Object Storage Service:Configure access credentials for OSS SDK for Go

Use RAMRoleARN

If your application needs to be authorized to access OSS, such as when accessing the OSS resources of another Alibaba Cloud account, you can use RAMRoleARN to initialize a credential provider. The underlying logic of this method is to use an STS token. The Credentials tool obtains an STS token based on the ARN of the RAM role and refreshes the STS token by calling the AssumeRole operation before the session expires. Additionally, you can restrict the RAM role to a smaller set of permissions by assigning a value to the policy.

1. Add the credentials dependency.

   go get github.com/aliyun/credentials-go/credentials

2. Configure access credentials.

   package main
   
   import (
   	"context"
   	"log"
   	"os"
   
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
   	openapicred "github.com/aliyun/credentials-go/credentials"
   )
   
   func main() {
   	// Specify the ID of the region in which the bucket is located based on your business requirements. For example, if the bucket is located in the China (Hangzhou) region, set the region ID to cn-hangzhou
   	region := "cn-hangzhou"
   
   	config := new(openapicred.Config).
   		// Set the credential type to ram_role_arn
   		SetType("ram_role_arn").
   		// Obtain the AccessKey ID and AccessKey secret of the RAM user from the environment variables
   		SetAccessKeyId(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")).
   		SetAccessKeySecret(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")).
   		// By default, the values of the parameters are directly entered for the following operations. You can also add environment variables and use os.Getenv("<variable name>") to specify the corresponding parameters
   		// Obtain the ARN of the RAM role from the environment variables. The ARN is the ID of the role. Format: acs:ram::$accountID:role/$roleName
   		SetRoleArn("ALIBABA_CLOUD_ROLE_ARN"). // By default, the canonical name of the RoleArn environment variable is ALIBABA_CLOUD_ROLE_ARN
   		// Specify a custom session name for the role to distinguish different tokens
   		SetRoleSessionName("ALIBABA_CLOUD_ROLE_SESSION_NAME"). // By default, the canonical name of the RoleSessionName environment variable is ALIBABA_CLOUD_ROLE_SESSION_NAME
   		// Optional. Specify the permissions of the security token
   		SetPolicy("Policy").
   		// Optional. Specify the validity period of the security token
   		SetRoleSessionExpiration(3600)
   
   	arnCredential, gerr := openapicred.NewCredential(config)
   	provider := credentials.CredentialsProviderFunc(func(ctx context.Context) (credentials.Credentials, error) {
   		if gerr != nil {
   			return credentials.Credentials{}, gerr
   		}
   		cred, err := arnCredential.GetCredential()
   		if err != nil {
   			return credentials.Credentials{}, err
   		}
   		return credentials.Credentials{
   			AccessKeyID:     *cred.AccessKeyId,
   			AccessKeySecret: *cred.AccessKeySecret,
   			SecurityToken:   *cred.SecurityToken,
   		}, nil
   	})
   
   	// Load the default configurations and specify the credential provider and region
   	cfg := oss.LoadDefaultConfig().
   		WithCredentialsProvider(provider).
   		WithRegion(region)
   
   	// Create an OSS client
   	client := oss.NewClient(cfg)
   	log.Printf("ossclient: %v", client)
   }
   

Use ECSRAMRole

If your application is running on an ECS instance, ECI instance, or a Worker node of Container Service for Kubernetes, it is advisable to use an ECS RAM role to initialize the credentials provider. This approach utilizes an STS token and allows the association of a role with an ECS instance, ECI instance, or Worker node of Container Service for Kubernetes for automatic STS token refresh within the instance. By using this method, there is no need to supply an AccessKey pair or STS token, thus reducing the risks of manual credential management. For information on obtaining an ECS RAM role, see CreateRole - 创建角色.

1. Add the credentials dependency.

   go get github.com/aliyun/credentials-go/credentials

2. Configure access credentials.

   package main
   
   import (
   	"context"
   	"log"
   
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
   	openapicred "github.com/aliyun/credentials-go/credentials"
   )
   
   func main() {
   	// Specify the ID of the region in which the bucket is located based on your business requirements. For example, if the bucket is located in the China (Hangzhou) region, set the region ID to cn-hangzhou
   	region := "cn-hangzhou"
   
   	config := new(openapicred.Config).
   		// Set the credential type to ecs_ram_role
   		SetType("ecs_ram_role").
   		// Optional. Specify the role name. If you do not specify the role name, OSS automatically generates a role name. We recommend that you specify a role name to reduce the number of requests
   		SetRoleName("RoleName")
   
   	arnCredential, gerr := openapicred.NewCredential(config)
   	provider := credentials.CredentialsProviderFunc(func(ctx context.Context) (credentials.Credentials, error) {
   		if gerr != nil {
   			return credentials.Credentials{}, gerr
   		}
   		cred, err := arnCredential.GetCredential()
   		if err != nil {
   			return credentials.Credentials{}, err
   		}
   		return credentials.Credentials{
   			AccessKeyID:     *cred.AccessKeyId,
   			AccessKeySecret: *cred.AccessKeySecret,
   			SecurityToken:   *cred.SecurityToken,
   		}, nil
   	})
   
   	// Load the default configurations and specify the credential provider and region
   	cfg := oss.LoadDefaultConfig().
   		WithCredentialsProvider(provider).
   		WithRegion(region)
   
   	// Create an OSS client
   	client := oss.NewClient(cfg)
   	log.Printf("ossclient: %v", client)
   }
   

Use OIDCRoleARN

After setting the RAM role for worker nodes in Container Service for Kubernetes, applications within pods on these nodes can retrieve the STS token of the attached role via the metadata server, similar to applications on ECS. However, you may want to prevent untrusted applications, such as those submitted by customers who do not share their application code, from accessing the metadata server to retrieve the STS token of the RAM role attached to the worker node. To protect cloud resources, enable untrusted applications to securely obtain the necessary security token, and limit application-level permissions, you can utilize the RAM Roles for Service Account (RRSA) feature. This method relies on an STS token, where ACK generates and mounts OpenID Connect (OIDC) token files for different application pods and conveys relevant configuration details through environment variables. The Credentials tool retrieves this configuration from the environment variables and invokes the AssumeRoleWithOIDC operation of STS to retrieve the STS token for attached roles, thereby mitigating the risks associated with manually managing an AccessKey pair or an STS token. For more information, see Isolate pod permissions by configuring RAM permissions for ServiceAccount through RRSA.

1. Add the credentials dependency.

   go get github.com/aliyun/credentials-go/credentials

2. Configure access credentials.

   package main
   
   import (
   	"context"
   	"log"
   
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
   	openapicred "github.com/aliyun/credentials-go/credentials"
   )
   
   func main() {
   	// Specify the ID of the region in which the bucket is located based on your business requirements. For example, if the bucket is located in the China (Hangzhou) region, set the region ID to cn-hangzhou
   	region := "cn-hangzhou"
   
   	config := new(openapicred.Config).
   		// Set the credential type to oidc_role_arn
   		SetType("oidc_role_arn").
   		// Specify the ARN of the OIDC IdP. The ARN is in the acs:ram::account-id:oidc-provider/provider-name format
   		SetOIDCProviderArn("OIDCProviderArn").
   		// Specify the path of the file in which the OIDC token is stored
   		SetOIDCTokenFilePath("OIDCTokenFilePath").
   		// Specify a custom session name for the role to distinguish different tokens
   		SetRoleSessionName("RoleSessionName"). // By default, the canonical name of the RoleSessionName environment variable is ALIBABA_CLOUD_ROLE_SESSION_NAME
   		// Optional. Specify the policy of the RAM role
   		SetPolicy("Policy").
   		// Specify the ARN of the RAM role, which is the ID of the role to be assumed. Format: acs:ram::113511544585****:oidc-provider/TestOidcProvider
   		SetRoleArn("RoleArn").
   		// Specify the validity period of the session
   		SetSessionExpiration(3600)
   
   	arnCredential, gerr := openapicred.NewCredential(config)
   	provider := credentials.CredentialsProviderFunc(func(ctx context.Context) (credentials.Credentials, error) {
   		if gerr != nil {
   			return credentials.Credentials{}, gerr
   		}
   		cred, err := arnCredential.GetCredential()
   		if err != nil {
   			return credentials.Credentials{}, err
   		}
   		return credentials.Credentials{
   			AccessKeyID:     *cred.AccessKeyId,
   			AccessKeySecret: *cred.AccessKeySecret,
   			SecurityToken:   *cred.SecurityToken,
   		}, nil
   	})
   
   	// Load the default configurations and specify the credential provider and region
   	cfg := oss.LoadDefaultConfig().
   		WithCredentialsProvider(provider).
   		WithRegion(region)
   
   	// Create an OSS client
   	client := oss.NewClient(cfg)
   	log.Printf("ossclient: %v", client)
   }
   

Use a custom credential provider

If the preceding credential configuration methods do not meet your requirements, you can specify the method that you want to use to obtain credentials. The following methods are supported:

1. Use the credentials.CredentialsProviderFunc method

   package main
   
   import (
   	"context"
   	"log"
   
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
   )
   
   func main() {
   	// Specify the ID of the region in which the bucket is located based on your business requirements. For example, if the bucket is located in the China (Hangzhou) region, set the region ID to cn-hangzhou
   	region := "cn-hangzhou"
   
   	// Create a credential provider
   	provider := credentials.CredentialsProviderFunc(func(ctx context.Context) (credentials.Credentials, error) {
   		// Return long-term credentials
   		return credentials.Credentials{AccessKeyID: "id", AccessKeySecret: "secret"}, nil
   		// Return temporary credentials
   		//return credentials.Credentials{AccessKeyID: "id", AccessKeySecret: "secret",    SecurityToken: "token"}, nil
   	})
   
   	// Load the default configurations and specify the credential provider and region
   	cfg := oss.LoadDefaultConfig().
   		WithCredentialsProvider(provider).
   		WithRegion(region)
   
   	// Create an OSS client
   	client := oss.NewClient(cfg)
   	log.Printf("ossclient: %v", client)
   }
   

2. Use the credentials.CredentialsProvider method

   package main
   
   import (
   	"context"
   	"log"
   
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
   )
   
   type CustomerCredentialsProvider struct {
   	// TODO
   }
   
   func NewCustomerCredentialsProvider() CustomerCredentialsProvider {
   	return CustomerCredentialsProvider{}
   }
   
   func (s CustomerCredentialsProvider) GetCredentials(_ context.Context) (credentials.Credentials, error) {
   	// Return long-term credentials
   	return credentials.Credentials{AccessKeyID: "id", AccessKeySecret: "secret"}, nil
   	// Return temporary credentials
   	//return credentials.Credentials{AccessKeyID: "id", AccessKeySecret: "secret",    SecurityToken: "token"}, nil
   }
   
   func main() {
   	// Specify the ID of the region in which the bucket is located based on your business requirements. For example, if the bucket is located in the China (Hangzhou) region, set the region ID to cn-hangzhou
   	region := "cn-hangzhou"
   
   	// Create a credential provider
   	provider := NewCustomerCredentialsProvider()
   
   	// Load the default configurations and specify the credential provider and region
   	cfg := oss.LoadDefaultConfig().
   		WithCredentialsProvider(provider).
   		WithRegion(region)
   
   	// Create an OSS client
   	client := oss.NewClient(cfg)
   	log.Printf("ossclient: %v", client)
   }
   

Use the default credential chain

If you do not specify a method to initialize a Credentials client, the default credential provider chain is used. For more information about the logic for reading default credentials, see Default credential chain.

package main

import (
	"context"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	osscred "github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
	"github.com/aliyun/credentials-go/credentials"
)

func main() {
	// Specify the ID of the region in which the bucket is located based on your business requirements. For example, if the bucket is located in the China (Hangzhou) region, set the region ID to cn-hangzhou
	region := "cn-hangzhou"
	// If you set the parameter to nil, the default credential provider chain is used and the credentials are automatically obtained
	arnCredential, gerr := credentials.NewCredential(nil)
	provider := osscred.CredentialsProviderFunc(func(ctx context.Context) (osscred.Credentials, error) {
		if gerr != nil {
			return osscred.Credentials{}, gerr
		}
		cred, err := arnCredential.GetCredential()
		if err != nil {
			return osscred.Credentials{}, err
		}

		return osscred.Credentials{
			AccessKeyID:     *cred.AccessKeyId,
			AccessKeySecret: *cred.AccessKeySecret,
			SecurityToken:   *cred.SecurityToken,
		}, nil
	})

	// Load the default configurations and specify the credential provider and region
	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(provider).
		WithRegion(region)

	// Create an OSS client
	client := oss.NewClient(cfg)
	log.Printf("ossclient: %v", client)
}