使用STS临时访问凭证访问OSS

Java

import com.aliyun.oss.*;
import com.aliyun.oss.common.auth.CredentialsProvider;
import com.aliyun.oss.common.auth.DefaultCredentialProvider;
import com.aliyun.oss.common.comm.SignVersion;
import com.aliyun.oss.model.PutObjectRequest;
import com.aliyun.oss.model.PutObjectResult;

import java.io.File;

public class Demo {

    public static void main(String[] args) throws Exception {
        // Enter the temporary AccessKey ID, AccessKey Secret, and security token generated in Step 1.5. Do not use the credentials of the RAM user.
        // Note that the AccessKey ID obtained from STS starts with "STS".
        String accessKeyId = "yourSTSAccessKeyID";
        String accessKeySecret = "yourSTSAccessKeySecret";
        // Enter the obtained STS security token.
        String stsToken= "yourSecurityToken";

        // Use the DefaultCredentialProvider method to directly set the AccessKey ID and AccessKey Secret.
        CredentialsProvider credentialsProvider = new DefaultCredentialProvider(accessKeyId, accessKeySecret, stsToken);
        // Use credentialsProvider to initialize the client.
        ClientBuilderConfiguration clientBuilderConfiguration = new ClientBuilderConfiguration();
        // Explicitly declare the use of the V4 signature algorithm.
        clientBuilderConfiguration.setSignatureVersion(SignVersion.V4);
        // Create an OSSClient instance.
        // When the OSSClient instance is no longer needed, call the shutdown method to release resources.
        OSS ossClient = OSSClientBuilder.create()
                 // Set the endpoint of the destination OSS. For example, for the China (Hangzhou) region: https://oss-cn-hangzhou.aliyuncs.com
                .endpoint("endpoint")
                .credentialsProvider(credentialsProvider)
                .clientConfiguration(clientBuilderConfiguration)
                // Set this to the region where the destination bucket is located. For example, for the China (Hangzhou) region: cn-hangzhou
                .region("region")
                .build();

        try {

            // Create a PutObjectRequest object to upload the local file exampletest.txt to examplebucket.
            PutObjectRequest putObjectRequest = new PutObjectRequest("examplebucket", "exampletest.txt", new File("D:\\localpath\\exampletest.txt"));

            // If you need to set the storage class and access permissions during the upload, see the following sample code.
            // ObjectMetadata metadata = new ObjectMetadata();
            // metadata.setHeader(OSSHeaders.OSS_STORAGE_CLASS, StorageClass.Standard.toString());
            // metadata.setObjectAcl(CannedAccessControlList.Private);
            // putObjectRequest.setMetadata(metadata);

            // Upload the file.
            PutObjectResult result = ossClient.putObject(putObjectRequest);
        } catch (OSSException oe) {
            System.out.println("Caught an OSSException, which means your request made it to OSS, "
                    + "but was rejected with an error response for some reason.");
            System.out.println("Error Message:" + oe.getErrorMessage());
            System.out.println("Error Code:" + oe.getErrorCode());
            System.out.println("Request ID:" + oe.getRequestId());
            System.out.println("Host ID:" + oe.getHostId());
        } catch (ClientException ce) {
            System.out.println("Caught an ClientException, which means the client encountered "
                    + "a serious internal problem while trying to communicate with OSS, "
                    + "such as not being able to access the network.");
            System.out.println("Error Message:" + ce.getMessage());
        } finally {
            if (ossClient != null) {
                ossClient.shutdown();
            }
        }
    }
}

Python

The Python SDK is available in V2 and V1. V2 is a complete refactor of V1. It simplifies underlying operations such as identity authentication, request retries, and error handling. It also provides more flexible parameter configurations and new advanced interfaces. See the following examples as needed.

import alibabacloud_oss_v2 as oss

def main():
    # Enter the temporary AccessKey ID, AccessKey Secret, and security token generated in Step 1.5. Do not use the credentials of the RAM user.
    # Note that the AccessKey ID obtained from STS starts with "STS".
    sts_access_key_id = 'yourSTSAccessKeyID'
    sts_access_key_secret = 'yourSTSAccessKeySecret'
    # Enter the obtained STS security token.
    sts_security_token = 'yourSecurityToken'
    
    # Create a static credentials provider and explicitly set the temporary AccessKey ID, AccessKey Secret, and STS security token.
    credentials_provider = oss.credentials.StaticCredentialsProvider(
        access_key_id=sts_access_key_id,
        access_key_secret=sts_access_key_secret,
        security_token=sts_security_token,
    )

    # Load the default SDK configuration and set the credentials provider.
    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider

    # Enter the region where the bucket is located. For example, for China (Hangzhou), set Region to cn-hangzhou.
    cfg.region = 'cn-hangzhou'

    # Create an OSS client with the specified configuration.
    client = oss.Client(cfg)

    # The path of the local file to upload. For example, D:\\localpath\\exampletest.txt.
    local_file_path = 'D:\\localpath\\exampletest.txt'
    with open(local_file_path, 'rb') as file:
        data = file.read()

    # Send a request to upload the object. This uploads the local file exampletest.txt to examplebucket. Specify the bucket name, object name, and the file to upload.
    result = client.put_object(oss.PutObjectRequest(
        # The bucket name.
        bucket='examplebucket',
        # The name of the object to be uploaded to the bucket.
        key='exampletest.txt',
        body=data,
    ))

     # Print the status code, request ID, content MD5, ETag, CRC64 checksum, and version ID of the request result to check whether the request was successful.
    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' content md5: {result.content_md5},'
          f' etag: {result.etag},'
          f' hash crc64: {result.hash_crc64},'
          f' version id: {result.version_id},'
    )


# Call the main function when this script is run directly.
if __name__ == "__main__":
    main()  # Script entry point. Calls the main function when the file is run directly.

# -*- coding: utf-8 -*-
import oss2

# Set yourEndpoint to the endpoint of the region where the bucket is located. For example, for China (Hangzhou), set the endpoint to https://oss-cn-hangzhou.aliyuncs.com.
endpoint = 'https://oss-cn-hangzhou.aliyuncs.com'
# Enter the temporary AccessKey ID and AccessKey Secret generated in Step 1.5. Do not use the AccessKey ID and AccessKey Secret of an Alibaba Cloud account.
sts_access_key_id = 'yourAccessKeyId'
sts_access_key_secret = 'yourAccessKeySecret'
# Enter the bucket name.
bucket_name = 'examplebucket'
# Enter the full path of the object and the content string. The full path cannot contain the bucket name. 
object_name = 'examplebt.txt'
# Enter the STS security token generated in Step 1.5.
security_token = 'yourSecurityToken'
# Use the authentication information in the temporary credentials to initialize an StsAuth instance.
auth = oss2.StsAuth(sts_access_key_id,
                    sts_access_key_secret,
                    security_token)
# Use the StsAuth instance to initialize the bucket.
bucket = oss2.Bucket(auth, endpoint, bucket_name)
# Upload the object.
result = bucket.put_object(object_name, "hello world")
print(result.status)

Go

The Go SDK is available in V2 and V1. V2 is a complete refactor of V1. It simplifies underlying operations such as identity authentication, request retries, and error handling. It also provides more flexible parameter configurations and new advanced interfaces. See the following examples as needed.

package main

import (
	"context"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
)

func main() {
	// Enter the region where the bucket is located. For example, for China (Hangzhou), set Region to cn-hangzhou.
	region := "cn-hangzhou"

	// Enter the temporary AccessKey ID, AccessKey Secret, and security token generated in Step 1.5. Do not use the credentials of the RAM user.
        // Note that the AccessKey ID obtained from STS starts with "STS".
	accessKeyID := "yourSTSAccessKeyID"
	accessKeySecret := "yourSTSAccessKeySecret"
	// Enter the obtained STS security token.
	stsToken := "yourSecurityToken"

	// Use the NewStaticCredentialsProvider method to directly set the AccessKey ID, AccessKey Secret, and STS token.
	provider := credentials.NewStaticCredentialsProvider(accessKeyID, accessKeySecret, stsToken)

	// Load the default configuration and set the credentials provider and region.
	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(provider).
		WithRegion(region)

	// Create an OSS client.
	client := oss.NewClient(cfg)

	// Enter the path and name of the local file to upload, for example, D:\\localpath\\exampletest.txt.
	localFile := "D:\\localpath\\exampletest.txt"

	// Create a request to upload the object.
	putRequest := &oss.PutObjectRequest{
		Bucket:       oss.Ptr("examplebucket"),      // The bucket name.
		Key:          oss.Ptr("exampletest.txt"),    // The name of the object to be uploaded to the bucket.
		StorageClass: oss.StorageClassStandard, // Specify the storage class of the object as Standard.
		Acl:          oss.ObjectACLPrivate,     // Specify the access control list (ACL) of the object as private.
		Metadata: map[string]string{
			"yourMetadataKey1": "yourMetadataValue1", // Set the metadata of the object.
		},
	}

	// Send a request to upload the object. This uploads the local file exampletest.txt to examplebucket.
	result, err := client.PutObjectFromFile(context.TODO(), putRequest, localFile)
	if err != nil {
		log.Fatalf("failed to put object from file %v", err)
	}

	// Print the result of the object upload.
	log.Printf("put object from file result:%#v\n", result)
	
}

package main

import (
    "fmt"
    "github.com/aliyun/aliyun-oss-go-sdk/oss"
    "os"
)

func main() {
    // Obtain the temporary credentials generated in Step 1.5 from environment variables. Before you run this sample code, make sure that the OSS_ACCESS_KEY_ID, OSS_ACCESS_KEY_SECRET, and OSS_SESSION_TOKEN environment variables are set.
    provider, err := oss.NewEnvironmentVariableCredentialsProvider()
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    // Create an OSSClient instance.
    // Set yourEndpoint to the endpoint of the bucket. For example, for China (Hangzhou), set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. For other regions, set the endpoint as needed.
    client, err := oss.New("yourEndpoint", "", "", oss.SetCredentialsProvider(&provider))
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    // Enter the bucket name, for example, examplebucket.
    bucketName := "examplebucket"
    // Enter the full path of the object. The full path cannot contain the bucket name. For example, exampledir/exampleobject.txt.
    objectName := "exampledir/exampleobject.txt"
    // Enter the full path of the local file, for example, D:\\localpath\\examplefile.txt.
    filepath := "D:\\localpath\\examplefile.txt"
    bucket, err := client.Bucket(bucketName)
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    // Use STS to authorize a third party to upload a file.
    err = bucket.PutObjectFromFile(objectName, filepath)
    if err != nil {
        fmt.Println("Error:", err)
        os.Exit(-1)
    }
    fmt.Println("upload success")
}

Node.js

const axios = require("axios");
const OSS = require("ali-oss");

// On the client, use temporary credentials to initialize the OSS client for temporary authorized access to OSS resources.
const getToken = async () => {
  // Set the address from which the client requests access credentials.
  await axios.get("http://localhost:8000/sts").then((token) => {
    const client = new OSS({
       // Set yourRegion to the region where the bucket is located. For example, for China (Hangzhou), set yourRegion to oss-cn-hangzhou.
      region: 'oss-cn-hangzhou',
      // Enter the temporary AccessKey ID and AccessKey Secret generated in Step 1.5. Do not use the AccessKey ID and AccessKey Secret of an Alibaba Cloud account.
      accessKeyId: token.data.AccessKeyId,
      accessKeySecret: token.data.AccessKeySecret,
      // Enter the STS security token generated in Step 1.5.
      stsToken: token.data.SecurityToken,
      authorizationV4: true,
      // Enter the bucket name.
      bucket: "examplebucket",
      // Refresh the temporary credentials.
      refreshSTSToken: async () => {
        const refreshToken = await axios.get("http://localhost:8000/sts");
        return {
          accessKeyId: refreshToken.data.AccessKeyId,
          accessKeySecret: refreshToken.data.AccessKeySecret,
          stsToken: refreshToken.data.SecurityToken,
        };
      },
    });
    // Use temporary credentials to upload the file.
    // Enter the full path of the object, excluding the bucket name. For example, exampleobject.jpg.
    // Enter the full path of the local file, for example, D:\\example.jpg.
    client.put('exampleobject.jpg', 'D:\\example.jpg').then((res)=>{console.log(res)}).catch(e=>console.log(e))
  });
};
getToken()

php

<?php
if (is_file(__DIR__ . 'autoload.php')) {
    require_once __DIR__ . 'autoload.php';
}
if (is_file(__DIR__ . '/vendor/autoload.php')) {
    require_once __DIR__ . '/vendor/autoload.php';
}

use OSS\Credentials\StaticCredentialsProvider;
use OSS\OssClient;
use OSS\Core\OssException;

try {
    // Enter the temporary AccessKey ID, AccessKey Secret, and security token generated in Step 1.5. Do not use the credentials of the RAM user.
    // Note that the AccessKey ID obtained from STS starts with "STS".
    $accessKeyId = 'yourSTSAccessKeyID';
    $accessKeySecret = 'yourSTSAccessKeySecret';
    // Enter the obtained STS security token.
    $securityToken = 'yourSecurityToken';

    // Use the StaticCredentialsProvider class to create a credentials provider.
    $provider = new StaticCredentialsProvider($accessKeyId, $accessKeySecret, $securityToken);

    // Set Endpoint to the endpoint of the region where the bucket is located. For example, for China (Hangzhou), set Endpoint to https://oss-cn-hangzhou.aliyuncs.com.
    $endpoint = "https://oss-cn-hangzhou.aliyuncs.com";

    // Enter the bucket name, for example, examplebucket.
    $bucket= "examplebucket";
    // Enter the name of the object to be uploaded to the bucket.
    $object = "exampletest.txt";
    // Enter the path of the local file to upload, for example, D:\\localpath\\exampletest.txt.
    $localFilePath = "D:\\localpath\\exampletest.txt";

    // You can set headers for the upload, such as setting the access permission to private and specifying custom metadata.
    $options = array(
        OssClient::OSS_HEADERS => array(
            'x-oss-object-acl' => 'private',
            'x-oss-meta-info' => 'yourinfo'
        ),
    );

    $config = array(
        "provider" => $provider,
        "endpoint" => $endpoint,
        "signatureVersion" => OssClient::OSS_SIGNATURE_VERSION_V4,
        // Enter the region where the bucket is located. For example, for China (Hangzhou), set Region to cn-hangzhou.
        "region" => "cn-hangzhou"
    );
    
    // Create an OSS client with the specified configuration.
    $ossClient = new OssClient($config);
    
     // Send a request to upload the local file exampletest.txt to examplebucket.
    $ossClient->putObject($bucket, $object, $localFilePath, $options);
} catch (OssException $e) {
    printf($e->getMessage() . "\n");
    return;
}

Ruby

require 'aliyun/sts'
require 'aliyun/oss'

client = Aliyun::OSS::Client.new(
  # For example, for China (Hangzhou), set the endpoint. For other regions, set the endpoint as needed.
  endpoint: 'https://oss-cn-hangzhou.aliyuncs.com',
  # Enter the temporary AccessKey ID and AccessKey Secret generated in Step 1.5. Do not use the AccessKey ID and AccessKey Secret of an Alibaba Cloud account.
  access_key_id: 'token.access_key_id',
  access_key_secret: 'token.access_key_secret',
  # Enter the STS security token generated in Step 1.5.
  sts_token: 'token.security_token'
  )
# Enter the bucket name, for example, examplebucket.
bucket = client.get_bucket('examplebucket')
# Upload the file.
bucket.put_object('exampleobject.txt', :file => 'D:\test.txt')