Manage access credentials

Prerequisites

• The Credentials tool requires Python 3.7 or later. For more information, see Alibaba Cloud SDK maintenance policy.

• Use a V2.0 Alibaba Cloud SDK. For more information, see V2.0 SDK and V1.0 SDK.

Install the Credentials tool

We recommend that you use pip to install the Credentials tool:

pip install alibabacloud_credentials

To check the latest version of the alibabacloud_credentials library, see the alibabacloud-credentials package page on PyPI or the change log on GitHub. Use the latest version to ensure that all features are supported.

Credential types and parameters

The Config class in the alibabacloud_credentials.models module defines the credential types that the Credentials tool supports and the configuration parameters of each type. The type parameter specifies the credential type, and each credential type requires a different set of configuration parameters. In the following table, each column corresponds to a valid value of type, and each row corresponds to a configuration parameter. Supported indicates a required parameter, - indicates an optional parameter, and Unsupported indicates that the parameter is not supported.

We recommend that you use only the credential types and parameters that are listed in the following table.

Method 1: Default credential chain

If you use the Credentials tool without passing any configuration parameters, the tool retrieves credentials from the default credential chain. Before you use this method, make sure that the runtime environment of your application is configured with one of the credential sources that the default credential chain supports.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
# If no configuration parameter is specified, credentials are retrieved from the default credential chain.
credentialsClient = CredentialClient()
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# Use config to initialize the client of the cloud service. For more information, see the SDK documentation of each cloud service.

Method 2: AccessKey pair

The Credentials tool uses the AccessKey you provide as the access credential.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='access_key',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET')
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# Then, use config to initialize the client of the corresponding cloud service.

Method 3: STS token

The Credentials tool uses the static STS token you provide as the access credential.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='sts',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET'),
    # Required. In this example, the temporary security token is retrieved from an environment variable.
    security_token=os.environ.get('ALIBABA_CLOUD_SECURITY_TOKEN')
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

Method 4: AccessKey pair and RAM role ARN

The Credentials tool uses the AccessKey pair and the RAM role ARN that you provide to call AssumeRole and obtain an STS token. The tool then uses the STS token as the access credential. Credentials obtained in this way support automatic refresh. For more information, see Automatic refresh mechanism of session credentials.

import os
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='ram_role_arn',
    # Required. In this example, the AccessKey ID is retrieved from an environment variable.
    access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
    # Required. In this example, the AccessKey secret is retrieved from an environment variable.
    access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET'),
    # Required. The ARN of the RAM role to assume. Example: acs:ram::123456789012****:role/adminrole. You can also use the ALIBABA_CLOUD_ROLE_ARN environment variable to set this parameter.
    role_arn='<role_arn>',
    # Optional. The role session name. You can also use the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable to set this parameter.
    role_session_name='<role_session_name>',
    # Optional. A more restrictive policy. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
    policy='<policy>',
    # Optional. The external ID of the role, which is mainly used to prevent the confused deputy problem.
    external_id='<external_id>',
    # Optional. The session expiration time. Default value: 3600 seconds.
    role_session_expiration=3600
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

Method 5: ECS instance RAM role

If your application runs on an Elastic Compute Service (ECS) or Elastic Container Instance (ECI) instance that has a RAM role attached, the Credentials tool can obtain the STS token of the RAM role from the instance metadata and use the token as the access credential. Credentials obtained in this way support automatic refresh. For more information, see Automatic refresh mechanism of session credentials.

By default, the Credentials tool uses the security hardening mode (IMDSv2) to access ECS instance metadata. If an error occurs in the security hardening mode, use the disable_imds_v1 parameter or the ALIBABA_CLOUD_IMDSV1_DISABLED environment variable to control how the tool handles the error:

• If the value is False, which is the default value, the Credentials tool tries to switch to the normal mode (IMDSv1) to continue obtaining credentials.

• If the value is True, the Credentials tool obtains credentials only in the security hardening mode. If access in the security hardening mode fails, an exception is thrown.

  Whether an instance supports the security hardening mode depends on how the instance is configured.

You can also set the ALIBABA_CLOUD_ECS_METADATA_DISABLED=true environment variable to prevent the Credentials tool from obtaining credentials from the instance metadata.

• For more information about instance metadata, see Instance metadata.

• For more information about how to attach a RAM role to an ECS or ECI instance, see Step 1: Create a RAM role and Attach an instance RAM role to an ECI instance.

• To obtain temporary identity credentials in the security hardening mode, use alibabacloud_credentials 0.3.6 or later.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='ecs_ram_role',
    # Optional. The name of the ECS role. If you leave this parameter empty, the name is obtained automatically. We recommend that you specify the name to reduce the number of requests. You can also use the ALIBABA_CLOUD_ECS_METADATA environment variable to set this parameter.
    role_name='<role_name>',
    # Optional. Default value: False. True: credentials are obtained only in the security hardening mode (IMDSv2), and an exception is thrown if access fails, so set True only for instances that support the security hardening mode. False: the tool first tries to obtain credentials in the security hardening mode. If the attempt fails, the tool switches to the normal mode (IMDSv1).
    disable_imds_v1=True
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

Method 6: OIDC role ARN

If you use the OIDC authentication protocol and have created a RAM role for an OIDC identity provider, you can pass the ARN of the OIDC IdP, the OIDC token, and the RAM role ARN to the Credentials tool. The tool automatically calls the AssumeRoleWithOIDC operation of STS to obtain the STS token of the RAM role and uses the STS token as the access credential. Credentials obtained in this way support automatic refresh. For more information, see Automatic refresh mechanism of session credentials.

For example, if your application runs in a Container Service for Kubernetes (ACK) cluster that has RRSA enabled, the Credentials tool reads the OIDC configuration from the pod environment variables and calls the AssumeRoleWithOIDC operation to obtain the STS token of the service role. Your application then uses the STS token to access Alibaba Cloud services.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='oidc_role_arn',
    # Required. The RAM role ARN. You can also use the ALIBABA_CLOUD_ROLE_ARN environment variable to set this parameter.
    role_arn='<role_arn>',
    # Required. The ARN of the OIDC IdP. You can also use the ALIBABA_CLOUD_OIDC_PROVIDER_ARN environment variable to set this parameter.
    oidc_provider_arn='<oidc_provider_arn>',
    # Required. The path to the OIDC token file. You can also use the ALIBABA_CLOUD_OIDC_TOKEN_FILE environment variable to set this parameter.
    oidc_token_file_path='<oidc_token_file_path>',
    # Optional. The role session name. You can also use the ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable to set this parameter.
    role_session_name='<role_session_name>',
    # Optional. A more restrictive policy. Example: {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}
    policy='<policy>',
    # Optional. The session expiration time. Default value: 3600 seconds.
    role_session_expiration=3600
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

Method 7: URI credentials

You can encapsulate the STS service and expose a URI so that external services can obtain an STS token through the URI. This approach reduces the risk of exposing sensitive information such as an AccessKey pair. The Credentials tool accesses the URI that you provide to obtain an STS token and uses the token as the access credential. Credentials obtained in this way support automatic refresh. For more information, see Automatic refresh mechanism of session credentials.

The URI must meet the following conditions:

• GET requests are supported.

• The response status code is 200.

• The response body has the following structure:

{
  "Code": "Success",
  "AccessKeySecret": "yourAccessKeySecret",
  "AccessKeyId": "STS.****************",
  "Expiration": "2021-09-26T03:46:38Z",
  "SecurityToken": "yourSecurityToken"
}

The following example shows how to obtain credentials from a URI:

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='credentials_uri',
    # Required. The URI from which the credentials are obtained. The format is http://local_or_remote_uri/. You can also use the ALIBABA_CLOUD_CREDENTIALS_URI environment variable to set this parameter.
    credentials_uri='<credentials_uri>',
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use a V2.0 SDK for a cloud service, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

Method 8: Bearer token

Currently, only Alibaba Cloud Call Center (CCC) supports bearer token authentication.

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
credentialsConfig = CredentialConfig(
    type='bearer',
    # Required. Enter your bearer token.
    bearer_token='<BearerToken>',
)
credentialsClient = CredentialClient(credentialsConfig)
credential = credentialsClient.get_credential()
access_key_id = credential.get_access_key_id()
access_key_secret = credential.get_access_key_secret()
security_token = credential.get_security_token()
# When you use the CCC V2.0 SDK, pass the credential by using the Config class of the alibabacloud_tea_openapi.models module.
config = open_api_models.Config(
    credential=credentialsClient,
    endpoint='<endpoint>'
)
# The code that uses config to initialize the client of the cloud service is omitted.

Default credential provider chain

The default credential provider chain is a fallback mechanism that searches for a credential by checking a predefined sequence of locations. The search continues until a credential is found. If no credential is found after checking all locations, a CredentialException is thrown. The search order is as follows:

{
  "current": "<PROFILE_NAME>",
  "profiles": [
    {
      "name": "<PROFILE_NAME>",
      "mode": "AK",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
    },
    {
      "name": "<PROFILE_NAME1>",
      "mode": "StsToken",
      "access_key_id": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "sts_token": "<SECURITY_TOKEN>"
    },
    {
      "name":"<PROFILE_NAME2>",
      "mode":"RamRoleArn",
      "access_key_id":"<ALIBABA_CLOUD_ACCESS_KEY_ID>",
      "access_key_secret":"<ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME3>",
      "mode":"EcsRamRole",
      "ram_role_name":"<RAM_ROLE_ARN>"
    },
    {
      "name":"<PROFILE_NAME4>",
      "mode":"OIDC",
      "oidc_provider_arn":"<OIDC_PROVIDER_ARN>",
      "oidc_token_file":"<OIDC_TOKEN_FILE>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    },
    {
      "name":"<PROFILE_NAME5>",
      "mode":"ChainableRamRoleArn",
      "source_profile":"<PROFILE_NAME>",
      "ram_role_arn":"<ROLE_ARN>",
      "ram_session_name":"<ROLE_SESSION_NAME>",
      "expired_seconds":3600
    }
  ]
}

Automatic refresh mechanism of session credentials

import os
import sys
import time
import threading
from functools import wraps
from threading import Lock
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_ecs20140526.client import Client
from alibabacloud_ecs20140526.models import DescribeRegionsRequest
from alibabacloud_tea_openapi.models import Config as EcsConfig
#
# Thread-safe singleton decorator.
#
def singleton(cls):
    """Implements a thread-safe singleton pattern."""
    instances = {}
    lock = Lock()
    @wraps(cls)
    def wrapper(*args, **kwargs):
        with lock:
            if cls not in instances:
                instances[cls] = cls(*args, **kwargs)
        return instances[cls]
    return wrapper
#
# Singleton service class.
#
@singleton
class Credential:
    def __init__(self):
        self._client = self._init_client()
    @staticmethod
    def _init_client() -> CredentialClient:
        try:
            config = CredentialConfig(
                type="ram_role_arn",
                access_key_id=os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"),
                access_key_secret=os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"),
                role_arn=os.getenv("ALIBABA_CLOUD_ROLE_ARN"),
                role_session_name="RamRoleArnTest",
                role_session_expiration=3600,
            )
            return CredentialClient(config)
        except Exception as e:
            raise RuntimeError(f"Credential initialization failed: {e}") from e
    @property
    def client(self) -> CredentialClient:
        return self._client
@singleton
class EcsClient:
    def __init__(self, credential: CredentialClient):
        self._client = self._init_client(credential)
    @staticmethod
    def _init_client(credential: CredentialClient) -> Client:
        try:
            ecs_config = EcsConfig(credential=credential)
            ecs_config.endpoint = 'ecs.cn-hangzhou.aliyuncs.com'
            return Client(ecs_config)
        except Exception as e:
            raise RuntimeError(f"ECS client initialization failed: {e}") from e
    @property
    def client(self) -> Client:
        return self._client
#
# Task function.
#
def execute_task():
    try:
        # Obtain the credential and the ECS client.
        credential = Credential().client.get_credential()
        ecs_client = EcsClient(Credential().client).client
        # Print the credential information.
        print("Time:", time.strftime("%Y-%m-%d %H:%M:%S"))
        print("AK ID:", credential.access_key_id)
        print("AK Secret:", credential.access_key_secret)
        print("STS Token:", credential.security_token)
        # Call an API operation to query the region list.
        request = DescribeRegionsRequest()
        response = ecs_client.describe_regions(request)
        print("Invoke result:", response.to_map()["statusCode"])
    except Exception as e:
        print(f"ECS client execution failed: {e}")
        raise
def schedule_task():
    def run_execute_task():
        try:
            execute_task()
        except Exception as e:
            print(f"Task execution failed: {e}")
        finally:
            nonlocal task_count
            task_count += 1
            if task_count == len(DELAYS):
                print("All tasks completed. Exiting program.")
                sys.exit(0)
    def schedule_execution(delay):
        task_timer = threading.Timer(delay, run_execute_task)
        task_timer.start()
        return task_timer
    # Define the delays of the scheduled tasks.
    DELAYS = [0, 600, 4200, 4300]
    task_count = 0
    timers = [schedule_execution(delay) for delay in DELAYS]
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        print("Program interrupted by user.")
        for timer in timers:
            timer.cancel()
if __name__ == "__main__":
    schedule_task()

Time: 2025-05-28 14:51:51
AK ID: STS.NXC2_xxx_3e8nhx6
AK Secret: 89HQ_xxx_3pVFMsJzbStqUQn
STS Token: CAISxAJ1q6Ft5B2yfSjIr5v2ed2M3uhT3JKAb3b9h3AdS+oUga3T1Dz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtilmAGIpbng4YfgbiJREKxaXeiru_xxx_3XUiTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_+UxM3D2hT+Bi3HLQztRLNaRsQdpz0agA6vG9rqhiMsdPZDiIoh5FHnB/fZ
 +F9ol26SXsmquJdjfFgX9FFPVOqvnsHYRXUS2abqNKD_xxx_1GzLDX26i+hM2jxG6CFc9BJ3S5iElyLCAA
Invoke result: 200
Time: 2025-05-28 15:01:51
AK ID: STS.NXC2_xxx_3e8nhx6
AK Secret: 89HQ_xxx_3pVFMsJzbStqUQn
STS Token: CAISxAJ1q6Ft5B2yfSjIr5v2ed2M3uhT3JKAb3b9h3AdS+oUga3T1Dz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtilmAGIpbng4YfgbiJREKxaXeiru_xxx_3XUiTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_+UxM3D2hT+Bi3HLQztRLNaRsQdpz0agA6vG9rqhiMsdPZDiIoh5FHnB/fZ
 +F9ol26SXsmquJdjfFgX9FFPVOqvnsHYRXUS2abqNKD_xxx_1GzLDX26i+hM2jxG6CFc9BJ3S5iElyLCAA
Invoke result: 200
Time: 2025-05-28 16:01:53
AK ID: STS.NVw9_xxx_QZ3M4mu
AK Secret: 2mP6_xxx_Xvp38ai4mJTazm
STS Token: CAISxAJ1q6Ft5B2yfSjIr5XCctz4vp1A9qmocRChqE4hXdUfovH6Lzz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtoxWAYIpbng4YfgbiJREKxaXeiru_xxx_iTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_xM3D2hT+Bi3HLQztXxScP8Qdpz0agAG61LMbLwCjTNi3juW48l
 +/w3E16v00Wet2c9vr1Ftp3qaJ8zuQJIMgixWIvAXa4_xxx_eAMf+DaoEa0gUg1lQ7096D76vMDDr1eTiiAA
Invoke result: 200
Time: 2025-05-28 16:03:31
AK ID: STS.NVw9_xxx_QZ3M4mu
AK Secret: 2mP6_xxx_Xvp38ai4mJTazm
STS Token: CAISxAJ1q6Ft5B2yfSjIr5XCctz4vp1A9qmocRChqE4hXdUfovH6Lzz2IHhMeXZoA+4YsPw2mmFW6/sdLqdJQpp
 /QkjJRNF20pLM7VtoxWAYIpbng4YfgbiJREKxaXeiru_xxx_iTnmW3NFkFlyGEe4CFdkf3jm5bHu0WB0gCkK7FO/trLT8L6P5U2DvBWSMyo2eF6TK3F3RNL5gJCnKUM1/Qcp6if5I
 /DXQEIvUTYbreL6L9mNxRkY6UgHKpJvCxxBmi0fUW5f_xxx_xM3D2hT+Bi3HLQztXxScP8Qdpz0agAG61LMbLwCjTNi3juW48l
 +/w3E16v00Wet2c9vr1Ftp3qaJ8zuQJIMgixWIvAXa4_xxx_eAMf+DaoEa0gUg1lQ7096D76vMDDr1eTiiAA
Invoke result: 200

Related documents

• For an overview of the basic concepts of RAM, see Basic concepts.

• To create an AccessKey, see Create an AccessKey.

• To programmatically create RAM users, AccessKeys, and RAM roles; define permission policies; and grant permissions, see RAM SDK overview.

• To programmatically assume a role, see STS SDK overview.

• For details about the RAM and STS APIs, see the API reference.

• Best practices for using access credentials to call Alibaba Cloud OpenAPI

• What to do if an AccessKey is compromised