Resource Access Management:Best practices for using an access credential to call API operations

Assume a RAM role by using an application that is deployed in an ACK cluster

Prerequisites

• An Alibaba Cloud service that works with RAM is used. For more information, see Services that work with RAM.

• The RRSA feature supports only ACK clusters that run Kubernetes 1.22 and later. ACK clusters that support the RRSA feature include ACK Basic clusters, ACK Pro clusters, ACK Serverless Basic clusters, and ACK Serverless Pro clusters.

• Alibaba Cloud SDK V2.0 is installed.

• The self-developed SDKs of services that use self-managed gateways are not installed.

Working principles

You can use the RRSA feature to allow different applications in an ACK cluster to assume different RAM roles. Applications can obtain STS tokens, use the tokens to assume specific RAM roles, and then access relevant cloud services. This enforces the principle of least privilege and allows applications to call API operations without the need to use AccessKey pairs, which prevents AccessKey pair leaks.

Configuration methods

• Enable the RRSA feature for an ACK cluster. For more information, see Enable RRSA.

• Use the RRSA feature in an ACK cluster. For more information, see Work with RRSA.

Sample code

Alibaba Cloud SDK V2.0 supports OIDC token authentication of RRSA. By default, all cloud service SDKs that support STS token authentication and are developed based on Alibaba Cloud SDK V2.0 support RRSA OIDC token authentication. The following table describes the supported SDK versions and demos.

Assume an instance RAM role in ECS

Prerequisites

• An Alibaba Cloud service that works with RAM is used. For more information, see Services that work with RAM.

• Alibaba Cloud SDK V2.0 is installed.

• The self-developed SDKs of services that use self-managed gateways are not installed.

Working principles

You can attach an instance Resource Access Management (RAM) role to an Elastic Compute Service (ECS) instance. Then, the ECS instance can use the Security Token Service (STS) temporary credential of the instance RAM role to access the APIs of other Alibaba Cloud services. The STS temporary credential is updated on a periodic basis. This ensures the security of your AccessKey pair and implements fine-grained access control and permissions management by using RAM.

The following list describes the process:

1. An application accesses ECS instance metadata to obtain an STS token. For more information, see Overview of ECS instance metadata.

2. The application uses the STS token to access cloud resources. For more information, see What is STS?

Configuration method

Attach an instance RAM role to an ECS instance. For more information, see Grant ECS access to other Alibaba Cloud services by using instance RAM roles.

Sample code

Alibaba Cloud Credentials is a credential management tool provided by Alibaba Cloud for developers. You can use Alibaba Cloud Credentials to attach an instance RAM role to an ECS instance in a convenient manner. The following sample code provides an example on how to call the DescribeRegions operation of ECS.

Use an STS token for development and debugging

Scenario

If the R&D, O&M, and product personnel of an enterprise want to use an AccessKey pair for O&M, management, and debugging, we recommend that you implement role-based single sign on (SSO). This way, users of your enterprise can assume a corresponding RAM role and obtain the STS token to perform the required operations.

Configuration methods

• If a single Alibaba Cloud account is used, we recommend that you assign RAM roles to users by job responsibility. For more information, see Overview. The users can use the CLI tool saml2alibabacloud to obtain the STS token after authentication on the identity provider (IdP) side. For more information, see saml2alibabacloud.

• If multiple Alibaba Cloud accounts are used, we recommend that you use CloudSSO to configure SSO for the accounts. For more information, see Configure SSO. After the configuration is complete, users can use CLI to log on to CloudSSO and access Alibaba Cloud resources. For more information, see Use Alibaba Cloud CLI to access CloudSSO and Alibaba Cloud resources.

Use an STS token in Function Compute

Scenario

If your application deployed on Function Compute needs to access other Alibaba Cloud resources and you hardcode the AccessKey pair of a RAM user in related functions, AccessKey pair leaks may occur, and O&M is difficult. In this case, you can attach RAM roles to the functions. This way, the application can use STS tokens to access cloud resources, and security risks from permanent access credentials are prevented.

Solution architecture

In the solution, function RAM roles in Function Compute are used to obtain and use temporary access credentials. The solution allows you to dynamically manage and temporarily grant access permissions. This prevents risks that are caused by long-term AccessKey pair exposure, and makes the system more secure and flexible. The administrator only needs to configure roles for functions and grant permissions to the roles one time. In subsequent operations, functions can dynamically obtain and use temporary access credentials in runtime. This simplifies O&M management.

The administrator creates a RAM role whose trusted entity is Function Compute and grants permissions to the RAM role. The permissions include the permissions that are required to access a specific cloud resource of a cloud service. Then, the administrator associates the created RAM role with a function in Function Compute. When your application attempts to obtain the temporary access credential from the function context, Function Compute calls the AssumeRole operation as a trusted Alibaba Cloud service to obtain the STS token from RAM or STS . Then, your application can use the obtained STS token to call an API operation of the cloud service. After the cloud service processes the request and returns the result, your application receives the result and performs subsequent operations.

Configuration method

For more information, see Grant Function Compute permissions to access other Alibaba Cloud services.

Configure system environment variables

Configuration method

Configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables.

• Linux and macOS

  Run the following commands:

  export ALIBABA_CLOUD_ACCESS_KEY_ID=<access_key_id>
  export ALIBABA_CLOUD_ACCESS_KEY_SECRET=<access_key_secret>

  Replace <access_key_id> with your AccessKey ID and <access_key_secret> with your AccessKey secret.

• Windows

  1. Create an environment variable file, add the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to the file, and then specify your AccessKey ID for ALIBABA_CLOUD_ACCESS_KEY_ID and your AccessKey secret for ALIBABA_CLOUD_ACCESS_KEY_SECRET.

  2. Restart the Windows operating system.

Sample code of Alibaba Cloud SDKs

Alibaba Cloud SDKs allow you to configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to create a default access credential. When you call an API operation, the system reads the AccessKey pair from the default access credential and uses the AccessKey pair to complete authentication. The following sample code provides an example on how to call the DescribeRegions operation of ECS.

Common sample code

For self-developed SDKs of services that use self-managed gateways, the following sample code provides an example on how to load environment variables by using Java:

import com.aliyun.credentials.Client;
import com.aliyun.credentials.models.Config;

public class DemoTest {
    public static void main(String[] args) throws Exception{
        Config config = new Config();
        // Which type of credential you want
        config.setType("access_key");
        // AccessKeyId of your ram user
        config.setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"));
        // AccessKeySecret of your ram user
        config.setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
        Client client = new Client(config);
    }
}