Object Storage Service:Set up a direct upload service for mobile applications

1. Create a RAM user

First, create a RAM user and get its AccessKey pair. This pair serves as the long-term identity credential for your application server.

1. Log on to the RAM console by using your Alibaba Cloud account or as an account administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. Click Create User.

4. Enter a Logon Name and a Display Name.

5. In the Access Mode section, select OpenAPI Access, and then click OK.

6. In the Actions column, click Copy to save the AccessKey pair (AccessKey ID and AccessKey secret).

2. Grant the RAM user AssumeRole permissions

After creating the RAM user, you must grant it permission to call the STS AssumeRole operation. This lets the user assume a RAM role to obtain temporary access credentials.

1. In the left-side navigation pane, choose Identities > Users.

2. On the Users page, find the target RAM user, and then click Add Permissions in the Actions column.

3. On the Grant Permission page, select the AliyunSTSAssumeRoleAccess system policy.

   Note

   The AliyunSTSAssumeRoleAccess policy grants the RAM user permission to call the STS AssumeRole operation. This permission is separate from the permissions required to obtain the temporary access credentials or to use those credentials to make OSS requests.

4. Click OK.

3. Create a RAM role

Create a RAM role for the current Alibaba Cloud account and obtain the corresponding ARN of the role (Alibaba Cloud Resource Name) for a RAM user to assume.

1. In the left-side navigation pane, choose Identities > Roles.

2. Click Create Role and select Cloud Account as the trusted entity type.

3. Select the current Alibaba Cloud account and click OK.

4. Enter a role name and click OK.

5. On the Roles page, find the role that you created and click its name. On the role details page, click Copy next to the ARN to save the role's ARN.

4. Create a policy for file uploads

Following the principle of least privilege, create a custom policy for the RAM role that restricts uploads to a specific OSS bucket.

1. In the left-side navigation pane, choose Permissions > Policies.

2. Click Create Policy.

3. On the Create Policy page, click the JSON Editor tab. In the policy editor, replace with the name of the bucket that you created, for example, web-direct-upload.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "oss:PutObject",
         "Resource": "acs:oss:*:*:<your-bucket-name>/*"
       }
     ]
   }

4. After configuring the policy, click Next to edit policy information.

5. In the Basic Information section, enter a name for the policy, and then click OK.

5. Grant permissions to the RAM role

Grant the custom policy to the RAM role. This ensures that when the role is assumed, it has the necessary permissions.

1. In the left-side navigation pane, choose Identities > RAM Role.

2. On the RAM Role page, find the target RAM role, and then click Grant Permission in the Actions column.

3. On the Grant Permission page, select Custom Policy and choose the custom policy you created.

4. Click OK.

6. Create an ECS instance as the application server

Create an ECS instance to serve as your application server for generating temporary credentials.

For more information, see Create an ECS instance.

7. Obtain temporary credentials on the application server

Integrate the STS SDK into your web application to create an API endpoint that provides temporary access credentials. When the mobile app makes an HTTP GET request to this endpoint (for example, /get_sts_token), the server generates and returns temporary access credentials.