Tablestore:Configure access credentials

Configure temporary access credentials provided by STS

If you want to access Tablestore only within a specific period of time, you can use Security Token Service (STS) to generate temporary access credentials. When you use temporary access credentials, you do not need to disclose the AccessKey pair of your Resource Access Management (RAM) user. This ensures secure access to Tablestore.

1. Create a RAM user. For more information, see the Step 1: Create a RAM user section of the "Use temporary access credentials obtained from STS to initiate requests" topic.

2. Attach the AliyunSTSAssumeRoleAccess policy to the RAM user. For more information, see the Step 2: Grant the RAM user the permissions to call the AssumeRole operation section of the "Use temporary access credentials obtained from STS to initiate requests" topic.

3. Create a RAM role and attach custom policies to the RAM role. For more information, see the Step 3: Create a RAM role and Step 4: Grant Tablestore read-only access to the RAM role sections of the "Use temporary access credentials obtained from STS to initiate requests" topic.

4. Assume the RAM role as the RAM user to obtain temporary access credentials from STS. For more information, see the Step 5: Use the RAM user to assume the RAM role to obtain temporary access credentials section of the "Use temporary access credentials obtained from STS to initiate requests" topic.

5. Configure the temporary access credentials obtained from STS.

   Environment variables

   1. Use temporary access credentials to specify environment variables.

      Mac OS X,Linux, and Unix

      export OTS_AK_ENV=<OTS_AK_ENV>
      export OTS_SK_ENV=<OTS_SK_ENV>
      export OTS_SESSION_TOKEN=<OTS_SESSION_TOKEN>

      Windows

      Open Command Prompt and run the following commands as the administrator:

      setx OTS_AK_ENV <OTS_AK_ENV> /m
      setx OTS_SK_ENV <OTS_SK_ENV> /m
      setx OTS_SESSION_TOKEN <OTS_SESSION_TOKEN> /m

      Note

      After you specify the environment variables, you may need to restart the relevant services or development tools such as Integrated Development Environment (IDE) to ensure that the new settings are applied as expected.

   2. Specify environment variables to pass temporary access credentials.

      # -*- coding: utf-8 -*-
      import os
      
      access_key_id = os.getenv("OTS_AK_ENV")
      access_key_secret = os.getenv("OTS_SK_ENV")
      sts_token = os.getenv("OTS_SESSION_TOKEN")

   Static credentials

   You can reference credentials by specifying variables in your code. In a runtime environment, the variables are passed by actual credential values from environment variables, configuration files, or other external data sources.

   The following procedure describes how to use a configuration file to pass credentials.

   1. Create a configuration file named config.ini.

      [configName]
      OTS_AK_ENV = <OTS_AK_ENV>
      OTS_SK_ENV = <OTS_SK_ENV>
      OTS_SESSION_TOKEN = <OTS_SESSION_TOKEN>

   2. Use the configuration file to pass credentials.

      # -*- coding: utf-8 -*-
      import configparser
      
      # Read the configuration file.
      config = configparser.ConfigParser()
      # For example, the config.ini configuration file is stored in the same directory as the script.
      config.read('config.ini')
      
      # Obtain the AccessKey ID and AccessKey secret from the configuration file.
      access_key_id = config.get('configName', 'OTS_AK_ENV')
      access_key_secret = config.get('configName', 'OTS_SK_ENV')
      security_token = config.get('configName', 'OTS_SESSION_TOKEN')

Use the Credentials parameter in the context of Function Compute

If the function of your application is deployed and run in Function Compute, you can obtain temporary access credentials by using the Credentials parameter in the context of Function Compute.

The underlying logic of this method is to use an STS token to configure access credentials. Function Compute obtains an STS token by assuming a service role based on the role configured for the function. Then, the STS token is passed to your application by using the Credentials parameter in the context of Function Compute. The STS token is valid for 36 hours. You cannot change its validity period. The maximum execution time of a function is 24 hours. Therefore, you do not need to refresh the STS token because it does not expire when the function is executed. This method eliminates the risks that may arise when you manually maintain an AccessKey pair or an STS token. For more information about how to grant Function Compute the permissions to access Tablestore, see Grant Function Compute permissions to access other Alibaba Cloud services.

1. Use the Credentials parameter in the context of Function Compute to obtain temporary access credentials.

   # -*- coding: utf-8 -*-
   
   def handler(event, context):
       # Obtain the key information. Before you execute the function, make sure that a role is configured for the service to which the function belongs and that the role is granted the permissions to access Tablestore. We recommend that you use the AliyunFCDefaultRole role.
       creds = context.credentials
   
       access_key_id = creds.access_key_id
       access_key_secret = creds.access_key_secret
       security_token = creds.security_token
   
       # Perform the subsequent operations.
   
       return 'success'

Environment variables

1. Use the AccessKey pair to specify environment variables.

   Mac OS X, Linux, and Unix

   export OTS_AK_ENV=<OTS_AK_ENV>
   export OTS_SK_ENV=<OTS_SK_ENV>

   Windows

   Open Command Prompt and run the following commands as the administrator:

   setx OTS_AK_ENV <OTS_AK_ENV> /m
   setx OTS_SK_ENV <OTS_SK_ENV> /m

   Note

   After you specify the environment variables, you may need to restart the relevant services or development tools such as IDE to ensure that the new settings are applied as expected.

2. Use environment variables to pass credentials.

   # -*- coding: utf-8 -*-
   import os
   
   access_key_id = os.getenv("OTS_AK_ENV")
   access_key_secret = os.getenv("OTS_SK_ENV")

Static credentials

You can reference credentials by specifying variables in your code. In a runtime environment, the variables are passed by actual credential values from environment variables, configuration files, or other external data sources.

The following procedure describes how to use a configuration file to pass credentials.

1. Create a configuration file named config.ini.

   [configName]
   OTS_AK_ENV = <OTS_AK_ENV>
   OTS_SK_ENV = <OTS_SK_ENV>

2. Use the configuration file to pass credentials.

   # -*- coding: utf-8 -*-
   import configparser
   
   # Read the configuration file.
   config = configparser.ConfigParser()
   # For example, the config.ini configuration file is stored in the same directory as the script.
   config.read('config.ini')
   
   # Obtain the AccessKey ID and AccessKey secret from the configuration file.
   access_key_id = config.get('configName', 'OTS_AK_ENV')
   access_key_secret = config.get('configName', 'OTS_SK_ENV')