Alibaba Cloud SDK:Erişim kimlik bilgilerini yönetin

pip install alibabacloud_credentials

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
# If no configuration parameter is specified, credentials are retrieved from the default credential chain.
credentialsClient = CredentialClient()
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# Use config to initialize the client of the cloud service. For more information, see the SDK documentation of each cloud service.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='access_key',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET')
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# Then, use config to initialize the client of the corresponding cloud service.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='sts',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET'),
    # Required. In this example, the temporary security token is retrieved from an environment variable.
    security_token=os.environ.get('ALIBABA_CLOUD_SECURITY_TOKEN')
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='ram_role_arn',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET'),
    # Required. The ARN of the RAM role to assume. Example: acs:ram::123456789012****:role/adminrole. You can also use the ALIBABA_CLOUD_ROLE_ARN environment variable to set this parameter.
    role_arn='<role_arn>',
    # Optional. The role session name. You can also use the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable to set this parameter.
    role_session_name='<role_session_name>',
    # Optional. A more restrictive policy. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
    policy='<policy>',
    # Optional. The external ID of the role, which is mainly used to prevent the confused deputy problem.
    external_id='<external_id>',
    # Optional. The session expiration time. Default value: 3600 seconds.
    role_session_expiration=3600
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='ecs_ram_role',
    # Optional. The name of the ECS role. If you leave this parameter empty, the name is obtained automatically. We recommend that you specify the name to reduce the number of requests. You can also use the ALIBABA_CLOUD_ECS_METADATA environment variable to set this parameter.
    role_name='<role_name>',
    # Optional. Default value: False. True: credentials are obtained only in the security hardening mode (IMDSv2), and an exception is thrown if access fails, so set True only for instances that support the security hardening mode. False: the tool first tries to obtain credentials in the security hardening mode. If the attempt fails, the tool switches to the normal mode (IMDSv1).
    disable_imds_v1=True
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='oidc_role_arn',
    # Required. The RAM role ARN. You can also use the ALIBABA_CLOUD_ROLE_ARN environment variable to set this parameter.
    role_arn='<role_arn>',
    # Required. The ARN of the OIDC IdP. You can also use the ALIBABA_CLOUD_OIDC_PROVIDER_ARN environment variable to set this parameter.
    oidc_provider_arn='<oidc_provider_arn>',
    # Required. The path to the OIDC token file. You can also use the ALIBABA_CLOUD_OIDC_TOKEN_FILE environment variable to set this parameter.
    oidc_token_file_path='<oidc_token_file_path>',
    # Optional. The role session name. You can also use the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable to set this parameter.
    role_session_name='<role_session_name>',
    # Optional. A more restrictive policy. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
    policy='<policy>',
    # Optional. The session expiration time. Default value: 3600 seconds.
    role_session_expiration=3600
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

{
  "Code": "Success",
  "AccessKeySecret": "yourAccessKeySecret",
  "AccessKeyId": "STS.****************",
  "Expiration": "2021-09-26T03:46:38Z",
  "SecurityToken": "yourSecurityToken"
}

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='credentials_uri',
    # Required. The URI from which the credentials are obtained. The format is http://local_or_remote_uri/. You can also use the ALIBABA_CLOUD_CREDENTIALS_URI environment variable to set this parameter.
    credentials_uri='<credentials_uri>',
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='bearer',
    # Required. Enter your bearer token.
    bearer_token='<BearerToken>',
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use the CCC V2.0 SDK, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

1. Kimlik bilgisi bilgilerini ortam değişkenlerinden alın

2. Kimlik bilgisi bilgilerini bir OIDC IdP'nin RAM rolünü kullanarak alın

3. Kimlik bilgisi bilgilerini bir yapılandırma dosyasından alın

Bu özellik alibabacloud_credentials 1.0rc3 veya sonraki bir sürümü gerektirir.

{
  "current": "<PROFILE_NAME>",
  "profiles": [
    {
      "name": "<PROFILE_NAME>",
      "mode": "AK",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
    },
    {
      "name": "<PROFILE_NAME1>",
      "mode": "StsToken",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "sts_token": "<SECURITY_TOKEN>"
    },
    {
      "name":"<PROFILE_NAME2>",
      "mode":"RamRoleArn",
      "access_key_id":"<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret":"<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME3>",
      "mode":"EcsRamRole",
      "ram_role_name":"<RAM_ROLE_ARN>"
    },
    {
      "name":"<PROFILE_NAME4>",
      "mode":"OIDC",
      "oidc_provider_arn":"<OIDC_PROVIDER_ARN>",
      "oidc_token_file":"<OIDC_TOKEN_FILE>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME5>",
      "mode":"ChainableRamRoleArn",
      "source_profile":"<PROFILE_NAME>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    }
  ]
}

4. Kimlik bilgisi bilgilerini bir ECS örneğinin RAM rolünü kullanarak alın

• Örnek meta verileri hakkında daha fazla bilgi için bkz. Örnek meta verileri.

• Bir ECS veya ECI örneğine RAM rolü ekleme hakkında daha fazla bilgi için bkz. Adım 1: RAM rolü oluşturma ve ECI örneğine örnek RAM rolü ekleme.

• Güvenlik sertleştirme modunda geçici kimlik kimlik bilgilerini almak için alibabacloud_credentials 0.3.6 veya sonraki bir sürümü kullanın.

5. Kimlik bilgisi bilgilerini bir URI'ye göre alın

ram_role_arn, ecs_ram_role, oidc_role_arn ve credentials_uri gibi oturum kimlik bilgisi türleri, kimlik bilgisi sağlayıcısında yerleşik bir mekanizma aracılığıyla otomatik yenilemeyi destekler. Bir kimlik bilgisi istemcisi ilk kez bir kimlik bilgisi aldığında sağlayıcı bunu bir önbellekte saklar. Sonraki işlemlerde aynı istemci örneği kimlik bilgisini bu önbellekten otomatik olarak alır. Önbelleğe alınan kimlik bilgisi süresi dolmuşsa istemci örneği yeni bir kimlik bilgisi alır ve önbelleği buna göre günceller.

Aşağıdaki örnek, bir kimlik bilgisi istemcisi oluşturmak için singleton desenini kullanır. Farklı zaman aralıklarında bir kimlik bilgisi alarak ve kimlik bilgisinin kullanılabilir olduğunu doğrulamak için bir OpenAPI işlemi çağırarak yenileme mekanizmasını gösterir.

import os
import sys
import time
import threading
from functools import wraps
from threading import Lock
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_ecs20140526.client import Client
from alibabacloud_ecs20140526.models import DescribeRegionsRequest
from alibabacloud_tea_openapi.models import Config as EcsConfig
#
# Thread-safe singleton decorator.
#
def singleton(cls):
    """Implements a thread-safe singleton pattern."""
    instances = {}
    lock = Lock()
    @wraps(cls)
    def wrapper(*args, **kwargs):
        with lock:
            if cls not in instances:
                instances[cls] = cls(*args, **kwargs)
        return instances[cls]
    return wrapper
#
# Singleton service class.
#
@singleton
class Credential:
    def __init__(self):
        self._client = self._init_client()
    @staticmethod
    def _init_client() -> CredentialClient:
        try:
            config = CredentialConfig(
                type="ram_role_arn",
                access_key_id=os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"),
                access_key_secret=os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"),
                role_arn=os.getenv("ALIBABA_CLOUD_ROLE_ARN"),
                role_session_name="RamRoleArnTest",
                role_session_expiration=3600,
            )
            return CredentialClient(config)
        except Exception as e:
            raise RuntimeError(f"Credential initialization failed: {e}") from e
    @property
    def client(self) -> CredentialClient:
        return self._client
@singleton
class EcsClient:
    def __init__(self, credential: CredentialClient):
        self._client = self._init_client(credential)
    @staticmethod
    def _init_client(credential: CredentialClient) -> Client:
        try:
            ecs_config = EcsConfig(credential=credential)
            ecs_config.endpoint = 'ecs.cn-hangzhou.aliyuncs.com'
            return Client(ecs_config)
        except Exception as e:
            raise RuntimeError(f"ECS client initialization failed: {e}") from e
    @property
    def client(self) -> Client:
        return self._client
#
# Task function.
#
def execute_task():
    try:
        # Obtain the credential and the ECS client.
        credential = Credential().client.get_credential()
        ecs_client = EcsClient(Credential().client).client
        # Print the credential information.
        print("Time:", time.strftime("%Y-%m-%d %H:%M:%S"))
        print("AK ID:", credential.access_key_id)
        print("AK Secret:", credential.access_key_secret)
        print("STS Token:", credential.security_token)
        # Call an API operation to query the region list.
        request = DescribeRegionsRequest()
        response = ecs_client.describe_regions(request)
        print("Invoke result:", response.to_map()["statusCode"])
    except Exception as e:
        print(f"ECS client execution failed: {e}")
        raise
def schedule_task():
    def run_execute_task():
        try:
            execute_task()
        except Exception as e:
            print(f"Task execution failed: {e}")
        finally:
            nonlocal task_count
            task_count += 1
            if task_count == len(DELAYS):
                print("All tasks completed. Exiting program.")
                sys.exit(0)
    def schedule_execution(delay):
        task_timer = threading.Timer(delay, run_execute_task)
        task_timer.start()
        return task_timer
    # Define the delays of the scheduled tasks.
    DELAYS = [0, 600, 4200, 4300]
    task_count = 0
    timers = [schedule_execution(delay) for delay in DELAYS]
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        print("Program interrupted by user.")
        for timer in timers:
            timer.cancel()
if __name__ == "__main__":
    schedule_task()

Time: 2025-05-28 14:51:51
AK ID: STS.NXC2_xxx_3e8nhx6
AK Secret: 89HQ_xxx_3pVFMsJzbStqUQn
STS Token: CAISxAJ1q6Ft5B2yfSjIr5v2ed2M3uhT3JKAb3b9h3AdS+oUga3T1Dz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtilmAGIpbng4YfgbiJREKxaXeiru_xxx_3XUiTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_+UxM3D2hT+Bi3HLQztRLNaRsQdpz0agA6vG9rqhiMsdPZDiIoh5FHnB/fZ
 +F9ol26SXsmquJdjfFgX9FFPVOqvnsHYRXUS2abqNKD_xxx_1GzLDX26i+hM2jxG6CFc9BJ3S5iElyLCAA
Invoke result: 200
Time: 2025-05-28 15:01:51
AK ID: STS.NXC2_xxx_3e8nhx6
AK Secret: 89HQ_xxx_3pVFMsJzbStqUQn
STS Token: CAISxAJ1q6Ft5B2yfSjIr5v2ed2M3uhT3JKAb3b9h3AdS+oUga3T1Dz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtilmAGIpbng4YfgbiJREKxaXeiru_xxx_3XUiTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_+UxM3D2hT+Bi3HLQztRLNaRsQdpz0agA6vG9rqhiMsdPZDiIoh5FHnB/fZ
 +F9ol26SXsmquJdjfFgX9FFPVOqvnsHYRXUS2abqNKD_xxx_1GzLDX26i+hM2jxG6CFc9BJ3S5iElyLCAA
Invoke result: 200
Time: 2025-05-28 16:01:53
AK ID: STS.NVw9_xxx_QZ3M4mu
AK Secret: 2mP6_xxx_Xvp38ai4mJTazm
STS Token: CAISxAJ1q6Ft5B2yfSjIr5XCctz4vp1A9qmocRChqE4hXdUfovH6Lzz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtoxWAYIpbng4YfgbiJREKxaXeiru_xxx_iTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_xM3D2hT+Bi3HLQztXxScP8Qdpz0agAG61LMbLwCjTNi3juW48l
 +/w3E16v00Wet2c9vr1Ftp3qaJ8zuQJIMgixWIvAXa4_xxx_eAMf+DaoEa0gUg1lQ7096D76vMDDr1eTiiAA
Invoke result: 200
Time: 2025-05-28 16:03:31
AK ID: STS.NVw9_xxx_QZ3M4mu
AK Secret: 2mP6_xxx_Xvp38ai4mJTazm
STS Token: CAISxAJ1q6Ft5B2yfSjIr5XCctz4vp1A9qmocRChqE4hXdUfovH6Lzz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtoxWAYIpbng4YfgbiJREKxaXeiru_xxx_iTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_xM3D2hT+Bi3HLQztXxScP8Qdpz0agAG61LMbLwCjTNi3juW48l
 +/w3E16v00Wet2c9vr1Ftp3qaJ8zuQJIMgixWIvAXa4_xxx_eAMf+DaoEa0gUg1lQ7096D76vMDDr1eTiiAA
Invoke result: 200

Günlük çıktısına dayalı analiz:

• İlk çağrıda önbellek boştur. Sistem yapılandırmanıza göre bir kimlik bilgisi alır ve ardından bunu önbelleğe kaydeder.

• İkinci çağrı, ilk çağrıyla aynı kimlik bilgisini kullanır; bu da kimlik bilgisinin önbellekten alındığını gösterir.

• Üçüncü çağrıda önbelleğe alınan kimlik bilgisinin süresi dolmuştur. Sona erme süresi (RoleSessionExpiration) 3.600 saniyedir ancak bu çağrı ilk çağrıdan 4.200 saniye sonra yapılır. Sonuç olarak SDK'nın otomatik yenileme mekanizması yeni bir kimlik bilgisi alır ve önbelleği günceller.

• Dördüncü çağrı, üçüncü çağrıyla aynı kimlik bilgisini kullanır; bu da önbelleğin güncellendiğini doğrular.