最近更新时间:2023.07.18 20:38:38
首次发布时间:2023.07.18 20:38:38
借助ECS实例IAM角色,使实例内部的应用程序可以使用STS临时凭证访问其他云产品
预计部署时间:30分钟
级别:初级
相关产品:ECS
受众: 通用
参考如下链接,进行 ECS 实例的创建,这里不在赘述
通过向导购买实例
{ "Statement": [ { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Principal": { "Service": [ "ecs", "Volc_ECS" ] } } ] }
{ "Statement": [ { "Effect": "Allow", "Action": [ "tos:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "Volc_InfluxDB_Proxy:Write" ], "Resource": [ "*" ] } ] }
调用ECS的API接口AssociateInstancesIamRole,将角色赋予实例,接口详情文档
角色名字为:Ecs_Sts_role
[root@lxb-jms TOS]# curl -sq http://100.96.0.96/volcstack/latest/iam/security_credentials/Ecs_Sts_role |jq { "ExpiredTime": "2022-11-09T15:48:00+08:00", "CurrentTime": "2022-11-09T09:48:00+08:00", "AccessKeyId": "AKTPOGU3NWE5NTY5NDU2NDkwMTg2MWExMzEwNWQxMDY1NzI", "SecretAccessKey": "NmZiYmRiOTk0MGEyNDhjNjgwZDMyODJkMDg3ZDRlNjA", "SessionToken": "STSeyJBY2NvdW50SWQiOjIxMDAxOTg2NDQsIklkZW50aXR5VHlwZSI6NCwiSWRlbnRpdHlJZCI6MTM4NDc2MSwiQ2hhbm5lbCI6IlZvbGNfRUNTIiwiQWNjZXNzS2V5SWQiOiJBS1RQT0dVM05XRTVOVFk1TkRVMk5Ea3dNVGcyTVdFeE16RXdOV1F4TURZMU56SSIsIlNpZ25lZFNlY3JldEFjY2Vzc0tleSI6ImtKUzI4UXRvSkk0dzFYNHNubCtxMzFJMm5TSGlMQVZwSGpWODRieGlqUjAweG9yRGovT2JRTks3dHJuK2VWTTAiLCJFeHBpcmVkVGltZSI6MTY2Nzk4MDA4MCwiUG9saWN5U3RyaW5nIjoiIiwiU2lnbmF0dXJlIjoiZTUwMGM3MzM3MjViY2E3NjQzMWM2NTZjYjMwOWYxYmVkMDhiMzBkZjhmNTExYTdkNmE2NGU3ZTMzNWYwNzkwYiIsIlNlc3Npb25OYW1lIjoiZWNzOmkteWJ1YmVqYWI0cjM4ZGdhNHhhZ2w6MTEtMDkgMDk6NDg6MDAiLCJPcmlnaW5hbElkZW50aXR5VHlwZSI6M30=" }
注意临时 token 的有效期,程序中需要定时获取并自行提取临时认证信息
示例代码如下:
$ak: 步骤4获取的到临时access key
$sk: 步骤4获取到的临时secret key
$sesson_token: 步骤4 获取到的session_token
[root@lxb-jms TOS]# cat tos.py import boto3 service_name = 's3' endpoint_url = 'https://tos-s3-cn-beijing.ivolces.com' region_name = 'cn-beijing' access_key = '$ak' secret_key = '$sk' session_token = '$session_token' if __name__ == "__main__": s3 = boto3.client(service_name, endpoint_url=endpoint_url, aws_access_key_id=access_key, aws_secret_access_key=secret_key,aws_session_token=session_token) response = s3.list_buckets() for bucket in response.get('Buckets', []): print(bucket.get('Name'))
[root@lxb-jms TOS]# python3 tos.py lxb-bucket
如果您有其他问题,欢迎您联系火山引擎技术支持服务。