Tablestore:Configure access credentials

Configure STS temporary access credentials

If you need to access Tablestore within a specified period of time, you can obtain an STS temporary access credential through the STS service. Temporary access credentials do not require revealing your RAM user key, making access to Tablestore more secure.

1. Create a RAM user. For detailed instructions, see Create a RAM user.

2. Grant the RAM user the AliyunSTSAssumeRoleAccess permission. For specific instructions, see how to grant permissions to a RAM user.

3. Create a RAM role and attach a custom policy to it. For specific instructions, see Create a RAM role and Attach a custom policy to a RAM role.

4. Utilize the RAM user to assume the RAM role and retrieve the STS temporary access credentials. For detailed instructions, see Obtain STS temporary access credentials.

5. Configure STS temporary access credentials.

   Environment variables

   1. Use temporary access credentials to specify environment variables.

      Mac OS X/Linux/Unix

      # Specify the temporary access credentials STS AccessKey ID
      export TABLESTORE_ACCESS_KEY_ID=your_sts_access_key_id
      # Specify the temporary access credentials STS AccessKey Secret
      export TABLESTORE_ACCESS_KEY_SECRET=your_sts_access_key_secret
      # Specify the temporary access credentials STS Token
      export TABLESTORE_SESSION_TOKEN=your_sts_token

      Windows

      Run the Command Prompt as an administrator and execute the following commands.

      # Specify the temporary access credentials STS AccessKey ID
      setx TABLESTORE_ACCESS_KEY_ID your_sts_access_key_id /m
      # Specify the temporary access credentials STS AccessKey Secret
      setx TABLESTORE_ACCESS_KEY_SECRET your_sts_access_key_secret /m
      # Specify the temporary access credentials STS Token
      setx TABLESTORE_SESSION_TOKEN your_sts_token /m

      Note

      After configuring the environment variables, you may need to restart the relevant services or development tools such as Integrated Development Environment (IDE) to ensure that the new settings are applied as expected.

   2. Pass credentials by using environment variables.

      # -*- coding: utf-8 -*-
      import os
      
      access_key_id = os.getenv("TABLESTORE_ACCESS_KEY_ID")
      access_key_secret = os.getenv("TABLESTORE_ACCESS_KEY_SECRET")
      sts_token = os.getenv("TABLESTORE_SESSION_TOKEN")

   Static credentials

   You can define credentials by using variables in your code. During code execution, these variables are populated with actual credential values sourced from environment variables, configuration files, or other external locations.

   The following procedure describes how to use a configuration file to provide credentials.

   1. Create a configuration file config.ini.

      [configName]
      TABLESTORE_ACCESS_KEY_ID = your_sts_access_key_id
      TABLESTORE_ACCESS_KEY_SECRET = your_sts_access_key_secret
      TABLESTORE_SESSION_TOKEN = your_sts_token

   2. Pass credential information by using the configuration file.

      # -*- coding: utf-8 -*-
      import configparser
      
      # Read configuration files
      config = configparser.ConfigParser()
      # Assume config.ini is in the same directory as the script
      config.read('config.ini')
      
      # Obtain the Access Key ID and Access Key Secret from the configuration file
      access_key_id = config.get('configName', 'TABLESTORE_ACCESS_KEY_ID')
      access_key_secret = config.get('configName', 'TABLESTORE_ACCESS_KEY_SECRET')
      security_token = config.get('configName', 'TABLESTORE_SESSION_TOKEN')

Use credentials in the Function Compute context

If your application's function is deployed and running in Function Compute, you can use credentials in the function compute context to obtain temporary access credentials.

This approach leverages an STS token to authorize Function Compute by assuming a server role specified for the function. The STS token, which remains valid for 36 hours, is then provided to your application via the credentials parameter in the context. Since the maximum execution time for a function is 24 hours, there is no need to refresh the security token during execution as it will not expire. This method mitigates the risks associated with manually managing an AccessKey pair or security token. For more information on how to grant Function Compute permissions to access Tablestore, see Grant Function Compute permissions to access other cloud services.

1. Use credentials in the function compute context to obtain temporary access credentials.

   # -*- coding: utf-8 -*-
   
   def handler(event, context):
       # Obtain key information. Before execution, ensure that the service to which the function belongs is configured with role information, and the role must have Tablestore permissions. It is recommended to directly use the AliyunFCDefaultRole role
       creds = context.credentials
   
       access_key_id = creds.access_key_id
       access_key_secret = creds.access_key_secret
       security_token = creds.security_token
   
       # Subsequent operations...
   
       return 'success'

Environment variables

1. Configure environment variables for an AccessKey pair.

   Mac OS X/Linux/Unix

   # Specify AccessKey ID
   export TABLESTORE_ACCESS_KEY_ID=your_access_key_id
   # Specify AccessKey Secret
   export TABLESTORE_ACCESS_KEY_SECRET=your_access_key_secret

   Windows

   Run the Command Prompt as an administrator and execute the following commands.

   # Specify AccessKey ID
   setx TABLESTORE_ACCESS_KEY_ID your_access_key_id /m
   # Specify AccessKey Secret
   setx TABLESTORE_ACCESS_KEY_SECRET your_access_key_secret /m

   Note

   After configuring the environment variables, you may need to restart the relevant services or development tools such as IDE to ensure that the new settings are applied as expected.

2. Pass credentials by using environment variables.

   # -*- coding: utf-8 -*-
   import os
   
   access_key_id = os.getenv("TABLESTORE_ACCESS_KEY_ID")
   access_key_secret = os.getenv("TABLESTORE_ACCESS_KEY_SECRET")

Static credentials

You can define credentials by using variables in your code. During code execution, these variables are populated with actual credential values sourced from environment variables, configuration files, or other external locations.

The following procedure describes how to use a configuration file to provide credentials.

1. Create a configuration file config.ini.

   [configName]
   TABLESTORE_ACCESS_KEY_ID = your_access_key_id
   TABLESTORE_ACCESS_KEY_SECRET = your_access_key_secret

2. Pass credential information by using the configuration file.

   # -*- coding: utf-8 -*-
   import configparser
   
   # Read configuration files
   config = configparser.ConfigParser()
   # Assume config.ini is in the same directory as the script
   config.read('config.ini')
   
   # Obtain the Access Key ID and Access Key Secret from the configuration file
   access_key_id = config.get('configName', 'TABLESTORE_ACCESS_KEY_ID')
   access_key_secret = config.get('configName', 'TABLESTORE_ACCESS_KEY_SECRET')