
CloudAccount account = new CloudAccount(ServiceSettings.getMNSAccountEndpoint());
```

Use temporary access credentials

When you temporarily use the Java SDK to access the SMQ service, you can use one of the following methods to configure temporary access credentials.

Use temporary credentials from STS: Use Security Token Service (STS) to obtain temporary access credentials for short-term access to SMQ. This method enhances security by not exposing your long-term AccessKey pair.
Assume a RAM role: If you need to grant access to a RAM user within your account or a different Alibaba Cloud account, you can configure the user to assume a RAM role to access SMQ.
Use an instance RAM role for an ECS instance: If your application runs on an Alibaba Cloud ECS instance, assign it an instance RAM role to access SMQ. The instance then automatically obtains temporary credentials from STS. These credentials, sourced from instance metadata, are automatically fetched and rotated, eliminating the need for manual management.

STS credentials

Create a RAM user.
For more information, see Create a RAM user.
Grant the RAM user the AliyunSTSAssumeRoleAccess permission.
For more information, see Grant permissions to a RAM user.
Use the RAM user to call the AssumeRole API operation of STS to obtain temporary access credentials.
For more information, see AssumeRole.

Configure the temporary access credentials from STS.

Environment variables

Use the temporary access credentials obtained from STS to configure environment variables.
macOS
1. Open the terminal.
2. Run the following command:
```
nano ~/.bash_profile
```
3. Add the temporary access credentials (AccessKey ID, AccessKey Secret, and security token) from STS to the end of the file.
```
export MNS_ACCESS_KEY_ID=LTA****
export MNS_ACCESS_KEY_SECRET=moiEs****
export MNS_SESSION_TOKEN=CAES****
```
4. Press Ctrl+X, press the Y key to confirm, and then press Enter to save and exit the file.
5. Run the following command to apply the changes:
```
source ~/.bash_profile
```
6. Run the following commands to verify the configuration:
```
echo $MNS_ACCESS_KEY_ID
echo $MNS_ACCESS_KEY_SECRET
echo $MNS_SESSION_TOKEN
```
  A successful response looks like this:
```
LTA****
moiEs**** 
CAES****
```
Linux
1. Open the terminal.
2. Run the following command:
```
sudo vim /etc/profile
```
3. Add the temporary access credentials (AccessKey ID, AccessKey Secret, and security token) from STS to the end of the file.
```
export MNS_ACCESS_KEY_ID=LTA****
export MNS_ACCESS_KEY_SECRET=moiEs****
export MNS_SESSION_TOKEN=CAES****
```
4. Press the ESC key to exit edit mode, enter :wq, and then press Enter to save and exit the file.
5. Run the following command to apply the changes:
```
source /etc/profile
```
6. Run the following commands to verify the configuration:
```
echo $MNS_ACCESS_KEY_ID
echo $MNS_ACCESS_KEY_SECRET
echo $MNS_SESSION_TOKEN
```
  A successful response looks like this:
```
LTA****
moiEs**** 
CAES****
```
Windows
Graphical user interface
These steps show how to set temporary access credentials from STS as environment variables in the Windows 10 GUI:
On your desktop, right-click This PC and select Properties > Advanced system settings > Environment Variables. In the dialog box that appears, under User variables or System variables, click New.
Add the following environment variables.
Parameter
Value
MNS_ACCESS_KEY_ID
LTA****
MNS_ACCESS_KEY_SECRET
moiEs****
MNS_SESSION_TOKEN
CAES****
Run the following commands to verify the configuration:
echo %MNS_ACCESS_KEY_ID% echo %MNS_ACCESS_KEY_SECRET% echo %MNS_SESSION_TOKEN%
A successful response looks like this:
LTA**** moiEs**** CAES****
Command prompt
Open Command Prompt.
Run the following commands to configure the temporary access credentials (AccessKey ID, AccessKey Secret, and security token) from STS:
set MNS_ACCESS_KEY_ID=LTA**** set MNS_ACCESS_KEY_SECRET=moiEs**** set MNS_SESSION_TOKEN=CAES****
Run the following commands to apply the changes permanently:
setx MNS_ACCESS_KEY_ID "%MNS_ACCESS_KEY_ID%" setx MNS_ACCESS_KEY_SECRET "%MNS_ACCESS_KEY_SECRET%" setx MNS_SESSION_TOKEN "%MNS_SESSION_TOKEN%"
Run the following commands to verify the configuration:
echo %MNS_ACCESS_KEY_ID% echo %MNS_ACCESS_KEY_SECRET% echo %MNS_SESSION_TOKEN%
A successful response looks like this:
LTA**** moiEs**** CAES****
Windows PowerShell
Press Win + X.
Set the temporary access credentials from STS.
For the current session only
From the pop-up menu, select Windows PowerShell.
Add the following environment variables for the current session:
$env:MNS_ACCESS_KEY_ID = "LTA****" $env:MNS_ACCESS_KEY_SECRET = "moiEs****" $env:MNS_SESSION_TOKEN = "CAE****"
For all new sessions
From the pop-up menu, select Windows PowerShell.
Add the following environment variables for all new sessions:
[System.Environment]::SetEnvironmentVariable('MNS_ACCESS_KEY_ID', 'LTA****', [System.EnvironmentVariableTarget]::User) [System.Environment]::SetEnvironmentVariable('MNS_ACCESS_KEY_SECRET', 'moiEs****', [System.EnvironmentVariableTarget]::User) [System.Environment]::SetEnvironmentVariable('MNS_SESSION_TOKEN', 'CAES****', [System.EnvironmentVariableTarget]::User)
For all users
From the pop-up menu, select Windows PowerShell (Administrator).
Add the following environment variables for all users:
[System.Environment]::SetEnvironmentVariable('MNS_ACCESS_KEY_ID', 'LTA****', [System.EnvironmentVariableTarget]::Machine) [System.Environment]::SetEnvironmentVariable('MNS_ACCESS_KEY_SECRET', 'moiEs****', [System.EnvironmentVariableTarget]::Machine) [System.Environment]::SetEnvironmentVariable('MNS_SESSION_TOKEN', 'CAES****', [System.EnvironmentVariableTarget]::Machine)
Run the following commands to verify the configuration:
Get-ChildItem env:MNS_ACCESS_KEY_ID Get-ChildItem env:MNS_ACCESS_KEY_SECRET Get-ChildItem env:MNS_SESSION_TOKEN
A successful response looks like this:
LTA**** moiEs**** CAES****

Load the temporary access credentials from the environment variables.

// Load the temporary credentials (AccessKey ID, AccessKey Secret, and security token) from environment variables. 
String accessKeyId = System.getenv("MNS_ACCESS_KEY_ID"); 
String accessKeySecret = System.getenv("MNS_ACCESS_KEY_SECRET");
String sessionToken = System.getenv("MNS_SESSION_TOKEN"); 
AlibabaCloudCredentials credentials = new BasicSessionCredentials(accessKeyId,accessKeySecret,sessionToken); 
AlibabaCloudCredentialsProvider provider = new StaticCredentialsProvider(credentials);

Embed in code

Warning

Hard-coding credentials in your code can lead to security risks. If the credentials are leaked, an attacker can use them to access your SMQ resources. As a best practice, load credentials from environment variables or use other secure methods.

// Load the temporary credentials (AccessKey ID, AccessKey Secret, and security token) from environment variables.
String accessKeyId = System.getenv("MNS_ACCESS_KEY_ID");
String accessKeySecret = System.getenv("MNS_ACCESS_KEY_SECRET");
String sessionToken = System.getenv("MNS_SESSION_TOKEN");

AlibabaCloudCredentials credentials = new BasicSessionCredentials(accessKeyId,accessKeySecret,sessionToken);
AlibabaCloudCredentialsProvider provider = new StaticCredentialsProvider(credentials);

String endpoint = ServiceSettings.getMNSAccountEndpoint();
CloudAccount account = new CloudAccount(endpoint, provider);

Assume a RAM role

Obtain the AccessKey pair of the RAM user.
For more information, see Create an AccessKey pair for a RAM user.
Important
To reduce the risk of an AccessKey pair leak, we recommend rotating any AccessKey pair that is more than three months old. If an AccessKey pair is no longer needed, disable and delete it promptly.
Obtain the Alibaba Cloud Resource Name (ARN) of the target RAM role.
Note
The role ARN is the unique identifier for the target RAM role. It follows the format acs:ram::$accountID:role/$roleName, where $accountID is your Alibaba Cloud account ID and $roleName is the name of the RAM role.
For more information, see View the information of a RAM role.

Configure the credentials using the RAM user's AccessKey pair and the target role's ARN.

Environment variables

Use the obtained AccessKey pair and role ARN to configure environment variables.

macOS

Open the terminal.
Run the following command:
```
nano ~/.bash_profile
```

Add the RAM user's AccessKey pair and the role ARN to the end of the file.

export MNS_ACCESS_KEY_ID=LTAI****
export MNS_ACCESS_KEY_SECRET=IrVTNZNy****  
export MNS_STS_ROLE_ARN=acs:ram::17464958********:role/mnsststest

Press Ctrl+X, press the Y key to confirm, and then press Enter to save and exit the file.
Run the following command to apply the changes:
```
source ~/.bash_profile
```

Run the following commands to verify the configuration:

echo $MNS_ACCESS_KEY_ID
echo $MNS_ACCESS_KEY_SECRET
echo $MNS_STS_ROLE_ARN

A successful response looks like this:

LTAI****
IrVTNZNy****  
acs:ram::17464958********:role/mnsststest

Linux

Open the terminal.
Run the following command:
```
sudo vim /etc/profile
```

Add the RAM user's AccessKey pair and the role ARN to the end of the file.

export MNS_ACCESS_KEY_ID=LTAI****
export MNS_ACCESS_KEY_SECRET=IrVTNZNy****  
export MNS_STS_ROLE_ARN=acs:ram::17464958********:role/mnsststest

Press the ESC key to exit edit mode, enter :wq, and then press Enter to save and exit the file.
Run the following command to apply the changes:
```
source /etc/profile
```

Run the following commands to verify the configuration:

echo $MNS_ACCESS_KEY_ID
echo $MNS_ACCESS_KEY_SECRET
echo $MNS_STS_ROLE_ARN

A successful response looks like this:

LTAI****
IrVTNZNy****  
acs:ram::17464958********:role/mnsststest

Windows

Graphical user interface

These steps show how to set the RAM user's AccessKey pair and the target role's ARN as environment variables in the Windows 10 GUI.

On your desktop, right-click This PC and select Properties > Advanced system settings > Environment Variables. In the dialog box that appears, under User variables or System variables, click New.
Add the following environment variables.
Parameter
Value
MNS_ACCESS_KEY_ID
LTAI****
MNS_ACCESS_KEY_SECRET
IrVTNZNy****
MNS_STS_ROLE_ARN
acs:ram::17464958********:role/mnsststest

Run the following commands to verify the configuration:

echo %MNS_ACCESS_KEY_ID%
echo %MNS_ACCESS_KEY_SECRET%
echo %MNS_STS_ROLE_ARN%

A successful response looks like this:

LTAI****
IrVTNZNy**** 
acs:ram::17464958********:role/mnsststest

Command prompt

Open Command Prompt.

Run the following commands to configure the RAM user's AccessKey pair and the role ARN:

set MNS_ACCESS_KEY_ID=LTAI****
set MNS_ACCESS_KEY_SECRET=IrVTNZNy****  
set MNS_STS_ROLE_ARN=acs:ram::17464958********:role/mnsststest

Run the following commands to apply the changes permanently:

setx MNS_ACCESS_KEY_ID "%MNS_ACCESS_KEY_ID%"
setx MNS_ACCESS_KEY_SECRET "%MNS_ACCESS_KEY_SECRET%"
setx MNS_STS_ROLE_ARN "%MNS_STS_ROLE_ARN%"

Run the following commands to verify the configuration:

echo %MNS_ACCESS_KEY_ID%
echo %MNS_ACCESS_KEY_SECRET%
echo %MNS_STS_ROLE_ARN%

A successful response looks like this:

LTAI****
IrVTNZNy****  
acs:ram::17464958********:role/mnsststest

Windows PowerShell

Press Win + X.

Set the RAM user's AccessKey pair and the target role's ARN.

For the current session only

From the pop-up menu, select Windows PowerShell.

Add the following environment variables for the current session:

$env:MNS_ACCESS_KEY_ID = "LTAI****"
$env:MNS_ACCESS_KEY_SECRET = "IrVTNZNy****"
$env:MNS_STS_ROLE_ARN = "acs:ram::17464958********:role/ossststest"

For all new sessions

From the pop-up menu, select Windows PowerShell.

Add the following environment variables for all new sessions:

[System.Environment]::SetEnvironmentVariable('MNS_ACCESS_KEY_ID', 'LTAI****', [System.EnvironmentVariableTarget]::User)
[System.Environment]::SetEnvironmentVariable('MNS_ACCESS_KEY_SECRET', 'IrVTNZNy****', [System.EnvironmentVariableTarget]::User)
[System.Environment]::SetEnvironmentVariable('MNS_STS_ROLE_ARN', 'acs:ram::17464958********:role/mnsststest', [System.EnvironmentVariableTarget]::User)

For all users

From the pop-up menu, select Windows PowerShell (Administrator).

Add the following environment variables for all users:

[System.Environment]::SetEnvironmentVariable('MNS_ACCESS_KEY_ID', 'LTAI****', [System.EnvironmentVariableTarget]::Machine)
[System.Environment]::SetEnvironmentVariable('MNS_ACCESS_KEY_SECRET', 'IrVTNZNy****', [System.EnvironmentVariableTarget]::Machine)
[System.Environment]::SetEnvironmentVariable('MNS_STS_ROLE_ARN', 'acs:ram::17464958********:role/mnsststest', [System.EnvironmentVariableTarget]::Machine)

Run the following commands to verify the configuration:

Get-ChildItem env:MNS_ACCESS_KEY_ID
Get-ChildItem env:MNS_ACCESS_KEY_SECRET
Get-ChildItem env:MNS_STS_ROLE_ARN

A successful response looks like this:

LTAI****
IrVTNZNy**** 
acs:ram::17464958********:role/mnsststest

Load the credentials from the environment variables.

// The region where STS is authorized to assume the role. This example uses China (Hangzhou). Replace it with your actual region.
String region = "cn-hangzhou";
// Load the RAM user's AccessKey pair (AccessKey ID and AccessKey Secret) from environment variables.
String accessKeyId = System.getenv("MNS_ACCESS_KEY_ID");
String accessKeySecret = System.getenv("MNS_ACCESS_KEY_SECRET");
// Load the role ARN from environment variables.
String roleArn = System.getenv("MNS_STS_ROLE_ARN");

// Configure credentials using the AccessKey pair and role ARN from the environment variables.
STSAssumeRoleSessionCredentialsProvider credentialsProvider = CredentialsProviderFactory
        .newSTSAssumeRoleSessionCredentialsProvider(
                region, 
                accessKeyId, 
                accessKeySecret, 
                roleArn
        );

Embed in code

Warning

// The region ID must match the region of the MNS endpoint.
String regionId = "cn-hangzhou";

// Load the RAM user's AccessKey pair (AccessKey ID and AccessKey Secret) from environment variables.
String accessKeyId = System.getenv("MNS_ACCESS_KEY_ID");
String accessKeySecret = System.getenv("MNS_ACCESS_KEY_SECRET");
// Load the role ARN from environment variables.
String roleArn = System.getenv("MNS_STS_ROLE_ARN");

DefaultProfile profile = DefaultProfile.getProfile(regionId);
AlibabaCloudCredentialsProvider provider = new STSAssumeRoleSessionCredentialsProvider(
    new BasicCredentials(accessKeyId, accessKeySecret),
    roleArn,
    profile
);


String endpoint = ServiceSettings.getMNSAccountEndpoint();
CloudAccount account = new CloudAccount(endpoint, provider);

Instance RAM role

Assign a RAM role to the ECS instance.
For more information, see Attach an instance RAM role.

Configure the credentials to use the instance RAM role.

// Obtain credentials using the instance RAM role. This example uses a role named "ecs-ram-role".
CredentialsProvider provider = new InstanceProfileCredentialsProvider("ecs-ram-role");

Parameter	Value
ALIBABA_CLOUD_ACCESS_KEY_ID	LTA****
ALIBABA_CLOUD_ACCESS_KEY_SECRET	moiEs****

Parameter	Value
MNS_ACCESS_KEY_ID	LTA****
MNS_ACCESS_KEY_SECRET	moiEs****
MNS_SESSION_TOKEN	CAES****