ApsaraVideo VOD:STS tokens

How it works

You can use STS to issue an STS token to a third-party user. An STS token is an access credential with a custom validity period and limited access permissions. Then, the third-party user can use the short-term STS token to call API operations of ApsaraVideo VOD.

Usage notes

Obtain an STS token

To skip the signature process, we recommend that you integrate the STS SDK and call the AssumeRole operation to obtain a temporary STS token. Before you integrate the STS SDK, you must create a RAM user and assign a role that has the permissions to access ApsaraVideo VOD to the RAM user.

1. Create a RAM user. For more information, see Create a RAM role and grant temporary access permissions to the role by using STS.
2. Optional. Attach custom authorization policies to the RAM user. For more information, see Create a custom policy.
3. Integrate STS SDK and call the AssumeRole operation to obtain an STS token. The substeps of this step vary based on the programming language of the server.

   Programming language of the server	Operation guide
   Java	STS SDK for Java Note The following section provides sample code in Java.
   Python	STS SDK for Python
   PHP	STS SDK for PHP
   .NET	STS SDK for .NET
   Node.js	STS SDK for Node.js
   Go	STS SDK for Go

Sample code in Java

Sample Java code on how to obtain an STS token

1. Integrate the STS SDK.
   Add dependencies for the STS SDK.

   <dependencies>
     <!--  STS SDK in the earlier version  -->
     <dependency>
       <groupId>com.aliyun</groupId>
       <artifactId>aliyun-java-sdk-sts</artifactId>
       <version>3.1.1</version>
     </dependency>
   </dependencies>

   Add the core library for the STS SDK.

   <dependency>
     <groupId>com.aliyun</groupId>
     <artifactId>aliyun-java-sdk-core</artifactId>
     <version>4.6.1</version>
   </dependency>

2. Call the AssumeRole operation to obtain an STS token.

   
   import com.aliyuncs.DefaultAcsClient;
   import com.aliyuncs.exceptions.ClientException;
   import com.aliyuncs.http.MethodType;
   import com.aliyuncs.profile.DefaultProfile;
   import com.aliyuncs.profile.IClientProfile;
   import com.aliyuncs.sts.model.v20150401.AssumeRoleRequest;
   import com.aliyuncs.sts.model.v20150401.AssumeRoleResponse;
   
   
   /**
    * @author jack
    * @date 2020/5/25
    */
   public class TestStsService {
   
       public static void main(String[] args) {
           // Only a RAM user can call the AssumeRole operation.
           // AccessKey pairs of Alibaba Cloud accounts cannot be used to initiate AssumeRole requests.
           // Create a RAM user in the RAM console and create an AccessKey pair for the RAM user.
           String accessKeyId = "LTAI5tKtf6vKccbinQu****";
           String accessKeySecret = "D47l1yBPgjdqe3JzVASSF9yrje****";
           // Request parameters for the AssumeRole operation include RoleArn, RoleSessionName, Policy, and DurationSeconds.
           // You must obtain the value of RoleArn in the RAM console.
           String roleArn = "acs:ram::174809843091****:role/vodrole";
           // RoleSessionName specifies the session name of the role. You can specify a custom value for this parameter.
           String roleSessionName = "session-name";// Specify a session name.
           // Specify a policy.
           String policy = "{\n" +
                   "  \"Version\": \"1\",\n" +
                   "  \"Statement\": [\n" +
                   "    {\n" +
                   "      \"Action\": \"vod:*\",\n" +
                   "      \"Resource\": \"*\",\n" +
                   "      \"Effect\": \"Allow\"\n" +
                   "    }\n" +
                   "  ]\n" +
                   "}";
           try {
               AssumeRoleResponse response = assumeRole(accessKeyId, accessKeySecret, roleArn, roleSessionName, policy);
               System.out.println("Expiration: " + response.getCredentials().getExpiration());
               System.out.println("Access Key Id: " + response.getCredentials().getAccessKeyId());
               System.out.println("Access Key Secret: " + response.getCredentials().getAccessKeySecret());
               System.out.println("Security Token: " + response.getCredentials().getSecurityToken());
               System.out.println("RequestId: " + response.getRequestId());
   
               createUploadVideo(response.getCredentials().getAccessKeyId(), response.getCredentials().getAccessKeySecret(), response.getCredentials().getSecurityToken());
           } catch (ClientException e) {
               System.out.println("Failed to get a token.");
               System.out.println("Error code: " + e.getErrCode());
               System.out.println("Error message: " + e.getErrMsg());
           }
       }
   
       static AssumeRoleResponse assumeRole(String accessKeyId, String accessKeySecret, String roleArn, String roleSessionName, String policy) throws ClientException {
           try {
               // Construct a default profile. Leave the parameters empty. The regionId parameter is not required.
               /*
               Note: If you set SysEndpoint to sts.aliyuncs.com, the regionId parameter is optional. Otherwise, you must set the regionId parameter to the ID of the region in which you use STS. Example: cn-shanghai.
               For more information, see the STS endpoints in different regions. 
                */
               IClientProfile profile = DefaultProfile.getProfile("", accessKeyId, accessKeySecret);
               // Use the profile to construct a client.
               DefaultAcsClient client = new DefaultAcsClient(profile);
               // Create an AssumeRole request and configure the request parameters.
               final AssumeRoleRequest request = new AssumeRoleRequest();
               request.setSysEndpoint("sts.aliyuncs.com");
               request.setSysMethod(MethodType.POST);
               request.setRoleArn(roleArn);
               request.setRoleSessionName(roleSessionName);
               request.setPolicy(policy);
               // Initiate the request and obtain the response.
               final AssumeRoleResponse response = client.getAcsResponse(request);
               return response;
           } catch (ClientException e) {
               throw e;
           }
       }
                   

Parameters