Set up a direct upload service for mobile applications

1. Create a RAM user in RAM

First, create a RAM user and obtain the corresponding AccessKey pair as the long-term identity credential for the application on the application server.

1. Log on to the RAM console by using your Alibaba Cloud account or as an account administrator.

2. In the left-side navigation pane, choose Identity Management > Users.

3. Click Create User.

4. Enter a Logon Name and Display Name.

5. In the Access Mode section, select Use Permanent AccessKey, and then click OK.

6. Click Copy under Actions to save the AccessKey pair (AccessKey ID and AccessKey Secret).

2. Grant the RAM user the permission to call the AssumeRole operation

After you create a RAM user, you must grant the RAM user the permission to call the AssumeRole operation of STS so that the user can assume a RAM role to obtain temporary credentials.

1. In the left-side navigation pane, choose Identity Management > Users.

2. On the Users page, find the target RAM user and click Grant Permissions on the right side of the RAM user.

3. On the Grant Permission page, select the AliyunSTSAssumeRoleAccess system policy.

   Note

   The AliyunSTSAssumeRoleAccess policy is a fixed permission required for calling the AssumeRole operation. This policy is not related to the permissions required to obtain temporary credentials or to initiate OSS requests by using temporary credentials.

   Set the resource scope to Account Level, and then click Confirm New Authorization.

4. ClickOK.

3. Create a RAM role in RAM

Create a RAM role for the current Alibaba Cloud account and obtain the ARN of the role (Alibaba Cloud Resource Name) for the RAM user to assume later.

1. In the left-side navigation pane, choose Identity Management > Roles.

2. Click Create Role and set the trusted entity type to Cloud Account.

3. Select the current Alibaba Cloud account and click OK.

4. Enter the role name and click OK.

5. On the RAM role management page, click Copy to save the ARN of the role.

The ARN of the role is in the format of acs:ram::<accountId>:role/oss-web-upload, where accountId is the ID of the current Alibaba Cloud account.

4. Create a permission policy for file upload in RAM

Based on the principle of least privilege, create a custom permission policy for the RAM role to restrict uploads to the specified OSS bucket only.

1. In the left-side navigation pane, choose Permissions > Policies.

2. ClickCreate Policy.

3. On the Create Policy page, click JSON Editor and replace <Bucket name> in the following script with the bucket name web-direct-upload that you created in the prerequisites.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "oss:PutObject",
         "Resource": "acs:oss:*:*:<Bucket name>/*"
       }
     ]
   }

4. After the policy is configured, click Next to edit policy information.

5. In the Basic Information section, enter the policy name, and then click OK.

5. Grant permissions to the RAM role in RAM

Grant the custom permissions to the RAM role so that the RAM role can obtain the required permissions when it is assumed.

1. In the left-side navigation pane, choose Identity Management > RAM Role.

2. On the RAM Role page, find the target RAM role, and then click Grant Permission on the right side of the RAM role.

3. On the Grant Permission page, select Custom Policy and select the custom policy that you created.

   Set Resource Scope to Account Level, and select Custom Policy from the policy type drop-down list to filter.

4. ClickOK.

6. Create an ECS instance as the application server

Create an ECS instance as the application server to generate temporary credentials.

For detailed steps, see Purchase a Linux instance and set up a WordPress website from the console.

7. Obtain temporary credentials on the application server

In a web application, integrate STS SDK into the application server to implement an API for obtaining temporary STS credentials. When this API (/get_sts_token) is accessed by using the HTTP GET method, it generates temporary credentials and returns them to the requester.