Object Storage Service:Set up direct data transfer for mobile apps

Quick deployment

You can use Resource Orchestration Service (ROS) to activate STS, configure an Elastic Compute Service (ECS) instance, and deploy application server source code on the ECS instance. To use ROS to activate STS and configure an application server, perform the following steps:

1. Go to the Create Stack wizard in the ROS console.

2. In the Select Template step of the Create Stack wizard in the ROS console, enter a stack name and the name of an OSS bucket that you want to create. Specify the zone, instance type, system disk category, and password for the ECS instance that you want to purchase, and then click Create.

   On the Stack Information tab of the page that appears, the status of the stack is Creating.

3. After the status of the stack becomes Created, click the Outputs tab to view the resources, such as the ECS instance and OSS bucket, that are deployed with a few clicks.

Manual deployment

1. Log on to the OSS console.

2. In the left-side navigation pane, click Overview.

3. In the Common Features section, choose Security Token (Authorization for RAM Users) > Go to RAM Console.

   

4. On the STS Quick Configuration page, click Start. Follow the on-screen instructions to complete the authorization.

   After the authorization is complete, save the AccessKey ID, AccessKey secret, and RoleArn parameters of the RAM user.

5. Download and decompress the application server code package.

   PHP

   sts-server.zip

   Java

   AppTokenServerDemo.zip

   Ruby

   sts-app-server-master.zip

   Node.js

   sts-app-server-node.zip

   Go

   test_token_server.zip

6. Modify the configuration file named config.json.

   The following sample code provides an example on how to modify the configuration file:

   {
   "AccessKeyID" : "",
   "AccessKeySecret" : "",
   "RoleArn" : "",
   "TokenExpireTime" : "900",
   "PolicyFile": "policy/bucket_write_policy.txt"
   }

   The following table describes the parameters in the preceding code.

   Parameter	Description
   AccessKeyID	The obtained AccessKey ID.
   AccessKeySecret	The obtained AccessKey secret.
   RoleArn	The obtained RoleArn.
   TokenExpireTime	The validity period of the token obtained by using the Android or iOS app. The default value 900 is the minimum value. Unit: seconds.
   PolicyFile	The file that lists the permissions of the token. The default value can be retained. In the policy directory, the following token files are most commonly used: bucket_read_policy.txt: specifies that the token has the permissions to read data from a specific bucket and objects whose names contain a specific prefix in the current account. bucket_write_policy.txt: specifies that the token has the permissions to write data to a specific bucket and objects whose names contain a specific prefix in the current account. To use the token file, replace $BUCKET_NAME and $OBJECT_PREFIX with specific values. For more information, see the examples and implementation of policies in Overview. Warning Follow the principle of least privilege (PoLP) based on your business requirements. If you specify all resources (resource:*) or all actions (action:*), security risks such as data leaks may arise because of excess permissions. The sample code is only for reference. The online system must implement permission isolation for different users or devices. This way, tokens that are used to grant different permissions are generated.

7. Run the sample code.

   PHP

   1. Run the following command to generate a token:

      php sts.php

   2. Deploy the app to the specified application server address.

   Java

   Note

   Java dependency 1.7 is required.

   1. Run the following command to start the service:

      java -jar app-token-server.jar (port)

      If you do not specify a port, the program starts listening on port 7080. You can specify a port used for listening, but you cannot specify a port that already exists.

   2. Call the AssumeRole operation to obtain the response.

      The response contains the following information:

      // A successful sample response. 
      {
          // The HTTP status code that is returned when the app obtains the token. If the token is obtained, the app returns the HTTP status code 200. 
          "StatusCode":200,
          // The AccessKey ID that can be used by the Android or iOS app to initialize an OSSClient instance. 
          "AccessKeyId":"STS.3p***dgagdasdg",
          // The AccessKey secret that can be used by the Android or iOS app to initialize an OSSClient instance. 
          "AccessKeySecret":"rpnwO9***tGdrddgsR2YrTtI",
          // The token that can be used by the Android or iOS app to initialize an OSSClient instance. 
          "SecurityToken":"CAES+wMIARKAAZhjH0EUOIhJMQBMjRywXq7MQ/cjLYg80Aho1ek0Jm63XMhr9Oc5s˙∂˙∂3qaPer8p1YaX1NTDiCFZWFkvlHf1pQhuxfKBc+mRR9KAbHUefqH+rdjZqjTF7p2m1wJXP8S6k+G2MpHrUe6TYBkJ43GhhTVFMuM3BZajY3VjZWOXBIODRIR1FKZjIiEjMzMzE0MjY0NzM5MTE4NjkxMSoLY2xpZGSSDgSDGAGESGTETqOio6c2RrLWRlbW8vKgoUYWNzOm9zczoqOio6c2RrLWRlbW9KEDExNDg5MzAxMDcyNDY4MThSBTI2ODQyWg9Bc3N1bWVkUm9sZVVzZXJgAGoSMzMzMTQyNjQ3MzkxMTg2OTExcglzZGstZGVt****",
          // The expiration time of the token. OSS SDK for Android checks whether the token is valid. If the token becomes invalid, a new token is automatically obtained. 
          "Expiration":"2017-12-12T07:49:09Z"
      }
      // A failed sample response. 
      {
          // The HTTP status code that is returned when the app obtains the token. If the token fails to be obtained, the HTTP status code 500 is returned. 
          "StatusCode":500,
          // The cause of the error. 
          "ErrorCode":"InvalidAccessKeyId.NotFound",
          // The error message. 
          "ErrorMessage":"Specified access key is not found."
      }