Object Storage Service:Set up direct data transfer for mobile applications

1.1 Create a RAM user

Create a RAM user and generate an AccessKey pair for it. The app server uses this pair to call STS.

1. Log on to the RAM console using your Alibaba Cloud account or as an account administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. Click Create User.

4. Set Logon Name and Display Name.

5. Under Access Mode, select Using permanent AccessKey to access, then click OK.

   Important

   The AccessKey secret is shown only once, at creation. Copy and store it securely before closing the page.

6. Click Copy in the Actions column to save the AccessKey pair.

1.2 Grant the RAM user permission to call AssumeRole

1. In the left-side navigation pane, choose Identities > Users.

2. Find the RAM user and click Add Permissions in the Actions column.

3. In the Grant Permission panel, select the AliyunSTSAssumeRoleAccess system policy.

   AliyunSTSAssumeRoleAccess grants the user permission to call AssumeRole. It is independent of the permissions that the resulting token will carry—those come from the RAM role.

4. Click Grant permissions.

1.3 Create a RAM role

Create a RAM role for the Alibaba Cloud account. The app server assumes this role to obtain scoped tokens for OSS upload.

1. In the left-side navigation pane, choose Identities > Roles.

2. Click Create Role. Set Select Trusted Entity to Alibaba Cloud Account, then click Next.

3. In the Configure Role step, enter a name in the RAM Role Name field (for example, oss-web-upload). Set Select Trusted Alibaba Cloud Account to Current Alibaba Cloud Account.

4. Click OK, then click Close.

5. On the Roles page, search for the role by name and click it.

6. In the Basic Information section, click Copy next to the ARN field to record the Alibaba Cloud Resource Name (ARN) of the role.

1.4 Create an upload policy

Create a custom policy that grants the RAM role write access to a specific bucket only.

1. In the left-side navigation pane, choose Permissions > Policies.

2. Click Create Policy.

3. On the Create Policy page, click JSON. Paste the following policy, replacing <BucketName> with your bucket name (for example, web-direct-upload):

      {
        "Version": "1",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": "oss:PutObject",
            "Resource": "acs:oss:*:*:<BucketName>/*"
          }
        ]
      }

   The policy permits PutObject on all objects in the specified bucket. It does not grant read, delete, or bucket-level permissions.

4. Click Next to edit policy information.

5. In the Basic Information section, enter a policy name, then click OK.

1.5 Attach the policy to the RAM role

1. In the left-side navigation pane, choose Identities > Roles.

2. Find the RAM role and click Grant Permission in the Actions column.

3. In the Grant Permission panel, select Custom Policy from the drop-down list and select the policy you created.

4. Click OK.

1.6 Create an ECS instance (for this tutorial)

For this tutorial, use an ECS instance as the app server. In production, integrate the STS calls into your existing backend instead.

For setup instructions, see Create an ECS instance.

1.7 Deploy the token endpoint

Deploy a Flask app on the ECS instance that exposes /get_sts_token. The mobile app calls this endpoint to get temporary credentials.

1. Connect to the ECS instance.

2. Install Python 3.

3. Create a project directory:

      mkdir my_web_sample
      cd my_web_sample

4. Install dependencies:

      pip3 install Flask
      pip3 install attr
      pip3 install yarl
      pip3 install async_timeout
      pip3 install idna_ssl
      pip3 install attrs
      pip3 install aiosignal
      pip3 install charset_normalizer
      pip3 install alibabacloud_tea_openapi
      pip3 install alibabacloud_sts20150401
      pip3 install alibabacloud_credentials

5. Create main.py with the following content:

      import json
      from flask import Flask, render_template
      from alibabacloud_tea_openapi.models import Config
      from alibabacloud_sts20150401.client import Client as Sts20150401Client
      from alibabacloud_sts20150401 import models as sts_20150401_models
      from alibabacloud_credentials.client import Client as CredentialClient
   
      app = Flask(__name__)
   
      # Replace <YOUR_ROLE_ARN> with the ARN you copied in step 1.3.
      role_arn_for_oss_upload = '<YOUR_ROLE_ARN>'
      # Set to the STS region. Example: cn-hangzhou
      region_id = 'cn-hangzhou'
   
      @app.route("/")
      def hello_world():
          return render_template('index.html')
   
      @app.route('/get_sts_token', methods=['GET'])
      def get_sts_token():
          # CredentialClient with no arguments uses the default credential chain:
          # - On a local machine: reads ALIBABA_CLOUD_ACCESS_KEY_ID and
          #   ALIBABA_CLOUD_ACCESS_KEY_SECRET from environment variables.
          # - On ECS or Elastic Container Instance: uses the instance RAM role via
          #   ALIBABA_CLOUD_ECS_METADATA; the SDK fetches credentials from STS
          #   automatically.
          config = Config(region_id=region_id, credential=CredentialClient())
          sts_client = Sts20150401Client(config=config)
          assume_role_request = sts_20150401_models.AssumeRoleRequest(
              role_arn=role_arn_for_oss_upload,
              # Replace <YOUR_ROLE_SESSION_NAME> with a name for this session.
              role_session_name='<YOUR_ROLE_SESSION_NAME>'
          )
          response = sts_client.assume_role(assume_role_request)
          token = json.dumps(response.body.credentials.to_map())
          return token
   
      # To listen on all interfaces (e.g., 0.0.0.0), add authentication first.
      app.run(host="127.0.0.1", port=8000)

6. Replace <YOUR_ROLE_ARN> with the ARN from step 1.3 and <YOUR_ROLE_SESSION_NAME> with a session identifier.

7. Start the app using the RAM user AccessKey pair from step 1.1:

      ALIBABA_CLOUD_ACCESS_KEY_ID=<YOUR_AK_ID> ALIBABA_CLOUD_ACCESS_KEY_SECRET=<YOUR_AK_SECRET> python3 main.py

8. Verify the endpoint by opening http://<ECS-public-IP-address>/get_sts_token in a browser. A successful response returns a JSON object containing AccessKeyId, AccessKeySecret, SecurityToken, and Expiration.

9. Press Ctrl+C to stop the app.