Access OSS by using STS temporary credentials

Java

import com.aliyun.oss.*;
import com.aliyun.oss.common.auth.CredentialsProvider;
import com.aliyun.oss.common.auth.DefaultCredentialProvider;
import com.aliyun.oss.common.comm.SignVersion;
import com.aliyun.oss.model.PutObjectRequest;
import com.aliyun.oss.model.PutObjectResult;

import java.io.File;

public class Demo {

    public static void main(String[] args) throws Exception {
        // Specify the temporary AccessKey ID, AccessKey secret, and security token that you obtained in Substep 5 of Step 1. Do not use the identity credentials of the RAM user.
        // Note that the AccessKey ID obtained from the STS service starts with "STS".
        String accessKeyId = "yourSTSAccessKeyID";
        String accessKeySecret = "yourSTSAccessKeySecret";
        // Specify the security token that you obtained from STS.
        String stsToken= "yourSecurityToken";

        // Use the DefaultCredentialProvider method to directly set the AccessKey ID and AccessKey secret.
        CredentialsProvider credentialsProvider = new DefaultCredentialProvider(accessKeyId, accessKeySecret, stsToken);
        // Initialize the client by using credentialsProvider.
        ClientBuilderConfiguration clientBuilderConfiguration = new ClientBuilderConfiguration();
        // Explicitly declare that the V4 signature algorithm is used.
        clientBuilderConfiguration.setSignatureVersion(SignVersion.V4);
        // Create an OSSClient instance.
        // When the OSSClient instance is no longer used, call the shutdown method to release resources.
        OSS ossClient = OSSClientBuilder.create()
                 // Set the OSS access domain name. Example for the China (Hangzhou) region: https://oss-cn-hangzhou.aliyuncs.com
                .endpoint("endpoint")
                .credentialsProvider(credentialsProvider)
                .clientConfiguration(clientBuilderConfiguration)
                // Set the region of the destination bucket. Example for the China (Hangzhou) region: cn-hangzhou
                .region("region")
                .build();

        try {

            // Create a PutObjectRequest object to upload the local file exampletest.txt to examplebucket.
            PutObjectRequest putObjectRequest = new PutObjectRequest("examplebucket", "exampletest.txt", new File("D:\\localpath\\exampletest.txt"));

            // If you need to set the storage class and access permissions during the upload, see the following sample code.
            // ObjectMetadata metadata = new ObjectMetadata();
            // metadata.setHeader(OSSHeaders.OSS_STORAGE_CLASS, StorageClass.Standard.toString());
            // metadata.setObjectAcl(CannedAccessControlList.Private);
            // putObjectRequest.setMetadata(metadata);

            // Upload the file.
            PutObjectResult result = ossClient.putObject(putObjectRequest);
        } catch (OSSException oe) {
            System.out.println("Caught an OSSException, which means your request made it to OSS, "
                    + "but was rejected with an error response for some reason.");
            System.out.println("Error Message:" + oe.getErrorMessage());
            System.out.println("Error Code:" + oe.getErrorCode());
            System.out.println("Request ID:" + oe.getRequestId());
            System.out.println("Host ID:" + oe.getHostId());
        } catch (ClientException ce) {
            System.out.println("Caught a ClientException, which means the client encountered "
                    + "a serious internal problem while trying to communicate with OSS, "
                    + "such as not being able to access the network.");
            System.out.println("Error Message:" + ce.getMessage());
        } finally {
            if (ossClient != null) {
                ossClient.shutdown();
            }
        }
    }
}

Python

OSS SDK for Python is available in V2 and V1. V2 is a comprehensive refactoring of V1 that simplifies underlying operations such as identity verification, request retries, and error handling. It also provides more flexible parameter configurations and new advanced interfaces. See the following examples based on your requirements.

import alibabacloud_oss_v2 as oss

def main():
    # Specify the temporary AccessKey ID, AccessKey secret, and security token that you obtained in Substep 5 of Step 1. Do not use the identity credentials of the RAM user.
    # Note that the AccessKey ID obtained from the STS service starts with "STS".
    sts_access_key_id = 'yourSTSAccessKeyID'
    sts_access_key_secret = 'yourSTSAccessKeySecret'
    # Specify the security token that you obtained from STS.
    sts_security_token = 'yourSecurityToken'
    
    # Create a static credential provider and explicitly set the temporary AccessKey ID, AccessKey secret, and security token.
    credentials_provider = oss.credentials.StaticCredentialsProvider(
        access_key_id=sts_access_key_id,
        access_key_secret=sts_access_key_secret,
        security_token=sts_security_token,
    )

    # Load the default configuration of the SDK and set the credential provider.
    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider

    # Specify the region of the bucket. Example for China (Hangzhou): cn-hangzhou.
    cfg.region = 'cn-hangzhou'

    # Create an OSS client by using the configured information.
    client = oss.Client(cfg)

    # The path of the local file to upload. Example: D:\\localpath\\exampletest.txt.
    local_file_path = 'D:\\localpath\\exampletest.txt'
    with open(local_file_path, 'rb') as file:
        data = file.read()

    # Execute the object upload request to upload the local file exampletest.txt to examplebucket. Specify the bucket name, object name, and file to upload.
    result = client.put_object(oss.PutObjectRequest(
        # Bucket name
        bucket='examplebucket',
        # Name of the object to upload to the bucket
        key='exampletest.txt',
        body=data,
    ))

     # Output the request status code, request ID, content MD5, ETag, CRC-64 checksum, and version ID to check whether the request was successful.
    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' content md5: {result.content_md5},'
          f' etag: {result.etag},'
          f' hash crc64: {result.hash_crc64},'
          f' version id: {result.version_id},'
    )


# When this script is run directly, call the main function.
if __name__ == "__main__":
    main()  # The entry point of the script. When the file is run directly, the main function is called.

# -*- coding: utf-8 -*-
import oss2

# yourEndpoint specifies the endpoint of the bucket's region. Example for China (Hangzhou): https://oss-cn-hangzhou.aliyuncs.com.
endpoint = 'https://oss-cn-hangzhou.aliyuncs.com'
# Specify the temporary AccessKey ID and AccessKey secret that you obtained in Substep 5 of Step 1. Do not use the AccessKey ID and AccessKey secret of an Alibaba Cloud account.
sts_access_key_id = 'yourAccessKeyId'
sts_access_key_secret = 'yourAccessKeySecret'
# Specify the bucket name.
bucket_name = 'examplebucket'
# Specify the full path of the object. The full path of the object cannot contain the bucket name. 
object_name = 'examplebt.txt'
# Specify the security token that you obtained in Substep 5 of Step 1.
security_token = 'yourSecurityToken'
# Initialize the StsAuth instance by using the authentication information from the temporary credentials.
auth = oss2.StsAuth(sts_access_key_id,
                    sts_access_key_secret,
                    security_token)
# Initialize the bucket by using the StsAuth instance.
bucket = oss2.Bucket(auth, endpoint, bucket_name)
# Upload the object.
result = bucket.put_object(object_name, "hello world")
print(result.status)

Go

OSS SDK for Go is available in V2 and V1. V2 is a comprehensive refactoring of V1 that simplifies underlying operations such as identity verification, request retries, and error handling. It also provides more flexible parameter configurations and new advanced interfaces. See the following examples based on your requirements.

package main

import (
	"context"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
)

func main() {
	// Specify the region of the bucket. Example for China (Hangzhou): cn-hangzhou.
	region := "cn-hangzhou"

	// Specify the temporary AccessKey ID, AccessKey secret, and security token that you obtained in Substep 5 of Step 1. Do not use the identity credentials of the RAM user.
    // Note that the AccessKey ID obtained from the STS service starts with "STS".
	accessKeyID := "yourSTSAccessKeyID"
	accessKeySecret := "yourSTSAccessKeySecret"
	// Specify the security token that you obtained from STS.
	stsToken := "yourSecurityToken"

	// Use the NewStaticCredentialsProvider method to directly set the AccessKey ID, AccessKey secret, and STS token.
	provider := credentials.NewStaticCredentialsProvider(accessKeyID, accessKeySecret, stsToken)

	// Load the default configuration and set the credential provider and region.
	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(provider).
		WithRegion(region)

	// Create an OSS client.
	client := oss.NewClient(cfg)

	// Specify the path and name of the local file to upload. Example: D:\\localpath\\exampletest.txt.
	localFile := "D:\\localpath\\exampletest.txt"

	// Create a request to upload an object.
	putRequest := &oss.PutObjectRequest{
		Bucket:       oss.Ptr("examplebucket"),      // Bucket name
		Key:          oss.Ptr("exampletest.txt"),    // Name of the object to upload to the bucket
		StorageClass: oss.StorageClassStandard, // Set the storage class of the object to Standard.
		Acl:          oss.ObjectACLPrivate,     // Set the access control list (ACL) of the object to private.
		Metadata: map[string]string{
			"yourMetadataKey1": "yourMetadataValue1", // Set the metadata of the object.
		},
	}

	// Execute the object upload request to upload the local file exampletest.txt to examplebucket.
	result, err := client.PutObjectFromFile(context.TODO(), putRequest, localFile)
	if err != nil {
		log.Fatalf("failed to put object from file %v", err)
	}

	// Print the result of the object upload.
	log.Printf("put object from file result:%#v\n", result)
	
}

package main

import (
    "fmt"
    "github.com/aliyun/aliyun-oss-go-sdk/oss"
    "os"
)

func main() {
    // Obtain the temporary credentials from environment variables that you obtained in Substep 5 of Step 1. Before you run this sample code, make sure that the OSS_ACCESS_KEY_ID, OSS_ACCESS_KEY_SECRET, and OSS_SESSION_TOKEN environment variables are set.
    provider, err := oss.NewEnvironmentVariableCredentialsProvider()
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    // Create an OSSClient instance.
    // yourEndpoint specifies the endpoint of the bucket. Example for China (Hangzhou): https://oss-cn-hangzhou.aliyuncs.com. Specify the endpoint based on your region.
    client, err := oss.New("yourEndpoint", "", "", oss.SetCredentialsProvider(&provider))
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    // Specify the bucket name. Example: examplebucket.
    bucketName := "examplebucket"
    // Specify the full path of the object. The full path cannot contain the bucket name. Example: exampledir/exampleobject.txt.
    objectName := "exampledir/exampleobject.txt"
    // Specify the full path of the local file. Example: D:\\localpath\\examplefile.txt.
    filepath := "D:\\localpath\\examplefile.txt"
    bucket, err := client.Bucket(bucketName)
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    // Authorize a third party to upload a file by using STS.
    err = bucket.PutObjectFromFile(objectName, filepath)
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    fmt.Println("upload success")
}

Node.js

const axios = require("axios");
const OSS = require("ali-oss");

// Use the temporary credentials to initialize the OSS client on the client side for temporary authorized access to OSS resources.
const getToken = async () => {
  // Set the address for the client to request access credentials.
  await axios.get("http://localhost:8000/sts").then((token) => {
    const client = new OSS({
       // yourRegion specifies the region of the bucket. Example for China (Hangzhou): oss-cn-hangzhou.
      region: 'oss-cn-hangzhou',
      // Specify the temporary AccessKey ID and AccessKey secret that you obtained in Substep 5 of Step 1. Do not use the AccessKey ID and AccessKey secret of an Alibaba Cloud account.
      accessKeyId: token.data.AccessKeyId,
      accessKeySecret: token.data.AccessKeySecret,
      // Specify the security token that you obtained in Substep 5 of Step 1.
      stsToken: token.data.SecurityToken,
      authorizationV4: true,
      // Specify the bucket name.
      bucket: "examplebucket",
      // Refresh the temporary credentials.
      refreshSTSToken: async () => {
        const refreshToken = await axios.get("http://localhost:8000/sts");
        return {
          accessKeyId: refreshToken.data.AccessKeyId,
          accessKeySecret: refreshToken.data.AccessKeySecret,
          stsToken: refreshToken.data.SecurityToken,
        };
      },
    });
    // Use the temporary credentials to upload a file.
    // Specify the full path of the object, excluding the bucket name. Example: exampleobject.jpg.
    // Specify the full path of the local file. Example: D:\\example.jpg.
    client.put('exampleobject.jpg', 'D:\\example.jpg').then((res)=>{console.log(res)}).catch(e=>console.log(e))
  });
};
getToken()

PHP

<?php
if (is_file(__DIR__ . 'autoload.php')) {
    require_once __DIR__ . 'autoload.php';
}
if (is_file(__DIR__ . '/vendor/autoload.php')) {
    require_once __DIR__ . '/vendor/autoload.php';
}

use OSS\Credentials\StaticCredentialsProvider;
use OSS\OssClient;
use OSS\Core\OssException;

try {
    // Specify the temporary AccessKey ID, AccessKey secret, and security token that you obtained in Substep 5 of Step 1. Do not use the identity credentials of the RAM user.
    // Note that the AccessKey ID obtained from the STS service starts with "STS".
    $accessKeyId = 'yourSTSAccessKeyID';
    $accessKeySecret = 'yourSTSAccessKeySecret';
    // Specify the security token that you obtained from STS.
    $securityToken = 'yourSecurityToken';

    // Create a credential provider by using the StaticCredentialsProvider class.
    $provider = new StaticCredentialsProvider($accessKeyId, $accessKeySecret, $securityToken);

    // Specify the endpoint of the bucket's region. Example for China (Hangzhou): https://oss-cn-hangzhou.aliyuncs.com.
    $endpoint = "https://oss-cn-hangzhou.aliyuncs.com";

    // Specify the bucket name. Example: examplebucket.
    $bucket= "examplebucket";
    // Specify the name of the object to upload to the bucket.
    $object = "exampletest.txt";
    // Specify the path of the local file to upload. Example: D:\\localpath\\exampletest.txt.
    $localFilePath = "D:\\localpath\\exampletest.txt";

    // You can set relevant headers during the upload, such as setting the access permission to private and specifying custom metadata.
    $options = array(
        OssClient::OSS_HEADERS => array(
            'x-oss-object-acl' => 'private',
            'x-oss-meta-info' => 'yourinfo'
        ),
    );

    $config = array(
        "provider" => $provider,
        "endpoint" => $endpoint,
        "signatureVersion" => OssClient::OSS_SIGNATURE_VERSION_V4,
        // Specify the region of the bucket. Example for China (Hangzhou): cn-hangzhou.
        "region" => "cn-hangzhou"
    );
    
    // Create an OSS client by using the configured information.
    $ossClient = new OssClient($config);
    
     // Send the request to upload the local file exampletest.txt to examplebucket.
    $ossClient->putObject($bucket, $object, $localFilePath, $options);
} catch (OssException $e) {
    printf($e->getMessage() . "\n");
    return;
}

Ruby

require 'aliyun/sts'
require 'aliyun/oss'

client = Aliyun::OSS::Client.new(
  # The endpoint of the China (Hangzhou) region is used in this example. Specify the endpoint based on your region.
  endpoint: 'https://oss-cn-hangzhou.aliyuncs.com',
  # Specify the temporary AccessKey ID and AccessKey secret that you obtained in Substep 5 of Step 1. Do not use the AccessKey ID and AccessKey secret of an Alibaba Cloud account.
  access_key_id: 'token.access_key_id',
  access_key_secret: 'token.access_key_secret',
  # Specify the security token that you obtained in Substep 5 of Step 1.
  sts_token: 'token.security_token'
  )
# Specify the bucket name. Example: examplebucket.
bucket = client.get_bucket('examplebucket')
# Upload the file.
bucket.put_object('exampleobject.txt', :file => 'D:\test.txt')