Credential resolution order for toolkit-maven-plugin-Enterprise Distributed Application Service(EDAS)-阿里云帮助中心

To deploy applications with toolkit-maven-plugin, provide the AccessKey ID and AccessKey secret of your Alibaba Cloud account. The plug-in checks multiple credential sources in a fixed order. If credentials exist in more than one source, the higher-priority source wins.

Resolution order

The plug-in resolves credentials in the following order, from highest to lowest priority:

Priority	Method	Best for
1	Command-line parameters or pom.xml	Per-build overrides
2	Account file specified on the command line (recommended)	Local development
3	Default Alibaba Cloud account	Reusing existing CLI credentials or CI/CD pipelines

1. Command-line parameters or pom.xml

Pass the AccessKey ID and AccessKey secret directly. This method overrides all other credential sources.

Option A: Maven system properties

When you run Maven commands to build packages, use -D flags to specify the AccessKey ID and AccessKey secret:

-Daccess_key_id=<your-access-key-id> -Daccess_key_secret=<your-access-key-secret>

Option B: pom.xml plug-in configuration

Add the credentials to the plug-in <configuration> block:

<plugin>
   <groupId>com.alibaba.cloud</groupId>
   <artifactId>toolkit-maven-plugin</artifactId>
   <version>1.0.3</version>
   <configuration>
     <accessKeyId>abc</accessKeyId>
     <accessKeySecret>1234567890</accessKeySecret>
   </configuration>
</plugin>

Note: Hardcoding credentials in pom.xml risks exposing them through version control. For production builds, use an account file or environment variables instead.

2. Account file specified on the command line

Point the plug-in to a YAML credential file with the -Daccess_key_file flag. This method is recommended for local development because it keeps credentials out of project files.

When you run Maven commands to build packages, use -Daccess_key_file={Account file path} to specify the account file.

The YAML file uses the following format:

access_key_id: <your-access-key-id>
access_key_secret: <your-access-key-secret>

3. Default Alibaba Cloud account

If methods 1 and 2 provide no credentials, the plug-in uses the Alibaba Cloud account that you previously specified to deploy the application. The plug-in checks the following sources:

a. Latest Alibaba Cloud CLI (aliyuncli)

The latest Alibaba Cloud CLI stores credentials at ~/.aliyuncli/credentials.

Example path on macOS: /Users/jack/.aliyuncli/credentials

File format:

[default]
aliyun_access_key_secret = 1234567890
aliyun_access_key_id = abc

The plug-in uses the account that is specified by this account file to deploy the application.

b. Earlier Alibaba Cloud CLI (aliyun)

Earlier versions of the Alibaba Cloud CLI store credentials at ~/.aliyun/config.json.

Example path on macOS: /Users/jack/.aliyun/config.json

File format:

{
    "current": "",
    "profiles": [
        {
            "name": "default",
            "mode": "AK",
            "access_key_id": "",
            "access_key_secret": "",
            "sts_token": "",
            "ram_role_name": "",
            "ram_role_arn": "",
            "ram_session_name": "",
            "private_key": "",
            "key_pair_name": "",
            "expired_seconds": 0,
            "verified": "",
            "region_id": "",
            "output_format": "json",
            "language": "en",
            "site": "",
            "retry_timeout": 0,
            "retry_count": 0
        },
        {
            "name": "",
            "mode": "AK",
            "access_key_id": "abc",
            "access_key_secret": "xxx",
            "sts_token": "",
            "ram_role_name": "",
            "ram_role_arn": "",
            "ram_session_name": "",
            "private_key": "",
            "key_pair_name": "",
            "expired_seconds": 0,
            "verified": "",
            "region_id": "cn-hangzhou",
            "output_format": "json",
            "language": "en",
            "site": "",
            "retry_timeout": 0,
            "retry_count": 0
        }
    ],
    "meta_path": ""
}

c. System environment variables

If no CLI config file provides credentials, the plug-in retrieves the values of access_key_id and access_key_secret from system environment variables through System.getenv("access_key_id") and System.getenv("access_key_secret").

Set the variables in your shell:

export access_key_id=<your-access-key-id>
export access_key_secret=<your-access-key-secret>

Environment variables suit CI/CD pipelines and containerized deployments where credentials are injected at runtime.

Placeholder reference

Replace the following placeholders with your actual values:

Placeholder	Description	Example
`<your-access-key-id>`	AccessKey ID of your Alibaba Cloud account	`LTAI5tXxx`
`<your-access-key-secret>`	AccessKey secret of your Alibaba Cloud account	`xXxXxXx`