Connect to SMQ via Python with Secure Endpoint Authentication - Simple Message Queue - Alibaba Cloud - Simple Message Queue (formerly MNS)

To make SMQ requests using the Python SDK, you must configure an endpoint and access credentials. Alibaba Cloud services use access credentials to verify your identity and permissions. You can choose different types of access credentials based on the authentication and authorization requirements of your use case. This topic describes how to configure endpoints, temporary access credentials, and long-term access credentials.

Configure the endpoint

Download the latest version of the Python SDK. Decompress the package and go to the aliyun-mns-python-sdk subdirectory.
Open the sample.cfg file to configure the endpoint.
- You can find information about the SMQ endpoint in the Endpoint section on the Queue Details or Topic Details page of the console. Log on to the Message Service (MNS) console. In the Queue List, click the name of a target queue to go to the Queue Details page. In the Endpoint section at the bottom of the page, obtain the endpoint for public or internal access and add it to the sample.cfg file.
- Endpoints vary by region.

Configure access credentials

You can use the following types of access credentials.

Long-term access credentials: For best security, use temporary access credentials instead of long-term access credentials. Long-term access credentials are convenient because they do not require frequent refreshing. Rotate your long-term access credentials every three months to enhance account security. If a long-term access credential is compromised or no longer in use, delete or disable it immediately to prevent security risks.
Temporary access credentials: For high-security use cases, such as temporarily authorizing an application to access SMQ, use temporary access credentials. These credentials are valid only for a limited time, which reduces the risk of credential compromise. Additionally, they support fine-grained access control, which helps avoid the security risks associated with excessive permissions.

Use long-term access credentials

When you are ready for long-term access to the SMQ service from an application or service, you can use the AccessKey pair of a RAM user to access your SMQ.

Obtain the AccessKey pair of a RAM user.

For more information, see Create an AccessKey pair for a RAM user.

Important
Rotate any RAM user AccessKey pair that is older than 3 months. If an AccessKey pair is no longer in use, immediately disable and delete it to prevent leaks.

Configure the AccessKey pair of the RAM user.

Environment variables

Configure environment variables.

macOS

Open the Terminal.
Run the following command.
```
nano ~/.bash_profile
```

Add the AccessKey pair of the RAM user to the end of the file.

export ALIBABA_CLOUD_ACCESS_KEY_ID=LTA****
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=moiEs****

Press Ctrl+X, press Y to confirm, and then press Enter to save and exit.
Run the following command to apply the changes.
```
source ~/.bash_profile
```
Run the following commands to verify the environment variable configuration.
```
echo $ALIBABA_CLOUD_ACCESS_KEY_ID
echo $ALIBABA_CLOUD_ACCESS_KEY_SECRET
```
Example of a successful output:
```
LTA****
moiEs****  
```

Linux

Open the Terminal.
Run the following command.
```
sudo vim /etc/profile
```

Add the AccessKey pair of the RAM user to the end of the file.

export ALIBABA_CLOUD_ACCESS_KEY_ID=LTA****
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=moiEs****

Press ESC to exit insert mode, enter :wq, and then press Enter to save and exit the file.
Run the following command to apply the changes.
```
source /etc/profile
```
Run the following commands to verify the environment variable configuration.
```
echo $ALIBABA_CLOUD_ACCESS_KEY_ID
echo $ALIBABA_CLOUD_ACCESS_KEY_SECRET
```
Example of a successful output:
```
LTA****
moiEs**** 
```

Windows

GUI

To set the RAM user's AccessKey pair as environment variables by using the Windows 10 GUI:

On your desktop, right-click This PC and select Properties > Advanced system settings > Environment Variables. In the System variables or User variables section, click New.

Add the following environment variables.

Parameter	Example
ALIBABA_CLOUD_ACCESS_KEY_ID	LTA****
ALIBABA_CLOUD_ACCESS_KEY_SECRET	moiEs****

Run the following commands to verify the environment variable configuration.
```
echo $ALIBABA_CLOUD_ACCESS_KEY_ID
echo $ALIBABA_CLOUD_ACCESS_KEY_SECRET
```
Example of a successful output:
```
LTA****
moiEs**** 
```

CMD

Open Command Prompt.

Run the following commands to configure the AccessKey pair of the RAM user.

set ALIBABA_CLOUD_ACCESS_KEY_ID=LTA****
set ALIBABA_CLOUD_ACCESS_KEY_SECRET=moiEs****

Run the following commands to apply the changes.

setx ALIBABA_CLOUD_ACCESS_KEY_ID "%ALIBABA_CLOUD_ACCESS_KEY_ID%"
setx ALIBABA_CLOUD_ACCESS_KEY_SECRET "%ALIBABA_CLOUD_ACCESS_KEY_SECRET%"

Run the following commands to verify the environment variable configuration.
```
echo %ALIBABA_CLOUD_ACCESS_KEY_ID%
echo %ALIBABA_CLOUD_ACCESS_KEY_SECRET%
```
Example of a successful output:
```
LTA****
moiEs****  
```

Windows PowerShell

Press the Win + X key combination.

Set the AccessKey pair of the RAM user.

Current session

From the pop-up menu, select Windows PowerShell.

Add the following environment variables for the current session.

$env:ALIBABA_CLOUD_ACCESS_KEY_ID = "LTA****"
$env:ALIBABA_CLOUD_ACCESS_KEY_SECRET = "moiEs****"

New sessions

From the pop-up menu, select Windows PowerShell.

Add the following environment variables for all new sessions.

[System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_ID', 'LTA****', [System.EnvironmentVariableTarget]::User)
[System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_SECRET', 'moiEs****', [System.EnvironmentVariableTarget]::User)

All users

From the pop-up menu, select Windows PowerShell (Admin).

Add the following environment variables for all users.

[System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_ID', 'LTA****', [System.EnvironmentVariableTarget]::Machine)
[System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_SECRET', 'moiEs****', [System.EnvironmentVariableTarget]::Machine)

Run the following commands to verify the environment variable configuration.

Get-ChildItem env:ALIBABA_CLOUD_ACCESS_KEY_ID
Get-ChildItem env:ALIBABA_CLOUD_ACCESS_KEY_SECRET

Example of a successful output:

LTA****
moiEs****

Obtain the AccessKey pair of the RAM user from the environment variables.

// Configure access credentials by using the AccessKey pair of the RAM user obtained from the environment variables.
accid = os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")
acckey = os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")

Embed in code

Warning

Embedding access credentials in your code is a significant security risk. Leaked credentials allow an attacker to access your SMQ resources, potentially resulting in financial loss. We strongly recommend using a more secure method, such as environment variables.

accid,acckey,endpoint,token = MNSSampleCommon.LoadConfig() 
my_account = Account(endpoint, accid, acckey, token)

Use temporary access credentials

When you need to temporarily access the SMQ service, you can use Security Token Service (STS) to issue temporary access credentials. Temporary access credentials do not require you to expose your RAM user's AccessKey pair, which makes your access to SMQ more secure.

Create a RAM user.

For more information, see Create a RAM user.
Grant the AliyunSTSAssumeRoleAccess permission to the RAM user.

For more information, see Manage RAM user permissions.
Use the RAM user to call the AssumeRole operation of STS to obtain temporary access credentials.

For more information, see AssumeRole.

Configure the temporary access credentials from STS.