cloud-idaas-akless-tencent-adapter 0.0.1b0

Python SDK for IDaaS AKless Adapter — obtain STS temporary credentials through IDaaS PAM to access Tencent Cloud services without SecretKey

idaas-python-akless-tencent-adapter

English | 简体中文

Python SDK for the IDaaS (Identity as a Service) AKless Adapter — obtain STS temporary credentials through IDaaS PAM (Privileged Access Management) to access Tencent Cloud services without SecretKey.

Features

• AK-Free Authentication: No long-term SecretKey required. Uses OIDC Token to obtain STS temporary credentials via IDaaS PAM, reducing the risk of credential leakage
• Multi-SDK Adaptation: Provides credential provider adapters for multiple Tencent Cloud official SDKs, including Tencent Cloud SDK and COS SDK
• Auto Credential Refresh: Built-in credential caching and expiration-based auto-refresh mechanism to ensure seamless credential rotation
• Easy Integration: Factory class provides one-line credential provider creation, minimizing integration cost

Requirements

• Python >= 3.9
• Dependencies:
  • cloud-idaas-core >= 0.0.5-beta

Installation

pip install cloud-idaas-akless-tencent-adapter

Prerequisites

This SDK depends on cloud-idaas-core. You need to complete the IDaaS Core SDK initialization before using this adapter.

1. Install and configure cloud-idaas-core. See cloud-idaas-core README for details.

2. In the configuration file, set the scope to the IDaaS PAM built-in scope:

   {
       "scope": "urn:cloud:idaas:pam|cloud_account_role:obtain_access_credential"
   }
   

3. Complete the IDaaS Core SDK initialization:

   from cloud_idaas.core import IDaaSCredentialProviderFactory
   
   IDaaSCredentialProviderFactory.init()
   

Quick Start

The simplest way to use this SDK is through the IDaaSPamAklessCredentialFactory factory class:

from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.tencentcloud.pam import IDaaSPamAklessCredentialFactory

# 1. Initialize IDaaS Core SDK
IDaaSCredentialProviderFactory.init()

# 2. Create Tencent Cloud credentials provider
credentials_provider = IDaaSPamAklessCredentialFactory.get_tencent_cloud_credentials_provider(
    role_arn="your-role-arn"
)

# 3. Get credentials
credential = credentials_provider.get_credentials()
print(credential.secretId)
print(credential.secretKey)
print(credential.token)

Usage Examples

Tencent Cloud SDK (tencentcloud-sdk-python)

from tencentcloud.cvm.v20170312 import cvm_client
from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.tencentcloud.pam import IDaaSPamAklessCredentialFactory

# Initialize
IDaaSCredentialProviderFactory.init()

# Create Tencent Cloud credentials provider
credentials_provider = IDaaSPamAklessCredentialFactory.get_tencent_cloud_credentials_provider(
    role_arn="your-role-arn"
)

# Get credentials and use with Tencent Cloud SDK
credential = credentials_provider.get_credentials()
client = cvm_client.CvmClient(credential, "ap-guangzhou")

COS (cos-python-sdk-v5)

from qcloud_cos import CosS3Client
from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.tencentcloud.pam import IDaaSPamAklessCredentialFactory

# Initialize
IDaaSCredentialProviderFactory.init()

# Create COS credentials provider
cos_provider = IDaaSPamAklessCredentialFactory.get_cos_credential_provider(
    role_arn="your-role-arn"
)

# Use with COS SDK
cos_config = cos_provider.get_cos_config(region="ap-guangzhou")
cos_client = CosS3Client(cos_config)

API Reference

IDaaSPamAklessCredentialFactory

Factory class providing static methods to create credential providers.

Method	Return Type	Description
get_tencent_cloud_credentials_provider(role_arn)	IDaaSPamTencentCloudCredentialsProvider	Create a Tencent Cloud credentials provider
get_cos_credential_provider(role_arn)	IDaaSPamTencentCloudCOSCredentialsProvider	Create a COS SDK credentials provider

Environment Variables

Variable	Description
CLOUD_IDAAS_CONFIG_PATH	IDaaS configuration file path
TENCENT_CLOUD_ROLE_ARN	Fallback for the cloud-account role ARN
TENCENT_CLOUD_OIDC_TOKEN_FILE	Path to an OIDC token file (used when no oidc_token_provider is given)

Support & Feedback

• Email: [e-mail]
• Issues: For questions or suggestions, please submit an Issue

License

This project is licensed under the Apache License 2.0.