Object Storage Service:Authorized access

Usage notes

• In this topic, the public endpoint of the China (Hangzhou) region is used. If you want to access OSS by using other Alibaba Cloud services in the same region as OSS, use an internal endpoint. For more information about the regions and endpoints supported by OSS, see Regions and endpoints.

• In this topic, an OSSClient instance is created by using an OSS endpoint. If you want to create an OSSClient instance by using custom domain names or Security Token Service (STS), see Initialization.

Use STS to authorize temporary access

You can use STS to authorize temporary access to OSS. STS is a web service that provides temporary access tokens for users. You can use STS to grant temporary access credentials that have a custom validity period and custom permissions to a third-party application or a RAM user that is managed by you. For more information about STS, see What is STS?

STS has the following benefits:

• You need to only generate a temporary access token and send the access token to a third-party application. You do not need to provide your AccessKey pair to the third-party application. You can specify the access permissions and the validity period of the token.

• The token automatically expires after the validity period. Therefore, you do not need to manually revoke the access permissions of a token.

To access OSS by using temporary access credentials provided by STS, perform the following operations:

1. Obtain temporary access credentials.

   The temporary access credentials consist of an AccessKey pair and a security token. The AccessKey pair consists of an AccessKey ID and an AccessKey secret. The minimum validity period of temporary access credentials is 900 seconds. The maximum validity period of temporary access credentials is the maximum session duration specified for the current role. For more information, see Specify the maximum session duration for a RAM role.

   You can use one of the following methods to obtain temporary access credentials:

   • Method 1:

     Call the AssumeRole operation to obtain temporary access credentials.

   • Method 2:

     Use STS SDKs to obtain temporary access credentials. For more information, see Overview.

2. Use temporary credentials obtained from STS to create a signed request.

   • Upload an object

     #include "oss_api.h"
     #include "aos_http_io.h"
     /* Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. */
     const char *endpoint = "yourEndpoint";
     /* Before you run the sample code, make sure that the YOUR_ACCESS_KEY_ID and YOUR_ACCESS_KEY_SECRET environment variables are configured by using temporary access credentials obtained from STS. */  
     const char *access_key_id = getenv("OSS_ACCESS_KEY_ID");
     const char *access_key_secret = getenv("OSS_ACCESS_KEY_SECRET");
     /* Specify a security token obtained from STS. */
     const char *sts_token = "yourStsToken";
     /* Specify the name of the bucket. Example: examplebucket. */
     const char *bucket_name = "examplebucket";
     /* Specify the full path of the object. Do not include the bucket name in the full path of the object. Example: exampledir/exampleobject.txt. */
     const char *object_name = "exampledir/exampleobject.txt";
     const char *object_content = "More than just cloud.";
     
     void init_options(oss_request_options_t *options)
     {
         options->config = oss_config_create(options->pool);
         /* Use a char* string to initialize data of the aos_string_t type. */
         aos_str_set(&options->config->endpoint, endpoint);
         aos_str_set(&options->config->access_key_id, access_key_id);
         aos_str_set(&options->config->access_key_secret, access_key_secret);
         aos_str_set(&options->config->sts_token, sts_token);
         /* Specify whether to use CNAME to access OSS. A value of 0 indicates that CNAME is not used. */
         options->config->is_cname = 0;
         /* Configure network parameters, such as the timeout period. */
         options->ctl = aos_http_controller_create(options->pool, 0);
     }
     
     int main(int argc, char *argv[])
     {
         /* Call the aos_http_io_initialize method in main() to initialize global resources, such as network resources and memory resources. */
         if (aos_http_io_initialize(NULL, 0) != AOSE_OK) {
             exit(1);
         }
     
         /* Create a memory pool to manage memory. aos_pool_t is equivalent to apr_pool_t. The code used to create a memory pool is included in the APR library. */
         aos_pool_t *pool;
         /* Recreate a memory pool. The second parameter is NULL, which indicates that the pool does not inherit any other memory pool. */
         aos_pool_create(&pool, NULL);
         /* Create and initialize options. This parameter includes global configuration information, such as endpoint, access_key_id, access_key_secret, is_cname, and curl. */
         oss_request_options_t *oss_client_options;
         /* Allocate the memory resources in the memory pool to the options. */
         oss_client_options = oss_request_options_create(pool);
         /* Initialize oss_client_options. */
         init_options(oss_client_options);
     
         /* Initialize the parameters. */
         aos_string_t bucket;
         aos_string_t object;
         aos_list_t buffer;
         aos_buf_t *content = NULL;
         aos_table_t *headers = NULL;
         aos_table_t *resp_headers = NULL; 
         aos_status_t *resp_status = NULL; 
         /* Assign the char* data to the bucket. */
         aos_str_set(&bucket, bucket_name);
         aos_str_set(&object, object_name);
     
         aos_list_init(&buffer);
         content = aos_buf_pack(oss_client_options->pool, object_content, strlen(object_content));
         aos_list_add_tail(&content->node, &buffer);
     
         /* Upload the object. */
         resp_status = oss_put_object_from_buffer(oss_client_options, &bucket, &object, &buffer, headers, &resp_headers);
         /* Determine whether the object is uploaded. */
         if (aos_status_is_ok(resp_status)) {
             printf("put object from buffer succeeded\n");
         } else {
             printf("put object from buffer failed\n");      
         }    
     
         /* Release the memory pool. This operation releases the memory resources allocated for the request. */
         aos_pool_destroy(pool);
     
         /* Release the allocated global resources. */
         aos_http_io_deinitialize();
     
         return 0;
     }            

   • Download an object

     #include "oss_api.h"
     #include "aos_http_io.h"
     /* Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. */
     const char *endpoint = "yourEndpoint";
     /* Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. */  
     const char *access_key_id = getenv("OSS_ACCESS_KEY_ID");
     const char *access_key_secret = getenv("OSS_ACCESS_KEY_SECRET");
     /* Specify a security token obtained from STS. */
     const char *sts_token = "yourStsToken";
     /* Specify the name of the bucket. Example: examplebucket. */
     const char *bucket_name = "examplebucket";
     /* Specify the full path of the object. Do not include the bucket name in the full path of the object. Example: exampledir/exampleobject.txt. */
     const char *object_name = "exampledir/exampleobject.txt";
     void init_options(oss_request_options_t *options)
     {
         options->config = oss_config_create(options->pool);
         /* Use a char* string to initialize data of the aos_string_t type. */
         aos_str_set(&options->config->endpoint, endpoint);
         aos_str_set(&options->config->access_key_id, access_key_id);
         aos_str_set(&options->config->access_key_secret, access_key_secret);
         aos_str_set(&options->config->sts_token, sts_token);
         /* Specify whether to use CNAME. A value of 0 indicates that CNAME is not used. */
         options->config->is_cname = 0;
         /* Specify network parameters, such as the timeout period. */
         options->ctl = aos_http_controller_create(options->pool, 0);
     }
     int main(int argc, char *argv[])
     {
         /* Call the aos_http_io_initialize method in main() to initialize global resources, such as network resources and memory resources. */
         if (aos_http_io_initialize(NULL, 0) != AOSE_OK) {
             exit(1);
         }
         /* Create a memory pool to manage memory. aos_pool_t is equivalent to apr_pool_t. The code used to create a memory pool is included in the APR library. */
         aos_pool_t *pool;
         /* Create a memory pool. The value of the second parameter is NULL. This value indicates that the pool does not inherit other memory pools. */
         aos_pool_create(&pool, NULL);
         /* Create and initialize options. This parameter includes global configuration information, such as endpoint, access_key_id, access_key_secret, is_cname, and curl. */
         oss_request_options_t *oss_client_options;
         /* Allocate the memory resources in the memory pool to the options. */
         oss_client_options = oss_request_options_create(pool);
         /* Initialize oss_client_options. */
         init_options(oss_client_options);
         /* Initialize the parameters. */
         aos_string_t bucket;
         aos_string_t object;
         aos_list_t buffer;
         aos_buf_t *content = NULL;
         aos_table_t *params = NULL;
         aos_table_t *headers = NULL;
         aos_table_t *resp_headers = NULL; 
         aos_status_t *resp_status = NULL; 
         char *buf = NULL;
         int64_t len = 0;
         int64_t size = 0;
         int64_t pos = 0;
         aos_str_set(&bucket, bucket_name);
         aos_str_set(&object, object_name);
         aos_list_init(&buffer);
         /* Download the object to the local memory. */
         resp_status = oss_get_object_to_buffer(oss_client_options, &bucket, &object, 
                                      headers, params, &buffer, &resp_headers);
         if (aos_status_is_ok(resp_status)) {
             printf("get object to buffer succeeded\n");
             /* Copy the downloaded content to the buffer. */
             len = aos_buf_list_len(&buffer);
             buf = aos_pcalloc(pool, len + 1);
             buf[len] = '\0';
             aos_list_for_each_entry(aos_buf_t, content, &buffer, node) {
             size = aos_buf_size(content);
                 memcpy(buf + pos, content->pos, size);
                 pos += size;
             }
         }
         else {
             printf("get object to buffer failed\n");  
         }
         /* Release the memory pool. This operation releases the memory resources allocated for the request. */
         aos_pool_destroy(pool);
         /* Release the allocated global resources. */
         aos_http_io_deinitialize();
         return 0;
     }

Use a signed URL to authorize temporary access

You can generate a signed URL and provide the URL to a third-party user for temporary access. When you generate a signed URL, you can specify the validity period of the URL to limit the period of time during which the third-party user can access OSS resources.