Object Storage Service:Set up direct data transfer for mobile applications

You can use ROS to activate STS, configure an Elastic Compute Service (ECS) instance, and deploy application server source code on the ECS instance. To use ROS to activate STS and configure an application server, perform the following steps:

1. Go to the Create Stack wizard in the ROS console.

2. In the Select Template step of the Create Stack wizard in the ROS console, enter a stack name, specify the zone, instance type, system disk category, and password for the ECS instance that you want to purchase, and click Next. In the Check and Confirm step, check your settings and click Create.

   On the Stack Information tab of the page that appears, the status of the stack is displayed as Creating.

3. After the status of the stack becomes Created, click the Outputs tab to view the address of the deployed application server.

1. Create a RAM user in the RAM console

Create a RAM user and obtain the AccessKey pair of the RAM user. The AccessKey pair is long-term access credentials that are required to access and manage the application server.

1. Log on to the RAM console by using an Alibaba Cloud account or as an account administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. Configure the Logon Name and Display Name parameters.

5. In the Access Mode section, select Using permanent AccessKey to access and click OK.

6. Click Copy in the Actions column of the page that appears to copy and paste the AccessKey pair to a securely stored file.

2. Grant the RAM user the permissions to call the AssumeRole operation in the RAM console

Grant the RAM user the permissions to call the AssumeRole operation. This way, the RAM user can obtain temporary access credentials by assuming a RAM role.

1. In the left-side navigation pane, choose Identities > Users.

2. On the Users page, find the RAM user and click Add Permissions in the Actions column.

3. In the Policy section of the Grant Permission panel, select the AliyunSTSAssumeRoleAccess system policy.

   Note

   The AliyunSTSAssumeRoleAccess policy allows a RAM user to call the AssumeRole operation. The permissions of the policy are independent of the permissions required to allow the RAM user to obtain temporary access credentials from STS and initiate requests to OSS.

4. Click Grant permissions.

3. Create a RAM role in the RAM console

Create a RAM role for the Alibaba Cloud account and obtain the Alibaba Cloud Resource Name (ARN) of the RAM role. The RAM role is assumed by the RAM user later.

1. In the left-side navigation pane, choose Identities > Roles.

2. Click Create Role. In the Create Role wizard, set Select Trusted Entity to Alibaba Cloud Account and click Next.

3. In the Configure Role step, enter a name in the RAM Role Name field and set Select Trusted Alibaba Cloud Account to Current Alibaba Cloud Account.

4. Click OK. After you create the role, click Close.

5. On the Roles page, enter the role name in the search box. Example: oss-web-upload. Click the name of the role.

6. In the Basic Information section, click Copy next to the ARN field to record the ARN of the RAM role.

4. Create a custom policy in the RAM console

Create a custom policy based on the principle of least privilege. The custom policy grants the RAM role the permissions to upload data only to a specific bucket.

1. In the left-side navigation pane, choose Permissions > Policies.

2. On the Policies page, click Create Policy.

3. On the Create Policy page, click JSON. Copy the following sample script and paste it into the code editor. Replace <BucketName> with the name of the bucket that you created.

   Important

   The following sample script is provided for reference only. You must configure fine-grained RAM policies based on your business requirements to avoid granting excessive permissions to the RAM role. For more information about how to configure fine-grained policies, see Custom policies for OSS.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "oss:PutObject",
         "Resource": "acs:oss:*:*:<BucketName>/uploads/*"
       }
     ]
   }

4. After you configure the policy, click Next to edit policy information.

5. In the Basic Information section, specify the policy name and click OK.

5. Attach the custom policies to the RAM role in the RAM console

Attach the custom policy to the RAM role. This way, the RAM role can provide the required permissions when the RAM role is assumed.

1. In the left-side navigation pane, choose Identities > Roles.

2. On the Roles page, find the RAM role and click Grant Permission in the Actions column.

3. In the Policy section of the Grant Permission panel, select Custom Policy from the drop-down list, and then select the custom policy.

4. Click OK.

6. Create an ECS instance as the application server

Create an ECS instance to obtain temporary access credentials from STS.

For more information, see Create and manage an ECS instance in the console (express version).

7. Obtain temporary access credentials from the application server

Integrate STS SDK into the application server to obtain the /get_sts_token operation to obtain temporary access credentials from STS. When the /get_sts_token operation is called by using the HTTP GET method, the temporary access credentials are created and returned to the requester.