Tablestore:Configure access credentials

Access credential types

• Temporary access credentials: We recommend that you use temporary access credentials in scenarios that require high security. Temporary access credentials are valid only within a specific period of time, which helps prevent credential leaks. Temporary access credentials support fine-grained access control, which prevents security risks caused by excessive permissions.

• Long-term access credentials: To ensure security, we recommend that you do not use long-term access credentials. In scenarios where convenience is essential, long-term access credentials eliminate the need for multiple refreshes within a long period of time.

  Important

  • We recommend that you change your long-term access credentials every three months to ensure account security.

  • If long-term access credentials are leaked or no longer used, you must delete or disable the long-term access credentials at the earliest opportunity to reduce security risks.

Configure temporary access credentials

If you want to use Tablestore SDK for Go to temporarily access Tablestore, you can use Security Token Service (STS) to generate temporary access credentials. When you use temporary access credentials, you do not need to disclose the AccessKey pair of your Resource Access Management (RAM) user. This ensures secure access to Tablestore.

1. Create a RAM user. For more information, see Create a RAM user.

2. Attach the AliyunSTSAssumeRoleAccess policy to the RAM user. For more information, see Grant the RAM user the AssumeRole permission.

3. Create a RAM role and attach custom policies to the RAM role. For more information, see Create a RAM role and Grant the RAM role the permissions to access Tablestore.

4. Call the AssumeRole operation as the RAM user to obtain temporary access credentials. For more information, see Assume the RAM role as the RAM user to obtain temporary access credentials from STS.

5. Configure STS temporary access credentials.

   Environment variables

   1. Configure environment variables for temporary access credentials.

      Mac OS X/Linux/Unix

      # Specify the temporary AccessKey ID obtained from STS.
      export TABLESTORE_ACCESS_KEY_ID=your_sts_access_key_id
      # Specify the temporary AccessKey secret obtained from STS.
      export TABLESTORE_ACCESS_KEY_SECRET=your_sts_access_key_secret
      # Specify the security token obtained from STS.
      export TABLESTORE_SESSION_TOKEN=your_sts_token

      Windows

      Run the command prompt as an administrator and run the following commands:

      # Specify the temporary AccessKey ID obtained from STS.
      setx TABLESTORE_ACCESS_KEY_ID your_sts_access_key_id /m
      # Specify the temporary AccessKey secret obtained from STS.
      setx TABLESTORE_ACCESS_KEY_SECRET your_sts_access_key_secret /m
      # Specify the security token obtained from STS.
      setx TABLESTORE_SESSION_TOKEN your_sts_token /m

      Note

      After you configure the environment variables, you may need to restart the relevant services or development tools such as Integrated Development Environment (IDE) to ensure that the new settings are applied as expected.

   2. Pass credential information by using environment variables.

      accessKeyId := os.Getenv("TABLESTORE_ACCESS_KEY_ID")
      accessKeySecret := os.Getenv("TABLESTORE_ACCESS_KEY_SECRET")
      securityToken := os.Getenv("TABLESTORE_SESSION_TOKEN")

   Static credentials

   You can define access credentials by using variables in your code. During the code execution, these variables are populated with actual credential values obtained from environment variables, configuration files, or other external data sources.

   The following procedure describes how to use a configuration file to pass credentials.

   1. Create a configuration file named config.ini.

      [credentials]
      TABLESTORE_ACCESS_KEY_ID = your_sts_access_key_id
      TABLESTORE_ACCESS_KEY_SECRET = your_sts_access_key_secret
      TABLESTORE_SESSION_TOKEN = your_sts_token

   2. Use the configuration file to pass credentials.

      // Read the configuration file.
      config, err := ini.Load("config.ini")
      if err != nil {
          fmt.Println("Failed to read the configuration file:", err)
      }
      
      // Obtain the AccessKey ID and AccessKey secret from the configuration file.
      access_key_id := config.Section("credentials").Key("TABLESTORE_ACCESS_KEY_ID").String()
      access_key_secret := config.Section("credentials").Key("TABLESTORE_ACCESS_KEY_SECRET").String()
      security_token := config.Section("credentials").Key("TABLESTORE_SESSION_TOKEN").String()

Configure long-term access credentials

If your application is deployed in a secure and stable environment that is not vulnerable to external attacks and requires long-term access to Tablestore by using Tablestore SDK for Go, you can use an AccessKey pair of your Alibaba Cloud account or a RAM user. For information about how to obtain an AccessKey pair, see Use the AccessKey pair of a RAM user to access Tablestore.