Alibaba Cloud SDK:Gestión de credenciales de acceso

pip install alibabacloud_credentials

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
# If no configuration parameter is specified, credentials are retrieved from the default credential chain.
credentialsClient = CredentialClient()
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# Use config to initialize the client of the cloud service. For more information, see the SDK documentation of each cloud service.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='access_key',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET')
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# Then, use config to initialize the client of the corresponding cloud service.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='sts',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET'),
    # Required. In this example, the temporary security token is retrieved from an environment variable.
    security_token=os.environ.get('ALIBABA_CLOUD_SECURITY_TOKEN')
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='ram_role_arn',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET'),
    # Required. The ARN of the RAM role to assume. Example: acs:ram::123456789012****:role/adminrole. You can also use the ALIBABA_CLOUD_ROLE_ARN environment variable to set this parameter.
    role_arn='<role_arn>',
    # Optional. The role session name. You can also use the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable to set this parameter.
    role_session_name='<role_session_name>',
    # Optional. A more restrictive policy. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
    policy='<policy>',
    # Optional. The external ID of the role, which is mainly used to prevent the confused deputy problem.
    external_id='<external_id>',
    # Optional. The session expiration time. Default value: 3600 seconds.
    role_session_expiration=3600
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='ecs_ram_role',
    # Optional. The name of the ECS role. If you leave this parameter empty, the name is obtained automatically. We recommend that you specify the name to reduce the number of requests. You can also use the ALIBABA_CLOUD_ECS_METADATA environment variable to set this parameter.
    role_name='<role_name>',
    # Optional. Default value: False. True: credentials are obtained only in the security hardening mode (IMDSv2), and an exception is thrown if access fails, so set True only for instances that support the security hardening mode. False: the tool first tries to obtain credentials in the security hardening mode. If the attempt fails, the tool switches to the normal mode (IMDSv1).
    disable_imds_v1=True
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='oidc_role_arn',
    # Required. The RAM role ARN. You can also use the ALIBABA_CLOUD_ROLE_ARN environment variable to set this parameter.
    role_arn='<role_arn>',
    # Required. The ARN of the OIDC IdP. You can also use the ALIBABA_CLOUD_OIDC_PROVIDER_ARN environment variable to set this parameter.
    oidc_provider_arn='<oidc_provider_arn>',
    # Required. The path to the OIDC token file. You can also use the ALIBABA_CLOUD_OIDC_TOKEN_FILE environment variable to set this parameter.
    oidc_token_file_path='<oidc_token_file_path>',
    # Optional. The role session name. You can also use the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable to set this parameter.
    role_session_name='<role_session_name>',
    # Optional. A more restrictive policy. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
    policy='<policy>',
    # Optional. The session expiration time. Default value: 3600 seconds.
    role_session_expiration=3600
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

{
  "Code": "Success",
  "AccessKeySecret": "yourAccessKeySecret",
  "AccessKeyId": "STS.****************",
  "Expiration": "2021-09-26T03:46:38Z",
  "SecurityToken": "yourSecurityToken"
}

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='credentials_uri',
    # Required. The URI from which the credentials are obtained. The format is http://local_or_remote_uri/. You can also use the ALIBABA_CLOUD_CREDENTIALS_URI environment variable to set this parameter.
    credentials_uri='<credentials_uri>',
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='bearer',
    # Required. Enter your bearer token.
    bearer_token='<BearerToken>',
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use the CCC V2.0 SDK, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

1. Obtención de la información de credenciales desde variables de entorno

2. Obtención de la información de credenciales mediante el rol de RAM de un IdP de OIDC

3. Obtención de la información de credenciales desde un archivo de configuración

Esta función requiere alibabacloud_credentials 1.0rc3 o una versión posterior.

{
  "current": "<PROFILE_NAME>",
  "profiles": [
    {
      "name": "<PROFILE_NAME>",
      "mode": "AK",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
    },
    {
      "name": "<PROFILE_NAME1>",
      "mode": "StsToken",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "sts_token": "<SECURITY_TOKEN>"
    },
    {
      "name":"<PROFILE_NAME2>",
      "mode":"RamRoleArn",
      "access_key_id":"<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret":"<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME3>",
      "mode":"EcsRamRole",
      "ram_role_name":"<RAM_ROLE_ARN>"
    },
    {
      "name":"<PROFILE_NAME4>",
      "mode":"OIDC",
      "oidc_provider_arn":"<OIDC_PROVIDER_ARN>",
      "oidc_token_file":"<OIDC_TOKEN_FILE>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME5>",
      "mode":"ChainableRamRoleArn",
      "source_profile":"<PROFILE_NAME>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    }
  ]
}

4. Obtención de la información de credenciales mediante el rol de RAM de una instancia de ECS

• Para más información sobre los metadatos de la instancia, consulte Instance metadata.

• Para más información sobre cómo asociar un rol de RAM a una instancia de ECS o ECI, consulte Step 1: Create a RAM role y Attach an instance RAM role to an ECI instance.

• Para obtener credenciales de identidad temporales en el modo de seguridad reforzada, utilice alibabacloud_credentials 0.3.6 o una versión posterior.

5. Obtención de la información de credenciales a partir de un URI

Los tipos de credenciales de sesión, como ram_role_arn, ecs_ram_role, oidc_role_arn y credentials_uri, admiten la actualización automática mediante un mecanismo integrado en el proveedor de credenciales. Cuando un cliente de credenciales obtiene una por primera vez, el proveedor la almacena en una caché. En las operaciones posteriores, la misma instancia del cliente recupera automáticamente la credencial desde esta caché. Si la credencial almacenada caducó, la instancia del cliente obtiene una nueva y actualiza la caché en consecuencia.

A continuación se muestra un ejemplo que utiliza el patrón singleton para crear un cliente de credenciales. Este ejemplo demuestra el mecanismo de actualización al obtener una credencial en distintos intervalos de tiempo y llamar a una operación de OpenAPI para comprobar que la credencial es válida.

import os
import sys
import time
import threading
from functools import wraps
from threading import Lock
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_ecs20140526.client import Client
from alibabacloud_ecs20140526.models import DescribeRegionsRequest
from alibabacloud_tea_openapi.models import Config as EcsConfig
#
# Thread-safe singleton decorator.
#
def singleton(cls):
    """Implements a thread-safe singleton pattern."""
    instances = {}
    lock = Lock()
    @wraps(cls)
    def wrapper(*args, **kwargs):
        with lock:
            if cls not in instances:
                instances[cls] = cls(*args, **kwargs)
        return instances[cls]
    return wrapper
#
# Singleton service class.
#
@singleton
class Credential:
    def __init__(self):
        self._client = self._init_client()
    @staticmethod
    def _init_client() -> CredentialClient:
        try:
            config = CredentialConfig(
                type="ram_role_arn",
                access_key_id=os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"),
                access_key_secret=os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"),
                role_arn=os.getenv("ALIBABA_CLOUD_ROLE_ARN"),
                role_session_name="RamRoleArnTest",
                role_session_expiration=3600,
            )
            return CredentialClient(config)
        except Exception as e:
            raise RuntimeError(f"Credential initialization failed: {e}") from e
    @property
    def client(self) -> CredentialClient:
        return self._client
@singleton
class EcsClient:
    def __init__(self, credential: CredentialClient):
        self._client = self._init_client(credential)
    @staticmethod
    def _init_client(credential: CredentialClient) -> Client:
        try:
            ecs_config = EcsConfig(credential=credential)
            ecs_config.endpoint = 'ecs.cn-hangzhou.aliyuncs.com'
            return Client(ecs_config)
        except Exception as e:
            raise RuntimeError(f"ECS client initialization failed: {e}") from e
    @property
    def client(self) -> Client:
        return self._client
#
# Task function.
#
def execute_task():
    try:
        # Obtain the credential and the ECS client.
        credential = Credential().client.get_credential()
        ecs_client = EcsClient(Credential().client).client
        # Print the credential information.
        print("Time:", time.strftime("%Y-%m-%d %H:%M:%S"))
        print("AK ID:", credential.access_key_id)
        print("AK Secret:", credential.access_key_secret)
        print("STS Token:", credential.security_token)
        # Call an API operation to query the region list.
        request = DescribeRegionsRequest()
        response = ecs_client.describe_regions(request)
        print("Invoke result:", response.to_map()["statusCode"])
    except Exception as e:
        print(f"ECS client execution failed: {e}")
        raise
def schedule_task():
    def run_execute_task():
        try:
            execute_task()
        except Exception as e:
            print(f"Task execution failed: {e}")
        finally:
            nonlocal task_count
            task_count += 1
            if task_count == len(DELAYS):
                print("All tasks completed. Exiting program.")
                sys.exit(0)
    def schedule_execution(delay):
        task_timer = threading.Timer(delay, run_execute_task)
        task_timer.start()
        return task_timer
    # Define the delays of the scheduled tasks.
    DELAYS = [0, 600, 4200, 4300]
    task_count = 0
    timers = [schedule_execution(delay) for delay in DELAYS]
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        print("Program interrupted by user.")
        for timer in timers:
            timer.cancel()
if __name__ == "__main__":
    schedule_task()

Time: 2025-05-28 14:51:51
AK ID: STS.NXC2_xxx_3e8nhx6
AK Secret: 89HQ_xxx_3pVFMsJzbStqUQn
STS Token: CAISxAJ1q6Ft5B2yfSjIr5v2ed2M3uhT3JKAb3b9h3AdS+oUga3T1Dz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtilmAGIpbng4YfgbiJREKxaXeiru_xxx_3XUiTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_+UxM3D2hT+Bi3HLQztRLNaRsQdpz0agA6vG9rqhiMsdPZDiIoh5FHnB/fZ
 +F9ol26SXsmquJdjfFgX9FFPVOqvnsHYRXUS2abqNKD_xxx_1GzLDX26i+hM2jxG6CFc9BJ3S5iElyLCAA
Invoke result: 200
Time: 2025-05-28 15:01:51
AK ID: STS.NXC2_xxx_3e8nhx6
AK Secret: 89HQ_xxx_3pVFMsJzbStqUQn
STS Token: CAISxAJ1q6Ft5B2yfSjIr5v2ed2M3uhT3JKAb3b9h3AdS+oUga3T1Dz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtilmAGIpbng4YfgbiJREKxaXeiru_xxx_3XUiTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_+UxM3D2hT+Bi3HLQztRLNaRsQdpz0agA6vG9rqhiMsdPZDiIoh5FHnB/fZ
 +F9ol26SXsmquJdjfFgX9FFPVOqvnsHYRXUS2abqNKD_xxx_1GzLDX26i+hM2jxG6CFc9BJ3S5iElyLCAA
Invoke result: 200
Time: 2025-05-28 16:01:53
AK ID: STS.NVw9_xxx_QZ3M4mu
AK Secret: 2mP6_xxx_Xvp38ai4mJTazm
STS Token: CAISxAJ1q6Ft5B2yfSjIr5XCctz4vp1A9qmocRChqE4hXdUfovH6Lzz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtoxWAYIpbng4YfgbiJREKxaXeiru_xxx_iTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_xM3D2hT+Bi3HLQztXxScP8Qdpz0agAG61LMbLwCjTNi3juW48l
 +/w3E16v00Wet2c9vr1Ftp3qaJ8zuQJIMgixWIvAXa4_xxx_eAMf+DaoEa0gUg1lQ7096D76vMDDr1eTiiAA
Invoke result: 200
Time: 2025-05-28 16:03:31
AK ID: STS.NVw9_xxx_QZ3M4mu
AK Secret: 2mP6_xxx_Xvp38ai4mJTazm
STS Token: CAISxAJ1q6Ft5B2yfSjIr5XCctz4vp1A9qmocRChqE4hXdUfovH6Lzz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtoxWAYIpbng4YfgbiJREKxaXeiru_xxx_iTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_xM3D2hT+Bi3HLQztXxScP8Qdpz0agAG61LMbLwCjTNi3juW48l
 +/w3E16v00Wet2c9vr1Ftp3qaJ8zuQJIMgixWIvAXa4_xxx_eAMf+DaoEa0gUg1lQ7096D76vMDDr1eTiiAA
Invoke result: 200

Análisis basado en la salida del registro:

• En la primera llamada, la caché está vacía. El sistema obtiene una credencial según su configuración y luego la almacena en la caché.

• La segunda llamada usa la misma credencial que la primera, lo cual indica que se recuperó de la caché.

• En la tercera llamada, la credencial almacenada ya caducó. Su tiempo de expiración (RoleSessionExpiration) es de 3,600 segundos, pero esta llamada se ejecuta 4,200 segundos después de la primera. Por lo tanto, el mecanismo de actualización automática del SDK obtiene una credencial nueva y actualiza la caché.

• La cuarta llamada usa la misma credencial que la tercera, lo que confirma que la caché se actualizó.