Tablestore:Configure access credentials

Use STS

If you want to access Tablestore only within a specific period of time, you can use Security Token Service (STS) to generate temporary access credentials. When you use temporary access credentials, you do not need to disclose the AccessKey pair of your Resource Access Management (RAM) user. This ensures secure access to Tablestore.

1. Create a RAM user. For more information, see Create a RAM user.

2. Attach the AliyunSTSAssumeRoleAccess policy to the RAM user. For more information, see Grant the RAM user the AssumeRole permission.

3. Create a RAM role and attach custom policies to the RAM role. For more information, see Create a RAM role and Grant the RAM role the permissions to access Tablestore.

4. Assume the RAM role as the RAM user to obtain temporary access credentials from STS. For more information, see Assume the RAM role as the RAM user to obtain temporary access credentials from STS.

5. Configure environment variables for the temporary access credentials.

   Environment variables

   1. Configure environment variables for temporary access credentials.

      Mac OS X/Linux/Unix

      # Specify the temporary AccessKey ID obtained from STS.
      export TABLESTORE_ACCESS_KEY_ID=your_sts_access_key_id
      # Specify the temporary AccessKey secret obtained from STS.
      export TABLESTORE_ACCESS_KEY_SECRET=your_sts_access_key_secret
      # Specify the security token obtained from STS.
      export TABLESTORE_SESSION_TOKEN=your_sts_token

      Windows

      Run the command prompt as an administrator and run the following commands:

      # Specify the temporary AccessKey ID obtained from STS.
      setx TABLESTORE_ACCESS_KEY_ID your_sts_access_key_id /m
      # Specify the temporary AccessKey secret obtained from STS.
      setx TABLESTORE_ACCESS_KEY_SECRET your_sts_access_key_secret /m
      # Specify the security token obtained from STS.
      setx TABLESTORE_SESSION_TOKEN your_sts_token /m

      Note

      After you specify the environment variables, you may need to restart the relevant services or development tools such as Integrated Development Environment (IDE) to ensure that the new settings are applied as expected.

   2. Specify environment variables to pass temporary access credentials.

      # -*- coding: utf-8 -*-
      import os
      
      access_key_id = os.getenv("TABLESTORE_ACCESS_KEY_ID")
      access_key_secret = os.getenv("TABLESTORE_ACCESS_KEY_SECRET")
      sts_token = os.getenv("TABLESTORE_SESSION_TOKEN")

   Static credentials

   You can define access credentials by using variables in your code. During the code execution, these variables are populated with actual credential values obtained from environment variables, configuration files, or other external data sources.

   The following procedure describes how to use a configuration file to pass credentials.

   1. Create a configuration file named config.ini.

      [configName]
      TABLESTORE_ACCESS_KEY_ID = your_sts_access_key_id
      TABLESTORE_ACCESS_KEY_SECRET = your_sts_access_key_secret
      TABLESTORE_SESSION_TOKEN = your_sts_token

   2. Use the configuration file to pass credentials.

      # -*- coding: utf-8 -*-
      import configparser
      
      # Read the configuration file.
      config = configparser.ConfigParser()
      # For example, the config.ini configuration file is stored in the same directory as the script.
      config.read('config.ini')
      
      # Obtain the AccessKey ID and AccessKey secret from the configuration file.
      access_key_id = config.get('configName', 'TABLESTORE_ACCESS_KEY_ID')
      access_key_secret = config.get('configName', 'TABLESTORE_ACCESS_KEY_SECRET')
      security_token = config.get('configName', 'TABLESTORE_SESSION_TOKEN')

Use the Credentials parameter in the context of Function Compute

If the function of your application is deployed and run in Function Compute, you can obtain temporary access credentials by using the Credentials parameter in the context of Function Compute.

The underlying logic of this method is to use an STS token to configure access credentials. Function Compute obtains an STS token by assuming a service role based on the role configured for the function. Then, the STS token is passed to your application by using the Credentials parameter in the context of Function Compute. The STS token is valid for 36 hours. You cannot change its validity period. The maximum execution time of a function is 24 hours. Therefore, you do not need to refresh the STS token because it does not expire when the function is executed. This method does not require an AccessKey pair or STS token, eliminating the risks associated with manually managing these credentials. For information about how to grant Function Compute the permissions to access Tablestore, see Grant Function Compute permissions to access other Alibaba Cloud services.

1. Use the Credentials parameter in the context of Function Compute to obtain temporary access credentials.

   # -*- coding: utf-8 -*-
   
   def handler(event, context):
       # Obtain the key information. Before you execute the function, make sure that a role is configured for the service to which the function belongs and that the role is granted the permissions to access Tablestore. We recommend that you use the AliyunFCDefaultRole role.
       creds = context.credentials
   
       access_key_id = creds.access_key_id
       access_key_secret = creds.access_key_secret
       security_token = creds.security_token
   
       # Perform the subsequent operations.
   
       return 'success'

Environment variables

1. Use the AccessKey pair to specify environment variables.

   Mac OS X/Linux/Unix

   # Specify the AccessKey ID.
   export TABLESTORE_ACCESS_KEY_ID=your_access_key_id
   # Specify the AccessKey secret.
   export TABLESTORE_ACCESS_KEY_SECRET=your_access_key_secret

   Windows

   Run the command prompt as an administrator and run the following commands:

   # Specify the AccessKey ID.
   setx TABLESTORE_ACCESS_KEY_ID your_access_key_id /m
   # Specify the AccessKey secret.
   setx TABLESTORE_ACCESS_KEY_SECRET your_access_key_secret /m

   Note

   After you specify the environment variables, you may need to restart the relevant services or development tools such as IDE to ensure that the new settings are applied as expected.

2. Use environment variables to pass credentials.

   # -*- coding: utf-8 -*-
   import os
   
   access_key_id = os.getenv("TABLESTORE_ACCESS_KEY_ID")
   access_key_secret = os.getenv("TABLESTORE_ACCESS_KEY_SECRET")

Static credentials

You can define access credentials by using variables in your code. During the code execution, these variables are populated with actual credential values obtained from environment variables, configuration files, or other external data sources.

The following procedure describes how to use a configuration file to pass credentials.

1. Create a configuration file named config.ini.

   [configName]
   TABLESTORE_ACCESS_KEY_ID = your_access_key_id
   TABLESTORE_ACCESS_KEY_SECRET = your_access_key_secret

2. Use the configuration file to pass credentials.

   # -*- coding: utf-8 -*-
   import configparser
   
   # Read the configuration file.
   config = configparser.ConfigParser()
   # For example, the config.ini configuration file is stored in the same directory as the script.
   config.read('config.ini')
   
   # Obtain the AccessKey ID and AccessKey secret from the configuration file.
   access_key_id = config.get('configName', 'TABLESTORE_ACCESS_KEY_ID')
   access_key_secret = config.get('configName', 'TABLESTORE_ACCESS_KEY_SECRET')