Object Storage Service:Access OSS by using STS temporary credentials

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.http.MethodType;
import com.aliyuncs.profile.DefaultProfile;
import com.aliyuncs.profile.IClientProfile;
import com.aliyuncs.auth.sts.AssumeRoleRequest;
import com.aliyuncs.auth.sts.AssumeRoleResponse;
public class StsServiceSample {
    public static void main(String[] args) { 
        // The endpoint of the STS service. Example: sts.cn-hangzhou.aliyuncs.com. You can access the STS service over the internet or through a VPC.       
        String endpoint = "sts.cn-hangzhou.aliyuncs.com";
        // Obtain the AccessKey ID and AccessKey secret of the RAM user that you created in Substep 1 from environment variables.
        String accessKeyId = System.getenv("ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("ACCESS_KEY_SECRET");
        // Obtain the ARN of the RAM role that you created in Substep 3 from environment variables.
        String roleArn = System.getenv("RAM_ROLE_ARN");
        // Specify a custom role session name to distinguish different tokens. Example: SessionTest.        
        String roleSessionName = "yourRoleSessionName";   
        // By default, the temporary credentials have all the permissions of the assumed role.      
        String policy = null;
        // The validity period of the temporary credentials in seconds. Minimum value: 900. Maximum value: the value of the Maximum Session Duration parameter of the role. The value of this parameter can be 3,600 to 43,200 seconds. Default value: 3,600 seconds.
        // When you upload large files or perform other time-consuming operations, we recommend that you specify a sufficient validity period to avoid having to repeatedly call the STS service to obtain new temporary credentials.
        Long durationSeconds = 3600L;
        try {
            // The region where the STS request is initiated. We recommend that you retain the default value, which is an empty string ("").
            String regionId = "";
            // Add an endpoint. This is applicable to STS SDK for Java 3.12.0 and later.
            DefaultProfile.addEndpoint(regionId, "Sts", endpoint);
            // Add an endpoint. This is applicable to STS SDK for Java versions earlier than 3.12.0.
            // DefaultProfile.addEndpoint("",regionId, "Sts", endpoint);
            // Construct a default profile.
            IClientProfile profile = DefaultProfile.getProfile(regionId, accessKeyId, accessKeySecret);
            // Construct a client.
            DefaultAcsClient client = new DefaultAcsClient(profile);
            final AssumeRoleRequest request = new AssumeRoleRequest();
            // This is applicable to STS SDK for Java 3.12.0 and later.
            request.setSysMethod(MethodType.POST);
            // This is applicable to STS SDK for Java versions earlier than 3.12.0.
            // request.setMethod(MethodType.POST);
            request.setRoleArn(roleArn);
            request.setRoleSessionName(roleSessionName);
            request.setPolicy(policy); 
            request.setDurationSeconds(durationSeconds); 
            final AssumeRoleResponse response = client.getAcsResponse(request);
            System.out.println("Expiration: " + response.getCredentials().getExpiration());
            System.out.println("Access Key Id: " + response.getCredentials().getAccessKeyId());
            System.out.println("Access Key Secret: " + response.getCredentials().getAccessKeySecret());
            System.out.println("Security Token: " + response.getCredentials().getSecurityToken());
            System.out.println("RequestId: " + response.getRequestId());
        } catch (ClientException e) {
            System.out.println("Failed:");
            System.out.println("Error code: " + e.getErrCode());
            System.out.println("Error message: " + e.getErrMsg());
            System.out.println("RequestId: " + e.getRequestId());
        }
    }
}

# -*- coding: utf-8 -*-

from aliyunsdkcore import client
from aliyunsdkcore.request import CommonRequest
import json
import oss2
import os

# Obtain the AccessKey ID and AccessKey secret of the RAM user that you created in Substep 1 from environment variables.
access_key_id = os.getenv("ACCESS_KEY_ID")
access_key_secret = os.getenv("ACCESS_KEY_SECRET")
# Obtain the ARN of the RAM role that you created in Substep 3 from environment variables.
role_arn = os.getenv("RAM_ROLE_ARN")

# Create a policy.
clt = client.AcsClient(access_key_id, access_key_secret, 'cn-hangzhou')
request = CommonRequest(product="Sts", version='2015-04-01', action_name='AssumeRole')
request.set_method('POST')
request.set_protocol_type('https')
request.add_query_param('RoleArn', role_arn)
# Specify a custom role session name to distinguish different tokens. Example: sessiontest.
request.add_query_param('RoleSessionName', 'sessiontest')
# Specify that the STS temporary credentials expire in 3,600 seconds.
request.add_query_param('DurationSeconds', '3600')
request.set_accept_format('JSON')

body = clt.do_action_with_exception(request)

# Use the AccessKey ID and AccessKey secret of the RAM user to request temporary credentials from STS.
token = json.loads(oss2.to_unicode(body))
# Print the temporary AccessKey pair (AccessKey ID and AccessKey secret), security token, and expiration time returned by STS.
print('AccessKeyId: ' + token['Credentials']['AccessKeyId'])
print('AccessKeySecret: ' + token['Credentials']['AccessKeySecret'])
print('SecurityToken: ' + token['Credentials']['SecurityToken'])
print('Expiration: ' + token['Credentials']['Expiration'])

const { STS } = require('ali-oss');
const express = require("express");
const app = express();

app.get('/sts', (req, res) => {
 let sts = new STS({
  // Obtain the AccessKey ID and AccessKey secret of the RAM user that you created in Substep 1 from environment variables.
   accessKeyId : process.env.ACCESS_KEY_ID,
   accessKeySecret : process.env.ACCESS_KEY_SECRET
});
  // process.env.RAM_ROLE_ARN is used to obtain the ARN of the RAM role that you created in Substep 3 from environment variables.
  // Specify a custom policy to further limit the permissions of the STS temporary credentials. If you do not specify a policy, the returned STS temporary credentials have all permissions of the specified role.
  // The final permissions of the temporary credentials are the intersection of the role permissions that you set in Step 4 and the permissions that you set in this policy.
  // The expiration parameter specifies the validity period of the temporary credentials in seconds. Minimum value: 900. Maximum value: the value of the Maximum Session Duration parameter of the role. In this example, the validity period is set to 3,600 seconds.
  // The sessionName parameter specifies a custom role session name to distinguish different tokens. Example: sessiontest.
  sts.assumeRole('process.env.RAM_ROLE_ARN', ``, '3600', 'sessiontest').then((result) => {
    console.log(result);
    res.set('Access-Control-Allow-Origin', '*');
    res.set('Access-Control-Allow-METHOD', 'GET');
    res.json({
      AccessKeyId: result.credentials.AccessKeyId,
      AccessKeySecret: result.credentials.AccessKeySecret,
      SecurityToken: result.credentials.SecurityToken,
      Expiration: result.credentials.Expiration
    });
  }).catch((err) => {
    console.log(err);
    res.status(400).json(err.message);
  });
});
app.listen(8000,()=>{
   console.log("server listen on:8000")
})

package main

import (
    "fmt"
    "os"

    openapi "github.com/alibabacloud-go/darabonba-openapi/v2/client"
    sts20150401 "github.com/alibabacloud-go/sts-20150401/v2/client"
    util "github.com/alibabacloud-go/tea-utils/v2/service"
    "github.com/alibabacloud-go/tea/tea"
)

func main() {
    // Obtain the AccessKey ID and AccessKey secret of the RAM user that you created in Substep 1 from environment variables.
    accessKeyId := os.Getenv("ACCESS_KEY_ID")
    accessKeySecret := os.Getenv("ACCESS_KEY_SECRET")
    // Obtain the ARN of the RAM role that you created in Substep 3 from environment variables.
    roleArn := os.Getenv("RAM_ROLE_ARN")

    // Create a policy client.
    config := &openapi.Config{
        // Required. The AccessKey ID that you obtained in Substep 1.
        AccessKeyId: tea.String(accessKeyId),
        // Required. The AccessKey secret that you obtained in Substep 1.
        AccessKeySecret: tea.String(accessKeySecret),
    }
    // For more information about endpoints, see https://api.aliyun.com/product/Sts
    config.Endpoint = tea.String("sts.cn-hangzhou.aliyuncs.com")
    client, err := sts20150401.NewClient(config)
    if err != nil {
        fmt.Printf("Failed to create client: %v\n", err)
        return
    }

    // Use the AccessKey ID and AccessKey secret of the RAM user to request temporary credentials from STS.
    request := &sts20150401.AssumeRoleRequest{
        // Specify that the STS temporary credentials expire in 3,600 seconds.
        DurationSeconds: tea.Int64(3600),
        // Obtain the ARN of the RAM role that you created in Substep 3 from environment variables.
        RoleArn: tea.String(roleArn),
        // Specify a custom role session name. In this example, use examplename.
        RoleSessionName: tea.String("examplename"),
    }
    response, err := client.AssumeRoleWithOptions(request, &util.RuntimeOptions{})
    if err != nil {
        fmt.Printf("Failed to assume role: %v\n", err)
        return
    }

    // Print the temporary AccessKey pair (AccessKey ID and AccessKey secret), security token, and expiration time returned by STS.
    credentials := response.Body.Credentials
    fmt.Println("AccessKeyId: " + tea.StringValue(credentials.AccessKeyId))
    fmt.Println("AccessKeySecret: " + tea.StringValue(credentials.AccessKeySecret))
    fmt.Println("SecurityToken: " + tea.StringValue(credentials.SecurityToken))
    fmt.Println("Expiration: " + tea.StringValue(credentials.Expiration))
}

<?php
require __DIR__ . '/vendor/autoload.php';

use AlibabaCloud\Client\AlibabaCloud;
use AlibabaCloud\Client\Exception\ClientException;
use AlibabaCloud\Client\Exception\ServerException;
use AlibabaCloud\Sts\Sts;

// Obtain the AccessKey ID and AccessKey secret of the RAM user that you created in Substep 1 from environment variables.
$accessKeyId = getenv("ACCESS_KEY_ID");
$accessKeySecret = getenv("ACCESS_KEY_SECRET");
// Obtain the ARN of the RAM role that you created in Substep 3 from environment variables.
$roleArn = getenv("RAM_ROLE_ARN");

// Initialize an Alibaba Cloud client.
AlibabaCloud::accessKeyClient($accessKeyId, $accessKeySecret)
    ->regionId('cn-hangzhou')
    ->asDefaultClient();

try {
    // Create an STS request.
    $result = Sts::v20150401()
        ->assumeRole()
        // Set the role ARN.
        ->withRoleArn($roleArn)
        // Specify a custom role session name to distinguish different tokens.
        ->withRoleSessionName('sessiontest')
        // Specify that the STS temporary credentials expire in 3,600 seconds.
        ->withDurationSeconds(3600)
        ->request();

    // Obtain the credential information from the response.
    $credentials = $result['Credentials'];

    // Print the temporary AccessKey pair (AccessKey ID and AccessKey secret), security token, and expiration time returned by STS.
    echo 'AccessKeyId: ' . $credentials['AccessKeyId'] . PHP_EOL;
    echo 'AccessKeySecret: ' . $credentials['AccessKeySecret'] . PHP_EOL;
    echo 'SecurityToken: ' . $credentials['SecurityToken'] . PHP_EOL;
    echo 'Expiration: ' . $credentials['Expiration'] . PHP_EOL;
} catch (ClientException $e) {
    // Handle client exceptions.
    echo $e->getErrorMessage() . PHP_EOL;
} catch (ServerException $e) {
    // Handle server exceptions.
    echo $e->getErrorMessage() . PHP_EOL;
}

require 'sinatra'
require 'base64'
require 'open-uri'
require 'cgi'
require 'openssl'
require 'json'
require 'sinatra/reloader'
require 'sinatra/content_for'
require 'aliyunsdkcore'

# Set the path of the public folder to the templates subfolder in the current folder.
set :public_folder, File.dirname(__FILE__) + '/templates'

def get_sts_token_for_oss_upload()
  client = RPCClient.new(
    # Obtain the AccessKey ID and AccessKey secret of the RAM user that you created in Substep 1 from environment variables.
    access_key_id: ENV['ACCESS_KEY_ID'],
    access_key_secret: ENV['ACCESS_KEY_SECRET'],
    endpoint: 'https://sts.cn-hangzhou.aliyuncs.com',
    api_version: '2015-04-01'
  )
  response = client.request(
    action: 'AssumeRole',
    params: {
      # Obtain the ARN of the RAM role that you created in Substep 3 from environment variables.
      "RoleArn": ENV['RAM_ROLE_ARN'],
      # Specify that the STS temporary credentials expire in 3,600 seconds.
      "DurationSeconds": 3600,
      # The sessionName parameter specifies a custom role session name to distinguish different tokens. Example: sessiontest.
      "RoleSessionName": "sessiontest"
    },
    opts: {
      method: 'POST',
      format_params: true
    }
  )
end

if ARGV.length == 1 
  $server_port = ARGV[0]
elsif ARGV.length == 2
  $server_ip = ARGV[0]
  $server_port = ARGV[1]
end

$server_ip = "127.0.0.1"  # To listen on other addresses such as 0.0.0.0, you must add an authentication mechanism on the server.
$server_port = 8000

puts "App server is running on: http://#{$server_ip}:#{$server_port}"

set :bind, $server_ip
set :port, $server_port

get '/get_sts_token_for_oss_upload' do
  token = get_sts_token_for_oss_upload()
  response = {
    "AccessKeyId" => token["Credentials"]["AccessKeyId"],
    "AccessKeySecret" => token["Credentials"]["AccessKeySecret"],
    "SecurityToken" => token["Credentials"]["SecurityToken"],
    "Expiration" => token["Credentials"]["Expiration"]
  }
  response.to_json
end

get '/*' do
  puts "********************* GET "
  send_file File.join(settings.public_folder, 'index.html')
end