Tablestore:Configure access credentials

Access credential types

• Temporary access credentials: We recommend that you use temporary access credentials in scenarios that require high security. Temporary access credentials are valid only within a specific period of time, which helps prevent credential leaks. Temporary access credentials support fine-grained access control, which prevents security risks caused by excessive permissions.

• Long-term access credentials: To ensure security, we recommend that you do not use long-term access credentials. In scenarios where convenience is essential, long-term access credentials eliminate the need for multiple refreshes within a long period of time.

  Important

  • We recommend that you change your long-term access credentials every three months to ensure account security.

  • If long-term access credentials are leaked or no longer used, you must delete or disable the long-term access credentials at the earliest opportunity to reduce security risks.

Temporary access credentials

To temporarily access Tablestore by using Tablestore SDK for Node.js, you must obtain temporary access credentials from Security Token Service (STS). If you access Tablestore by using temporary access credentials, the AccessKey pair of your RAM user is not leaked, which ensures the access security.

1. Create a RAM user. For information about how to create a RAM user, see Create a RAM user.

2. Attach the AliyunSTSAssumeRoleAccess policy to the RAM user. For more information, see Grant the RAM user the permissions to call the AssumeRole operation.

3. Create a RAM role and attach a custom policy to the RAM role. For more information, see Create a RAM role and Grant Tablestore read-only access to the RAM role.

4. Use the RAM user to call the AssumeRole operation to obtain temporary access credentials. For more information, see Use the RAM user to assume the RAM role to obtain temporary access credentials.

5. Configure environment variables for the temporary access credentials.

   1. Use the temporary access credentials to specify environment variables.

      Mac OS X/Linux/Unix

      # Specify the temporary AccessKey ID obtained from STS.
      export TABLESTORE_ACCESS_KEY_ID=your_sts_access_key_id
      # Specify the temporary AccessKey secret obtained from STS.
      export TABLESTORE_ACCESS_KEY_SECRET=your_sts_access_key_secret
      # Specify the security token obtained from STS.
      export TABLESTORE_SESSION_TOKEN=your_sts_token

      Windows

      Run the command prompt as an administrator and run the following commands:

      # Specify the temporary AccessKey ID obtained from STS.
      setx TABLESTORE_ACCESS_KEY_ID your_sts_access_key_id /m
      # Specify the temporary AccessKey secret obtained from STS.
      setx TABLESTORE_ACCESS_KEY_SECRET your_sts_access_key_secret /m
      # Specify the security token obtained from STS.
      setx TABLESTORE_SESSION_TOKEN your_sts_token /m

      Note

      After you configure the environment variables, you may need to restart the relevant services or development tools such as Integrated Development Environment (IDE) to ensure that the new settings are applied as expected.

   2. Pass credential information by using environment variables.

      var accessKeyId = process.env.TABLESTORE_ACCESS_KEY_ID;
      var secretAccessKey = process.env.TABLESTORE_ACCESS_KEY_SECRET;
      var stsToken = process.env.TABLESTORE_SESSION_TOKEN;

Long term access credentials

If your application is deployed in a secure and stable environment that is not vulnerable to external attacks and requires long-term access to Tablestore by using Tablestore SDK for Node.js, you can use an AccessKey pair of your Alibaba Cloud account or a RAM user to access Tablestore. For information about how to obtain an AccessKey pair, see Use the AccessKey pair of a RAM user to access Tablestore.

1. Use the AccessKey pair to specify environment variables.

   Mac OS X/Linux/Unix

   # Specify the AccessKey ID.
   export TABLESTORE_ACCESS_KEY_ID=your_access_key_id
   # Specify the AccessKey secret.
   export TABLESTORE_ACCESS_KEY_SECRET=your_access_key_secret

   Windows

   Run the command prompt as an administrator and run the following commands:

   # Specify the AccessKey ID.
   setx TABLESTORE_ACCESS_KEY_ID your_access_key_id /m
   # Specify the AccessKey secret.
   setx TABLESTORE_ACCESS_KEY_SECRET your_access_key_secret /m

   Note

   After you configure the environment variables, you may need to restart the relevant services or development tools such as IDE to ensure that the new settings are applied as expected.

2. Use environment variables to pass credentials.

   var accessKeyId = process.env.TABLESTORE_ACCESS_KEY_ID;
   var secretAccessKey = process.env.TABLESTORE_ACCESS_KEY_SECRET;