Elastic Compute Service:Instance RAM roles

Benefits

• Secure and convenient API operation calls within ECS instances: When your project is deployed on an ECS instance, you can use the capabilities provided by ECS to obtain STS tokens as temporary access credentials to call API operations without the need to configure an AccessKey pair in the code. This reduces the risk of AccessKey pair leaks.

• Simplified RAM identity switchover: If you use the AccessKey pair of a RAM identity as the access credential for a service, you must change the AccessKey pair in the configurations or code and restart the service when you change your RAM identity. If you use an instance RAM role to obtain STS tokens as temporary access credentials for a service, you need to only change the instance RAM role when you change your RAM identity. No additional configurations are required.

• Fine-grained permission management: You can attach instance RAM roles that include specific policies to different ECS instances. This allows you to implement fine-grained access control based on your business requirements.

Limits

Take note of the following limits when you attach instance RAM roles to ECS instances:

• The ECS instances to which you want to attach instance RAM roles must reside in virtual private clouds (VPCs).

• You can attach only one instance RAM role to an ECS instance.

Create an instance RAM role and attach the instance RAM role to an ECS instance

Obtain temporary access credentials for an instance RAM role

You can obtain temporary access credentials from within an ECS instance by accessing the metadata service. The validity of the temporary access credentials is ensured. For more information, see Obtain instance metadata.

Use an instance RAM role to call API operations

In this example, a Python application that is deployed on a Linux ECS instance calls API operations by using the instance RAM role attached to the instance to download files from an OSS bucket.

pip install oss2  
pip install alibabacloud_credentials

import oss2
from alibabacloud_credentials.client import Client
from alibabacloud_credentials.models import Config
from oss2 import CredentialsProvider
from oss2.credentials import Credentials

class CredentialProviderWarpper(CredentialsProvider):
    def __init__(self, client):
        self.client = client

    def get_credentials(self):
        access_key_id = self.client.get_access_key_id()
        access_key_secret = self.client.get_access_key_secret()
        security_token = self.client.get_security_token()
        return Credentials(access_key_id, access_key_secret, security_token)

def download_image_using_instance_role(bucket_name, endpoint, object_key, local_file, role_name):
    config = Config(
        type='ecs_ram_role',      # Specify the type of access credential. Set this parameter to ecs_ram_role. 
        role_name=role_name
    )
    cred = Client(config)
    credentials_provider = CredentialProviderWarpper(cred)
    auth = oss2.ProviderAuth(credentials_provider)

    # Initialize the OSS bucket.
    bucket = oss2.Bucket(auth, endpoint, bucket_name)
    # Download the image.
    bucket.get_object_to_file(object_key, local_file)
    print("Image downloaded successfully")

if __name__ == "__main__":  

    # Define global variables.
    role_name = 'role_name'  # Specify the name of the instance RAM role.
    bucket_name = 'bucket_name'  # Specify the name of the OSS bucket.
    endpoint = 'http://oss-cn-beijing-internal.aliyuncs.com'  # Specify the endpoint of the OSS bucket. If an internal endpoint is used, make sure that the ECS instance and the OSS bucket reside in the same region. 
    object_key = 'testfolder/example.png'  # Specify the path in which the image that you want to download is stored in OSS. The path does not include the bucket name.
    local_file = '/localpath/to/image.png'  # Specify a name for the image and the path in which you want to store the image on the ECS instance.
    download_image_using_instance_role(bucket_name, endpoint, object_key, local_file, role_name)

Other operations

Detach or change an instance RAM role

References

• If your self-managed application is deployed on an ECS instance, you can attach an instance RAM role to the ECS instance and use the instance RAM role to access Key Management Service (KMS) from the instance. For more information, see Use the instance RAM role attached to an ECS instance to securely access KMS.

• If an ECS instance no longer requires specific permissions, you can revoke the permissions from the instance RAM role that is attached to the instance. For more information, see Revoke permissions from a RAM role.

• If you hard code a plaintext AccessKey pair in the code that you use to call API operations of Alibaba Cloud, the AccessKey pair may be leaked due to improper permission management of the code repository. To call the API operations of Alibaba Cloud, we recommend that you use access credentials instead of a hard-coded AccessKey pair. For more information, see Best practices for using an access credential to call API operations and Credential security solutions.