Call services with STS temporary credentials

To avoid the security risk of exposing a RAM user's AccessKey, create a RAM role and use temporary security credentials from STS to make API calls.

Procedure

1. Create a RAM user to use STS tokens and record the AccessKey ID and AccessKey Secret.

2. Create a RAM role .

3. Grant the RAM role the AliyunDocmindFullAccess and AliyunSTSAssumeRoleAccess system policies.

After you complete these steps, you can use the STS token to make API requests.

Obtain temporary credentials

Call the AssumeRole API to obtain temporary security credentials. These are returned in an AssumeRoleResponse object.

For parameter details, see AssumeRole.

Send API requests with an STS token

The following example shows how to call an API using the Java SDK:

public static void submit() throws Exception {
    Config config = new Config()
        // The AccessKey ID returned by AssumeRoleResponse
        .setAccessKeyId(accessKeyId)
        // The securityToken returned by AssumeRoleResponse
        .securityToken(securityToken)
        // The AccessKey Secret returned by AssumeRoleResponse
        .setAccessKeySecret(accessKeySecret);
    // The API endpoint. Both IPv4 and IPv6 are supported. For IPv6, use docmind-api-dualstack.cn-hangzhou.aliyuncs.com.
    config.endpoint = "docmind-api.cn-hangzhou.aliyuncs.com";
    Client client = new Client(config);
    // Create a RuntimeObject instance and set runtime parameters.
    RuntimeOptions runtime = new RuntimeOptions();
    // Replace the input parameters and method with those of your specific asynchronous task submission API. This example uses the document intelligence parsing API.
    SubmitDocStructureJobAdvanceRequest advanceRequest = new SubmitDocStructureJobAdvanceRequest();
    File file = new File("D:\\example.pdf");
    advanceRequest.fileUrlObject = new FileInputStream(file);
    advanceRequest.fileName = "example.pdf";
    // 4. Send the request and handle the response or exceptions.
    SubmitDocStructureJobResponse response = client.submitDocStructureJobAdvance(advanceRequest, runtime);
}

The procedure is similar for other APIs and SDKs. The main change is the client configuration: set the securityToken, accessKeyId, and accessKeySecret parameters with the values from the AssumeRoleResponse object.