Alibaba Cloud SDK:Gerenciar credenciais de acesso

<dependency>
    <groupId>com.aliyun</groupId>
    <artifactId>aliyun-java-sdk-core</artifactId>
    <version>4.7.3</version>
</dependency>

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.profile.DefaultProfile;

public class Test {
    public static void main(String[] args) {
        DefaultProfile profile = DefaultProfile.getProfile(
                "<REGION_ID>",
                // Retrieve the AccessKey ID of the RAM user from an environment variable.
                System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"),
                // Retrieve the AccessKey secret of the RAM user from an environment variable.
                System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"),
                // The STS token.
                System.getenv("ALIBABA_CLOUD_SECURITY_TOKEN"));
        IAcsClient client = new DefaultAcsClient(profile);
        // The API call logic is omitted.
    }
}

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.auth.STSAssumeRoleSessionCredentialsProvider;
import com.aliyuncs.profile.DefaultProfile;

public class Sample {
    public static void main(String[] args) {
        DefaultProfile profile = DefaultProfile.getProfile("<REGION_ID>");
        // Use a RAM role ARN.
        STSAssumeRoleSessionCredentialsProvider stsProvider = STSAssumeRoleSessionCredentialsProvider
                .builder()
                // Required. Retrieve the AccessKey ID of the RAM user from an environment variable.
                .accessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"))
                // Required. Retrieve the AccessKey secret of the RAM user from an environment variable.
                .accessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"))
                // The Alibaba Cloud Resource Name (ARN) of the RAM role. Required unless the ALIBABA_CLOUD_ROLE_ARN environment variable is set.
                .roleArn("<ROLE_ARN>")
                // A custom session name. Optional. Can also be set by using the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable.
                .roleSessionName("<ROLE_SESSION_NAME>")
                // A custom policy. Optional. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
                .policy("<POLICY>")
                // An external ID to prevent the confused deputy problem. Optional.
                .externalId("<<EXTERNAL_ID>>")
                // The duration of the access credential in seconds. Optional. Defaults to 3600 and must not exceed 43200 (12 hours).
                .durationSeconds(3600)
                // The region ID for the AssumeRole API call. Optional.
                .stsRegionId("<STS_REGION_ID>") 
                .build();
        DefaultAcsClient client = new DefaultAcsClient(profile, stsProvider);
        // The API call logic is omitted.
    }
}

O SDK recupera credenciais de uma função RAM de instância anexada a uma instância do Elastic Compute Service (ECS) ou Elastic Container Instance (ECI), eliminando a necessidade de AccessKeys estáticos. O SDK detecta automaticamente a função RAM anexada e obtém um token STS do servidor de metadados.

A ferramenta Credentials usa IMDSv2 (modo de segurança reforçada) por padrão. Se o IMDSv2 falhar, a configuração disableIMDSv1 controla o comportamento de fallback:

1. false (padrão): retorna ao modo normal (IMDSv1) para recuperar credenciais.

2. true: lança uma exceção em vez de retornar ao IMDSv1.

O suporte ao IMDSv2 depende da configuração da instância.

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.auth.InstanceProfileCredentialsProvider;
import com.aliyuncs.profile.DefaultProfile;

public class Sample {
    public static void main(String[] args) {
        DefaultProfile profile = DefaultProfile.getProfile("<REGION_ID>");
        // Use an instance RAM role.
        InstanceProfileCredentialsProvider provider = InstanceProfileCredentialsProvider
                .builder()
                // The name of the RAM role attached to the instance.
                .roleName("<ROLE_NAME>")
                //.disableIMDSv1(false)
                .build();
        DefaultAcsClient client = new DefaultAcsClient(profile, provider);
        // The API call logic is omitted.
    }
}

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.auth.OIDCCredentialsProvider;
import com.aliyuncs.profile.DefaultProfile;

public class Sample {
    public static void main(String[] args) {
        // Use an OIDC-based RAM role.
        OIDCCredentialsProvider provider = OIDCCredentialsProvider
                .builder()
                // The ARN of the OIDC provider. Required unless the ALIBABA_CLOUD_OIDC_PROVIDER_ARN environment variable is set.
                .oidcProviderArn(System.getenv("ALIBABA_CLOUD_OIDC_PROVIDER_ARN"))
                // The path of the OIDC token file. Required unless the ALIBABA_CLOUD_OIDC_TOKEN_FILE environment variable is set.
                .oidcTokenFilePath(System.getenv("ALIBABA_CLOUD_OIDC_TOKEN_FILE"))
                // The ARN of the RAM role. Required unless the ALIBABA_CLOUD_ROLE_ARN environment variable is set.
                .roleArn(System.getenv("ALIBABA_CLOUD_ROLE_ARN"))
                // A custom session name. Optional.
                .roleSessionName("<ROLE_SESSION_NAME>")
                // A custom policy. Optional. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
                .policy("<POLICY>")
                // The duration of the access credential in seconds. Optional. Defaults to 3600 and must not exceed 43200 (12 hours).
                .durationSeconds(3600)
                // The region ID of STS. Optional.
                .stsRegionId("<REGION_ID>")
                .build();
        DefaultProfile profile = DefaultProfile.getProfile(
                // Specify the region ID of the client.
                "<REGION_ID>");
        IAcsClient client = new DefaultAcsClient(profile, provider);
        // The API call logic is omitted.
    }
}

Método 6: Token Bearer

import com.aliyuncs.auth.BearerTokenCredentials;
import com.aliyuncs.profile.DefaultProfile;
import com.aliyuncs.DefaultAcsClient;

public class BearerToken {
    public static void main(String[] args) {
        DefaultProfile profile = DefaultProfile.getProfile("<REGION_ID>");
        // Set the access credential by using BearerTokenCredentials.
        BearerTokenCredentials bearerTokenCredential = new BearerTokenCredentials("<BEARER_TOKEN>");
        DefaultAcsClient client = new DefaultAcsClient(profile, bearerTokenCredential);
        // The API call logic is omitted.
    }
}

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.exceptions.ClientException;

public class Test {
    public static void main(String[] args) throws ClientException {
        // Use the default credential provider chain.
        IAcsClient client = new DefaultAcsClient("<REGION_ID>");
        // The API call logic is omitted.
    }
}

Quando nenhuma credencial for encontrada, a cadeia de provedores tentará carregar o arquivo de credenciais compartilhadas, config.json, do local padrão e usará a credencial especificada no arquivo.

• Linux/macOS: ~/.aliyun/config.json

• Windows: C:\Users\USER_NAME\.aliyun\config.json

Para configurar uma credencial dessa forma, use a Alibaba Cloud CLI ou crie manualmente um arquivo config.json no caminho apropriado. O exemplo a seguir mostra o formato do conteúdo:

{
  "current": "<PROFILE_NAME>",
  "profiles": [
    {
      "name": "<PROFILE_NAME>",
      "mode": "AK",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
    },
    {
      "name": "<PROFILE_NAME1>",
      "mode": "StsToken",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "sts_token": "<SECURITY_TOKEN>"
    },
    {
      "name":"<PROFILE_NAME2>",
      "mode":"RamRoleArn",
      "access_key_id":"<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret":"<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME3>",
      "mode":"EcsRamRole",
      "ram_role_name":"<RAM_ROLE_ARN>"
    },
    {
      "name":"<PROFILE_NAME4>",
      "mode":"OIDC",
      "oidc_provider_arn":"<OIDC_PROVIDER_ARN>",
      "oidc_token_file":"<OIDC_TOKEN_FILE>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME5>",
      "mode":"ChainableRamRoleArn",
      "source_profile":"<PROFILE_NAME>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    }
  ]
}

O SDK verifica a variável de ambiente ALIBABA_CLOUD_CREDENTIALS_URI. Quando configurada, o SDK solicita uma credencial temporária na URI especificada.