Alibaba Cloud SDK:Gerencie credenciais de acesso

pip install alibabacloud_credentials

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
# If no configuration parameter is specified, credentials are retrieved from the default credential chain.
credentialsClient = CredentialClient()
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# Use config to initialize the client of the cloud service. For more information, see the SDK documentation of each cloud service.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='access_key',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET')
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# Then, use config to initialize the client of the corresponding cloud service.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='sts',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET'),
    # Required. In this example, the temporary security token is retrieved from an environment variable.
    security_token=os.environ.get('ALIBABA_CLOUD_SECURITY_TOKEN')
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='ram_role_arn',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET'),
    # Required. The ARN of the RAM role to assume. Example: acs:ram::123456789012****:role/adminrole. You can also use the ALIBABA_CLOUD_ROLE_ARN environment variable to set this parameter.
    role_arn='<role_arn>',
    # Optional. The role session name. You can also use the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable to set this parameter.
    role_session_name='<role_session_name>',
    # Optional. A more restrictive policy. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
    policy='<policy>',
    # Optional. The external ID of the role, which is mainly used to prevent the confused deputy problem.
    external_id='<external_id>',
    # Optional. The session expiration time. Default value: 3600 seconds.
    role_session_expiration=3600
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='ecs_ram_role',
    # Optional. The name of the ECS role. If you leave this parameter empty, the name is obtained automatically. We recommend that you specify the name to reduce the number of requests. You can also use the ALIBABA_CLOUD_ECS_METADATA environment variable to set this parameter.
    role_name='<role_name>',
    # Optional. Default value: False. True: credentials are obtained only in the security hardening mode (IMDSv2), and an exception is thrown if access fails, so set True only for instances that support the security hardening mode. False: the tool first tries to obtain credentials in the security hardening mode. If the attempt fails, the tool switches to the normal mode (IMDSv1).
    disable_imds_v1=True
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='oidc_role_arn',
    # Required. The RAM role ARN. You can also use the ALIBABA_CLOUD_ROLE_ARN environment variable to set this parameter.
    role_arn='<role_arn>',
    # Required. The ARN of the OIDC IdP. You can also use the ALIBABA_CLOUD_OIDC_PROVIDER_ARN environment variable to set this parameter.
    oidc_provider_arn='<oidc_provider_arn>',
    # Required. The path to the OIDC token file. You can also use the ALIBABA_CLOUD_OIDC_TOKEN_FILE environment variable to set this parameter.
    oidc_token_file_path='<oidc_token_file_path>',
    # Optional. The role session name. You can also use the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable to set this parameter.
    role_session_name='<role_session_name>',
    # Optional. A more restrictive policy. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
    policy='<policy>',
    # Optional. The session expiration time. Default value: 3600 seconds.
    role_session_expiration=3600
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

{
  "Code": "Success",
  "AccessKeySecret": "yourAccessKeySecret",
  "AccessKeyId": "STS.****************",
  "Expiration": "2021-09-26T03:46:38Z",
  "SecurityToken": "yourSecurityToken"
}

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='credentials_uri',
    # Required. The URI from which the credentials are obtained. The format is http://local_or_remote_uri/. You can also use the ALIBABA_CLOUD_CREDENTIALS_URI environment variable to set this parameter.
    credentials_uri='<credentials_uri>',
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='bearer',
    # Required. Enter your bearer token.
    bearer_token='<BearerToken>',
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use the CCC V2.0 SDK, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

1. Obter as informações de credencial de variáveis de ambiente

2. Obter as informações de credencial usando a função RAM de um provedor de identidade OIDC

3. Obter as informações de credencial de um arquivo de configuração

Este recurso requer alibabacloud_credentials 1.0rc3 ou posterior.

{
  "current": "<PROFILE_NAME>",
  "profiles": [
    {
      "name": "<PROFILE_NAME>",
      "mode": "AK",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
    },
    {
      "name": "<PROFILE_NAME1>",
      "mode": "StsToken",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "sts_token": "<SECURITY_TOKEN>"
    },
    {
      "name":"<PROFILE_NAME2>",
      "mode":"RamRoleArn",
      "access_key_id":"<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret":"<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME3>",
      "mode":"EcsRamRole",
      "ram_role_name":"<RAM_ROLE_ARN>"
    },
    {
      "name":"<PROFILE_NAME4>",
      "mode":"OIDC",
      "oidc_provider_arn":"<OIDC_PROVIDER_ARN>",
      "oidc_token_file":"<OIDC_TOKEN_FILE>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME5>",
      "mode":"ChainableRamRoleArn",
      "source_profile":"<PROFILE_NAME>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    }
  ]
}

4. Obter as informações de credencial usando a função RAM de uma instância ECS

• Para mais informações sobre metadados de instância, consulte Instance metadata.

• Para saber como anexar uma função RAM a uma instância ECS ou ECI, consulte Step 1: Create a RAM role e Attach an instance RAM role to an ECI instance.

• Para obter credenciais de identidade temporárias no modo de segurança reforçada, use alibabacloud_credentials 0.3.6 ou posterior.

5. Obter as informações de credencial com base em uma URI

Tipos de credencial de sessão, como ram_role_arn, ecs_ram_role, oidc_role_arn e credentials_uri, oferecem suporte à atualização automática por meio de um mecanismo integrado ao provedor de credenciais. Quando um cliente de credencial recupera uma credencial pela primeira vez, o provedor a armazena em cache. Nas operações subsequentes, a mesma instância do cliente recupera automaticamente a credencial desse cache. Se a credencial em cache tiver expirado, a instância do cliente busca uma nova e atualiza o cache adequadamente.

O exemplo a seguir usa o padrão singleton para criar um cliente de credencial. Ele demonstra o mecanismo de atualização buscando uma credencial em intervalos de tempo diferentes e chamando uma operação OpenAPI para verificar se a credencial está utilizável.

import os
import sys
import time
import threading
from functools import wraps
from threading import Lock
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_ecs20140526.client import Client
from alibabacloud_ecs20140526.models import DescribeRegionsRequest
from alibabacloud_tea_openapi.models import Config as EcsConfig
#
# Thread-safe singleton decorator.
#
def singleton(cls):
    """Implements a thread-safe singleton pattern."""
    instances = {}
    lock = Lock()
    @wraps(cls)
    def wrapper(*args, **kwargs):
        with lock:
            if cls not in instances:
                instances[cls] = cls(*args, **kwargs)
        return instances[cls]
    return wrapper
#
# Singleton service class.
#
@singleton
class Credential:
    def __init__(self):
        self._client = self._init_client()
    @staticmethod
    def _init_client() -> CredentialClient:
        try:
            config = CredentialConfig(
                type="ram_role_arn",
                access_key_id=os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"),
                access_key_secret=os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"),
                role_arn=os.getenv("ALIBABA_CLOUD_ROLE_ARN"),
                role_session_name="RamRoleArnTest",
                role_session_expiration=3600,
            )
            return CredentialClient(config)
        except Exception as e:
            raise RuntimeError(f"Credential initialization failed: {e}") from e
    @property
    def client(self) -> CredentialClient:
        return self._client
@singleton
class EcsClient:
    def __init__(self, credential: CredentialClient):
        self._client = self._init_client(credential)
    @staticmethod
    def _init_client(credential: CredentialClient) -> Client:
        try:
            ecs_config = EcsConfig(credential=credential)
            ecs_config.endpoint = 'ecs.cn-hangzhou.aliyuncs.com'
            return Client(ecs_config)
        except Exception as e:
            raise RuntimeError(f"ECS client initialization failed: {e}") from e
    @property
    def client(self) -> Client:
        return self._client
#
# Task function.
#
def execute_task():
    try:
        # Obtain the credential and the ECS client.
        credential = Credential().client.get_credential()
        ecs_client = EcsClient(Credential().client).client
        # Print the credential information.
        print("Time:", time.strftime("%Y-%m-%d %H:%M:%S"))
        print("AK ID:", credential.access_key_id)
        print("AK Secret:", credential.access_key_secret)
        print("STS Token:", credential.security_token)
        # Call an API operation to query the region list.
        request = DescribeRegionsRequest()
        response = ecs_client.describe_regions(request)
        print("Invoke result:", response.to_map()["statusCode"])
    except Exception as e:
        print(f"ECS client execution failed: {e}")
        raise
def schedule_task():
    def run_execute_task():
        try:
            execute_task()
        except Exception as e:
            print(f"Task execution failed: {e}")
        finally:
            nonlocal task_count
            task_count += 1
            if task_count == len(DELAYS):
                print("All tasks completed. Exiting program.")
                sys.exit(0)
    def schedule_execution(delay):
        task_timer = threading.Timer(delay, run_execute_task)
        task_timer.start()
        return task_timer
    # Define the delays of the scheduled tasks.
    DELAYS = [0, 600, 4200, 4300]
    task_count = 0
    timers = [schedule_execution(delay) for delay in DELAYS]
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        print("Program interrupted by user.")
        for timer in timers:
            timer.cancel()
if __name__ == "__main__":
    schedule_task()

Time: 2025-05-28 14:51:51
AK ID: STS.NXC2_xxx_3e8nhx6
AK Secret: 89HQ_xxx_3pVFMsJzbStqUQn
STS Token: CAISxAJ1q6Ft5B2yfSjIr5v2ed2M3uhT3JKAb3b9h3AdS+oUga3T1Dz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtilmAGIpbng4YfgbiJREKxaXeiru_xxx_3XUiTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_+UxM3D2hT+Bi3HLQztRLNaRsQdpz0agA6vG9rqhiMsdPZDiIoh5FHnB/fZ
 +F9ol26SXsmquJdjfFgX9FFPVOqvnsHYRXUS2abqNKD_xxx_1GzLDX26i+hM2jxG6CFc9BJ3S5iElyLCAA
Invoke result: 200
Time: 2025-05-28 15:01:51
AK ID: STS.NXC2_xxx_3e8nhx6
AK Secret: 89HQ_xxx_3pVFMsJzbStqUQn
STS Token: CAISxAJ1q6Ft5B2yfSjIr5v2ed2M3uhT3JKAb3b9h3AdS+oUga3T1Dz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtilmAGIpbng4YfgbiJREKxaXeiru_xxx_3XUiTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_+UxM3D2hT+Bi3HLQztRLNaRsQdpz0agA6vG9rqhiMsdPZDiIoh5FHnB/fZ
 +F9ol26SXsmquJdjfFgX9FFPVOqvnsHYRXUS2abqNKD_xxx_1GzLDX26i+hM2jxG6CFc9BJ3S5iElyLCAA
Invoke result: 200
Time: 2025-05-28 16:01:53
AK ID: STS.NVw9_xxx_QZ3M4mu
AK Secret: 2mP6_xxx_Xvp38ai4mJTazm
STS Token: CAISxAJ1q6Ft5B2yfSjIr5XCctz4vp1A9qmocRChqE4hXdUfovH6Lzz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtoxWAYIpbng4YfgbiJREKxaXeiru_xxx_iTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_xM3D2hT+Bi3HLQztXxScP8Qdpz0agAG61LMbLwCjTNi3juW48l
 +/w3E16v00Wet2c9vr1Ftp3qaJ8zuQJIMgixWIvAXa4_xxx_eAMf+DaoEa0gUg1lQ7096D76vMDDr1eTiiAA
Invoke result: 200
Time: 2025-05-28 16:03:31
AK ID: STS.NVw9_xxx_QZ3M4mu
AK Secret: 2mP6_xxx_Xvp38ai4mJTazm
STS Token: CAISxAJ1q6Ft5B2yfSjIr5XCctz4vp1A9qmocRChqE4hXdUfovH6Lzz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtoxWAYIpbng4YfgbiJREKxaXeiru_xxx_iTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_xM3D2hT+Bi3HLQztXxScP8Qdpz0agAG61LMbLwCjTNi3juW48l
 +/w3E16v00Wet2c9vr1Ftp3qaJ8zuQJIMgixWIvAXa4_xxx_eAMf+DaoEa0gUg1lQ7096D76vMDDr1eTiiAA
Invoke result: 200

Análise baseada na saída do log:

• Na primeira chamada, o cache está vazio. O sistema recupera uma credencial com base na sua configuração e a armazena no cache.

• A segunda chamada usa a mesma credencial da primeira, indicando que ela foi recuperada do cache.

• Na terceira chamada, a credencial em cache expirou. Seu tempo de expiração (RoleSessionExpiration) é de 3.600 segundos, mas esta chamada ocorre 4.200 segundos após a primeira. Consequentemente, o mecanismo de atualização automática do SDK busca uma nova credencial e atualiza o cache.

• A quarta chamada usa a mesma credencial da terceira, confirmando que o cache foi atualizado.