STS临时授权访问__权限管理_最佳实践_对象存储 OSS-阿里云

1. 获取STS的临时凭证，App用户为usr001。

    [admin@NGIS-CWWF344M01C /home/admin/oss_test]
    $python ./sts.py AssumeRole RoleArn=acs:ram::1894189769722283:role/ramtestappwrite RoleSessionName=usr001 Policy='{"Version":"1","Statement":[{"Effect":"Allow","Action":["oss:PutObject"],"Resource":["acs:oss:*:*:ram-test-app/usr001/*"]}]}'  --id=oOhuek56i53Frogv --secret=OmVwFJO3qcT0IWrmqkFhOYpg3p0KnA 
    https://sts.aliyuncs.com/?SignatureVersion=1.0&Format=JSON&Timestamp=2015-11-17T03%3A16%3A10Z&RoleArn=acs%3Aram%3A%3A1894189769722283%3Arole%2Framtestappwrite&RoleSessionName=usr001&AccessKeyId=oOhuek56i53Frogv&Policy=%7B%22Version%22%3A%221%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Action%22%3A%5B%22oss%3APutObject%22%5D%2C%22Resource%22%3A%5B%22acs%3Aoss%3A%2A%3A%2A%3Aram-test-app%2Fusr001%2F%2A%22%5D%7D%5D%7D&SignatureMethod=HMAC-SHA1&Version=2015-04-01&Signature=Y0OPUoL1PrCqX4X6A3%2FJvgXuS6c%3D&Action=AssumeRole&SignatureNonce=8d0798a8-8cd9-11e5-9f49-008cfa5e4938
    {
      "AssumedRoleUser": {
        "Arn": "acs:ram::1894189769722283:role/ramtestappwrite/usr001", 
        "AssumedRoleId": "355407847660029428:usr001"
      }, 
      "Credentials": {
        "AccessKeyId": "STS.rtfx13DYMUbcNlIJlS4U", 
        "AccessKeySecret": "2fsaM8E2maB2dngj7S2KwpsKTyK4ajo7TxFr0zIM", 
        "Expiration": "2015-11-17T04:16:10Z", 
        "SecurityToken": "CAESkwMIARKAAUh3/Uzcg13YLRBWxy0IZjGewMpg31ITxCleBFU1eO/3Sgpudid+GVs+Olvu1vXJn6DLcvPa8azKJKtzV0oKSy+mwUrxSvUSRVDntrs78CsNfWoOJUMJKjLIxdWnGi1pgxJCBzNZ2YV/6ycTaZySSE1V6kqQ7A+GPwYoBSnWmLpdGhhTVFMucnRmeDEzRFlNVWJjTmxJSmxTNFUiEjM1NTQwNzg0NzY2MDAyOTQyOCoGdXNyMDAxMOPzoJ2RKjoGUnNhTUQ1QnYKATEacQoFQWxsb3cSJwoMQWN0aW9uRXF1YWxzEgZBY3Rpb24aDwoNb3NzOlB1dE9iamVjdBI/Cg5SZXNvdXJjZUVxdWFscxIIUmVzb3VyY2UaIwohYWNzOm9zczoqOio6cmFtLXRlc3QtYXBwL3VzcjAwMS8qShAxODk0MTg5NzY5NzIyMjgzUgUyNjg0MloPQXNzdW1lZFJvbGVVc2VyYABqEjM1NTQwNzg0NzY2MDAyOTQyOHIPcmFtdGVzdGFwcHdyaXRl"
      }, 
      "RequestId": "19407707-54B2-41AD-AAF0-FE87E8870B0D"
    }

2. 试验一下能否使用这个凭证来上传下载。

    [admin@NGIS-CWWF344M01C /home/admin/oss_test]
    $./osscmd get oss://ram-test-app/test.txt test.txt --host=oss-cn-hangzhou.aliyuncs.com -i STS.rtfx13DYMUbcNlIJlS4U -k 2fsaM8E2maB2dngj7S2KwpsKTyK4ajo7TxFr0zIM --sts_token=CAESkwMIARKAAUh3/Uzcg13YLRBWxy0IZjGewMpg31ITxCleBFU1eO/3Sgpudid+GVs+Olvu1vXJn6DLcvPa8azKJKtzV0oKSy+mwUrxSvUSRVDntrs78CsNfWoOJUMJKjLIxdWnGi1pgxJCBzNZ2YV/6ycTaZySSE1V6kqQ7A+GPwYoBSnWmLpdGhhTVFMucnRmeDEzRFlNVWJjTmxJSmxTNFUiEjM1NTQwNzg0NzY2MDAyOTQyOCoGdXNyMDAxMOPzoJ2RKjoGUnNhTUQ1QnYKATEacQoFQWxsb3cSJwoMQWN0aW9uRXF1YWxzEgZBY3Rpb24aDwoNb3NzOlB1dE9iamVjdBI/Cg5SZXNvdXJjZUVxdWFscxIIUmVzb3VyY2UaIwohYWNzOm9zczoqOio6cmFtLXRlc3QtYXBwL3VzcjAwMS8qShAxODk0MTg5NzY5NzIyMjgzUgUyNjg0MloPQXNzdW1lZFJvbGVVc2VyYABqEjM1NTQwNzg0NzY2MDAyOTQyOHIPcmFtdGVzdGFwcHdyaXRl
    Error Headers:
    [('content-length', '254'), ('server', 'AliyunOSS'), ('connection', 'keep-alive'), ('x-oss-request-id', '564A9C31FFFC811F24B6E7E3'), ('date', 'Tue, 17 Nov 2015 03:17:05 GMT'), ('content-type', 'application/xml')]
    Error Body:
    <?xml version="1.0" encoding="UTF-8"?>
    <Error>
      <Code>AccessDenied</Code>
      <Message>Access denied by authorizer's policy.</Message>
      <RequestId>564A9C31FFFC811F24B6E7E3</RequestId>
      <HostId>ram-test-app.oss-cn-hangzhou.aliyuncs.com</HostId>
    </Error>
    Error Status:
    403
    get Failed!
    [admin@NGIS-CWWF344M01C /home/admin/oss_test]
    $./osscmd put test.txt oss://ram-test-app/test.txt  --host=oss-cn-hangzhou.aliyuncs.com -i STS.rtfx13DYMUbcNlIJlS4U -k 2fsaM8E2maB2dngj7S2KwpsKTyK4ajo7TxFr0zIM --sts_token=CAESkwMIARKAAUh3/Uzcg13YLRBWxy0IZjGewMpg31ITxCleBFU1eO/3Sgpudid+GVs+Olvu1vXJn6DLcvPa8azKJKtzV0oKSy+mwUrxSvUSRVDntrs78CsNfWoOJUMJKjLIxdWnGi1pgxJCBzNZ2YV/6ycTaZySSE1V6kqQ7A+GPwYoBSnWmLpdGhhTVFMucnRmeDEzRFlNVWJjTmxJSmxTNFUiEjM1NTQwNzg0NzY2MDAyOTQyOCoGdXNyMDAxMOPzoJ2RKjoGUnNhTUQ1QnYKATEacQoFQWxsb3cSJwoMQWN0aW9uRXF1YWxzEgZBY3Rpb24aDwoNb3NzOlB1dE9iamVjdBI/Cg5SZXNvdXJjZUVxdWFscxIIUmVzb3VyY2UaIwohYWNzOm9zczoqOio6cmFtLXRlc3QtYXBwL3VzcjAwMS8qShAxODk0MTg5NzY5NzIyMjgzUgUyNjg0MloPQXNzdW1lZFJvbGVVc2VyYABqEjM1NTQwNzg0NzY2MDAyOTQyOHIPcmFtdGVzdGFwcHdyaXRl
    100%  Error Headers:
    [('content-length', '254'), ('server', 'AliyunOSS'), ('connection', 'keep-alive'), ('x-oss-request-id', '564A9C3FB8DE437A91B16772'), ('date', 'Tue, 17 Nov 2015 03:17:19 GMT'), ('content-type', 'application/xml')]
    Error Body:
    <?xml version="1.0" encoding="UTF-8"?>
    <Error>
      <Code>AccessDenied</Code>
      <Message>Access denied by authorizer's policy.</Message>
      <RequestId>564A9C3FB8DE437A91B16772</RequestId>
      <HostId>ram-test-app.oss-cn-hangzhou.aliyuncs.com</HostId>
    </Error>
    Error Status:
    403
    put Failed!

   这里出现了问题，上传test.txt失败了。将本小节开始的时候传入的Policy格式化之后如下：

    {
        "Version": "1",
            "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "oss:PutObject"
                    ],
                "Resource": [
                    "acs:oss:*:*:ram-test-app/usr001/*"
                    ]
            }
        ]
    }

   这个Policy的意义是仅允许用户向ram-test-app这个Bucket上传类似usr001/的文件，如果App用户是usr002的时候，就可以修改Policy为仅允许上传类似usr002/这种类型的文件，通过这种对不同的App用户设定不同的Policy的方式，可以做到不同App用户之间拥有独立的存储空间互不干扰的目的。

3. 重新试验，将上传的目标指定为ram-test-app/usr001/test.txt。

    [admin@NGIS-CWWF344M01C /home/admin/oss_test]
    $./osscmd put test.txt oss://ram-test-app/usr001/test.txt  --host=oss-cn-hangzhou.aliyuncs.com -i STS.rtfx13DYMUbcNlIJlS4U -k 2fsaM8E2maB2dngj7S2KwpsKTyK4ajo7TxFr0zIM --sts_token=CAESkwMIARKAAUh3/Uzcg13YLRBWxy0IZjGewMpg31ITxCleBFU1eO/3Sgpudid+GVs+Olvu1vXJn6DLcvPa8azKJKtzV0oKSy+mwUrxSvUSRVDntrs78CsNfWoOJUMJKjLIxdWnGi1pgxJCBzNZ2YV/6ycTaZySSE1V6kqQ7A+GPwYoBSnWmLpdGhhTVFMucnRmeDEzRFlNVWJjTmxJSmxTNFUiEjM1NTQwNzg0NzY2MDAyOTQyOCoGdXNyMDAxMOPzoJ2RKjoGUnNhTUQ1QnYKATEacQoFQWxsb3cSJwoMQWN0aW9uRXF1YWxzEgZBY3Rpb24aDwoNb3NzOlB1dE9iamVjdBI/Cg5SZXNvdXJjZUVxdWFscxIIUmVzb3VyY2UaIwohYWNzOm9zczoqOio6cmFtLXRlc3QtYXBwL3VzcjAwMS8qShAxODk0MTg5NzY5NzIyMjgzUgUyNjg0MloPQXNzdW1lZFJvbGVVc2VyYABqEjM1NTQwNzg0NzY2MDAyOTQyOHIPcmFtdGVzdGFwcHdyaXRl
    100%  
    Object URL is: https://ram-test-app.oss-cn-hangzhou.aliyuncs.com/usr001%2Ftest.txt
    Object abstract path is: oss://ram-test-app/usr001/test.txt
    ETag is "946A0A1AC8245696B9C6A6F35942690B" 
    0.071(s) elapsed

   可见上传成功了。

总结

本章主要介绍了使用STS来临时授权用户访问OSS。在典型的移动开发场景中，使用STS可以做到不同的App用户需要访问App的时候，可以通过获取到的临时授权来访问OSS。临时授权可以指定过期时间，因此大大降低了泄露的危害。在获取临时授权的时候，可以根据App用户的不同，传入不同的授权策略来限制用户的访问权限，比如限制用户访问的Object路径，从而达到隔离不同App用户的存储空间的目的。