Resource Access Management:Best practices for using an access credential to call API operations

This topic describes how to use an access credential instead of a hard-coded AccessKey pair to call API operations of Alibaba Cloud in various scenarios.

Background information

An AccessKey pair is provided by Alibaba Cloud and used to complete identity authentication when you call API operations. Each AccessKey pair consists of an AccessKey ID and an AccessKey secret. You must keep the AccessKey pair confidential.

If you hard code a plaintext AccessKey pair in your code to call API operations of Alibaba Cloud, the AccessKey pair may be leaked due to improper permission management of the code repository. This may pose threats to the security of all resources that belong to your account. We recommend that you use an access credential to call API operations of Alibaba Cloud to ensure the security of resources that belong to your account.

Solution overview

Assume a RAM role by using an application that is deployed in an ACK cluster

Prerequisites

• An Alibaba Cloud service that works with RAM is used. For more information, see Services that work with RAM.

• RRSA supports only Kubernetes 1.22 and later. The cluster types that support RRSA include ACK standard cluster, ACK Pro cluster, ACK Serverless standard cluster, and ACK Serverless Pro cluster.

• Alibaba Cloud SDK V2.0 is installed.

• The self-developed SDKs of services that use self-managed gateways are not installed.

Working principles

Configuration methods

• Enable the RRAS feature for an ACK cluster. For more information, see Enable RRSA.

• Use the RRAS feature in an ACK cluster. For more information, see Work with RRSA.

Sample code

Some Alibaba Cloud SDKs allow applications to call the APIs of specific cloud services by using the OIDC tokens of RRSA. The following table describes the supported SDK versions.

Assume an instance RAM role

Prerequisites

• An Alibaba Cloud service that supports RAM is used. For more information, see Services that work with RAM.

• Alibaba Cloud SDK V2.0 is installed.

• The self-developed SDKs of services that use self-managed gateways are not installed.

Working principles

You can attach an instance Resource Access Management (RAM) role to an Elastic Compute Service (ECS) instance. Then, the ECS instance can use the Security Token Service (STS) temporary credential of the instance RAM role to access the APIs of other Alibaba Cloud services. The STS temporary credential is updated on a periodic basis. This ensures the security of your AccessKey pair and implements fine-grained access control and permissions management by using RAM.

1. An application accesses ECS instance metadata to obtain a Security Token Service (STS) token. For more information, see Overview of ECS instance metadata.

2. The application uses the STS token to access cloud resources. For more information, see What is STS?

Configuration methods

Attach an instance RAM role to an ECS instance. For more information, see Attach an instance RAM role to an ECS instance.

Sample code

Alibaba Cloud Credentials is a credential management tool provided by Alibaba Cloud for developers. You can use Alibaba Cloud Credentials to attach an instance RAM role to an ECS instance in a convenient manner. The following sample code provides an example on how to call the DescribeRegions operation of ECS.

Configure system environment variables

Configuration methods

Configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables.

• Linux and macOS

  Run the following commands:

  export ALIBABA_CLOUD_ACCESS_KEY_ID=<access_key_id>
  export ALIBABA_CLOUD_ACCESS_KEY_SECRET=<access_key_secret>

  Replace <access_key_id> with your AccessKey ID and <access_key_secret> with your AccessKey secret.

• Windows

  1. Create an environment variable file, add the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to the file, and then specify your AccessKey ID for ALIBABA_CLOUD_ACCESS_KEY_ID and your AccessKey secret for ALIBABA_CLOUD_ACCESS_KEY_SECRET.

  2. Restart the Windows operating system.

Sample code of Alibaba Cloud SDKs

Alibaba Cloud SDKs allow you to configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to create a default credential. When you call an API operation, the system reads the AccessKey pair from the default credential and uses the AccessKey pair to complete authentication. The following sample code provides an example on how to call the DescribeRegions operation of ECS.

Common sample code

For self-developed SDKs of services that use self-managed gateways, the following sample code provides an example on how to load environment variables by using Java:

import com.aliyun.credentials.Client;
import com.aliyun.credentials.models.Config;

public class DemoTest {
    public static void main(String[] args) throws Exception{
        Config config = new Config();
        // Which type of credential you want
        config.setType("access_key");
        // AccessKeyId of your ram user
        config.setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"));
        // AccessKeySecret of your ram user
        config.setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
        Client client = new Client(config);
    }
}

References

For more information about best practices for cloud security, see the following topics:

• Credential security solutions

• Use RAM to ensure the security of the Alibaba Cloud resources of your enterprise

• Use RAM to manage user permissions and resources