cloud-idaas-akless-alibabacloud-adapter

简体中文 | English

Python SDK for IDaaS (Identity as a Service) AKless Adapter — Enables AK-free authentication for Alibaba Cloud services using IDaaS PAM (Privileged Access Management) to obtain STS temporary credentials.

Features

• AK-free Authentication: Eliminates the need for long-term AccessKey, uses OIDC Token to obtain STS temporary credentials via IDaaS PAM, reducing the risk of credential leakage
• Multi-SDK Adaptation: Provides credential provider adapters for multiple Alibaba Cloud SDKs, including OSS V1, OSS V2, and SLS
• Automatic Credential Refresh: Built-in credential caching and automatic refresh based on expiration time, ensuring seamless credential rotation
• Simple Integration: Factory class provides one-line creation of credential providers, minimizing integration effort

Requirements

• Python >= 3.9
• Dependencies:
  • cloud-idaas-core >= 0.0.5b0
  • alibabacloud-credentials >= 1.0.0
  • oss2 >= 2.18.0
  • alibabacloud-oss-v2 >= 1.0.0
  • aliyun-log-python-sdk >= 0.9.0

Installation

pip install cloud-idaas-akless-alibabacloud-adapter

Prerequisites

This SDK depends on cloud-idaas-core. You need to complete the IDaaS Core SDK initialization before using this adapter.

1. Install and configure cloud-idaas-core, refer to cloud-idaas-core README for details.

2. In the configuration file, set the scope to the IDaaS built-in scope for PAM:

   {
       "scope": "urn:cloud:idaas:pam|.all"
   }
   

3. Complete the IDaaS Core SDK initialization:

   from cloud_idaas.core import IDaaSCredentialProviderFactory
   
   IDaaSCredentialProviderFactory.init()
   

Quick Start

The simplest way to use this SDK is through the IDaaSPamAklessCredentialFactory factory class:

from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.alibabacloud.pam import IDaaSPamAklessCredentialFactory

# 1. Initialize IDaaS Core SDK
IDaaSCredentialProviderFactory.init()

# 2. Create an Alibaba Cloud credentials provider
credentials_provider = IDaaSPamAklessCredentialFactory.get_alibaba_cloud_credentials_provider(
    role_arn="acs:ram::123456789:role/your-role-name"
)

# 3. Get credentials
credentials = credentials_provider.get_credentials()
print(credentials.access_key_id)
print(credentials.access_key_secret)
print(credentials.security_token)

Note: The role_arn parameter can also be configured via the environment variable ALIBABA_CLOUD_ROLE_ARN.

Usage Examples

OSS V1 (oss2)

import oss2
from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.alibabacloud.pam import IDaaSPamAklessCredentialFactory

# Initialize
IDaaSCredentialProviderFactory.init()

# Create OSS V1 credentials provider
oss_v1_provider = IDaaSPamAklessCredentialFactory.get_oss_v1_credential_provider(
    role_arn="acs:ram::123456789:role/your-role-name"
)

# Use with OSS V1 SDK
auth = oss2.ProviderAuthV4(oss_v1_provider)
bucket = oss2.Bucket(auth, "https://oss-cn-hangzhou.aliyuncs.com", "your-bucket-name")

OSS V2 (alibabacloud-oss-v2)

import alibabacloud_oss_v2 as oss
from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.alibabacloud.pam import IDaaSPamAklessCredentialFactory

# Initialize
IDaaSCredentialProviderFactory.init()

# Create OSS V2 credentials provider
oss_v2_provider = IDaaSPamAklessCredentialFactory.get_oss_v2_credential_provider(
    role_arn="acs:ram::123456789:role/your-role-name"
)

# Use with OSS V2 SDK
cfg = oss.config.load_default()
cfg.credentials_provider = oss_v2_provider
cfg.region = "cn-hangzhou"
client = oss.Client(cfg)

SLS (aliyun-log-python-sdk)

from aliyun.log import LogClient
from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.alibabacloud.pam import IDaaSPamAklessCredentialFactory

# Initialize
IDaaSCredentialProviderFactory.init()

# Create SLS credentials provider
sls_provider = IDaaSPamAklessCredentialFactory.get_sls_credential_provider(
    role_arn="acs:ram::123456789:role/your-role-name"
)

# Use with SLS SDK
client = LogClient("cn-hangzhou.log.aliyuncs.com", credentials_provider=sls_provider)

API Reference

IDaaSPamAklessCredentialFactory

Factory class providing static methods to create credential providers.

IDaaSPamAlibabaCloudCredentialsProvider

Core credentials provider that obtains STS temporary credentials from PAM API using OIDC Token.

Environment Variables

Support and Feedback

• Email: cloudidaas@list.alibaba-inc.com
• Issues: Please submit an Issue for questions or suggestions

License

This project is licensed under the Apache License 2.0.