STS臨時授權訪問__權限管理_最佳實踐_對象存儲 OSS-阿裏雲

1. 獲取STS的臨時憑證，App用戶為usr001。

    [admin@NGIS-CWWF344M01C /home/admin/oss_test]
    $python ./sts.py AssumeRole RoleArn=acs:ram::1894189769722283:role/ramtestappwrite RoleSessionName=usr001 Policy='{"Version":"1","Statement":[{"Effect":"Allow","Action":["oss:PutObject"],"Resource":["acs:oss:*:*:ram-test-app/usr001/*"]}]}'  --id=oOhuek56i53Frogv --secret=OmVwFJO3qcT0IWrmqkFhOYpg3p0KnA 
    https://sts.aliyuncs.com/?SignatureVersion=1.0&Format=JSON&Timestamp=2015-11-17T03%3A16%3A10Z&RoleArn=acs%3Aram%3A%3A1894189769722283%3Arole%2Framtestappwrite&RoleSessionName=usr001&AccessKeyId=oOhuek56i53Frogv&Policy=%7B%22Version%22%3A%221%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Action%22%3A%5B%22oss%3APutObject%22%5D%2C%22Resource%22%3A%5B%22acs%3Aoss%3A%2A%3A%2A%3Aram-test-app%2Fusr001%2F%2A%22%5D%7D%5D%7D&SignatureMethod=HMAC-SHA1&Version=2015-04-01&Signature=Y0OPUoL1PrCqX4X6A3%2FJvgXuS6c%3D&Action=AssumeRole&SignatureNonce=8d0798a8-8cd9-11e5-9f49-008cfa5e4938
    {
      "AssumedRoleUser": {
        "Arn": "acs:ram::1894189769722283:role/ramtestappwrite/usr001", 
        "AssumedRoleId": "355407847660029428:usr001"
      }, 
      "Credentials": {
        "AccessKeyId": "STS.rtfx13DYMUbcNlIJlS4U", 
        "AccessKeySecret": "2fsaM8E2maB2dngj7S2KwpsKTyK4ajo7TxFr0zIM", 
        "Expiration": "2015-11-17T04:16:10Z", 
        "SecurityToken": "CAESkwMIARKAAUh3/Uzcg13YLRBWxy0IZjGewMpg31ITxCleBFU1eO/3Sgpudid+GVs+Olvu1vXJn6DLcvPa8azKJKtzV0oKSy+mwUrxSvUSRVDntrs78CsNfWoOJUMJKjLIxdWnGi1pgxJCBzNZ2YV/6ycTaZySSE1V6kqQ7A+GPwYoBSnWmLpdGhhTVFMucnRmeDEzRFlNVWJjTmxJSmxTNFUiEjM1NTQwNzg0NzY2MDAyOTQyOCoGdXNyMDAxMOPzoJ2RKjoGUnNhTUQ1QnYKATEacQoFQWxsb3cSJwoMQWN0aW9uRXF1YWxzEgZBY3Rpb24aDwoNb3NzOlB1dE9iamVjdBI/Cg5SZXNvdXJjZUVxdWFscxIIUmVzb3VyY2UaIwohYWNzOm9zczoqOio6cmFtLXRlc3QtYXBwL3VzcjAwMS8qShAxODk0MTg5NzY5NzIyMjgzUgUyNjg0MloPQXNzdW1lZFJvbGVVc2VyYABqEjM1NTQwNzg0NzY2MDAyOTQyOHIPcmFtdGVzdGFwcHdyaXRl"
      }, 
      "RequestId": "19407707-54B2-41AD-AAF0-FE87E8870B0D"
    }

2. 試驗一下能否使用這個憑證來上傳下載。

    [admin@NGIS-CWWF344M01C /home/admin/oss_test]
    $./osscmd get oss://ram-test-app/test.txt test.txt --host=oss-cn-hangzhou.aliyuncs.com -i STS.rtfx13DYMUbcNlIJlS4U -k 2fsaM8E2maB2dngj7S2KwpsKTyK4ajo7TxFr0zIM --sts_token=CAESkwMIARKAAUh3/Uzcg13YLRBWxy0IZjGewMpg31ITxCleBFU1eO/3Sgpudid+GVs+Olvu1vXJn6DLcvPa8azKJKtzV0oKSy+mwUrxSvUSRVDntrs78CsNfWoOJUMJKjLIxdWnGi1pgxJCBzNZ2YV/6ycTaZySSE1V6kqQ7A+GPwYoBSnWmLpdGhhTVFMucnRmeDEzRFlNVWJjTmxJSmxTNFUiEjM1NTQwNzg0NzY2MDAyOTQyOCoGdXNyMDAxMOPzoJ2RKjoGUnNhTUQ1QnYKATEacQoFQWxsb3cSJwoMQWN0aW9uRXF1YWxzEgZBY3Rpb24aDwoNb3NzOlB1dE9iamVjdBI/Cg5SZXNvdXJjZUVxdWFscxIIUmVzb3VyY2UaIwohYWNzOm9zczoqOio6cmFtLXRlc3QtYXBwL3VzcjAwMS8qShAxODk0MTg5NzY5NzIyMjgzUgUyNjg0MloPQXNzdW1lZFJvbGVVc2VyYABqEjM1NTQwNzg0NzY2MDAyOTQyOHIPcmFtdGVzdGFwcHdyaXRl
    Error Headers:
    [('content-length', '254'), ('server', 'AliyunOSS'), ('connection', 'keep-alive'), ('x-oss-request-id', '564A9C31FFFC811F24B6E7E3'), ('date', 'Tue, 17 Nov 2015 03:17:05 GMT'), ('content-type', 'application/xml')]
    Error Body:
    <?xml version="1.0" encoding="UTF-8"?>
    <Error>
      <Code>AccessDenied</Code>
      <Message>Access denied by authorizer's policy.</Message>
      <RequestId>564A9C31FFFC811F24B6E7E3</RequestId>
      <HostId>ram-test-app.oss-cn-hangzhou.aliyuncs.com</HostId>
    </Error>
    Error Status:
    403
    get Failed!
    [admin@NGIS-CWWF344M01C /home/admin/oss_test]
    $./osscmd put test.txt oss://ram-test-app/test.txt  --host=oss-cn-hangzhou.aliyuncs.com -i STS.rtfx13DYMUbcNlIJlS4U -k 2fsaM8E2maB2dngj7S2KwpsKTyK4ajo7TxFr0zIM --sts_token=CAESkwMIARKAAUh3/Uzcg13YLRBWxy0IZjGewMpg31ITxCleBFU1eO/3Sgpudid+GVs+Olvu1vXJn6DLcvPa8azKJKtzV0oKSy+mwUrxSvUSRVDntrs78CsNfWoOJUMJKjLIxdWnGi1pgxJCBzNZ2YV/6ycTaZySSE1V6kqQ7A+GPwYoBSnWmLpdGhhTVFMucnRmeDEzRFlNVWJjTmxJSmxTNFUiEjM1NTQwNzg0NzY2MDAyOTQyOCoGdXNyMDAxMOPzoJ2RKjoGUnNhTUQ1QnYKATEacQoFQWxsb3cSJwoMQWN0aW9uRXF1YWxzEgZBY3Rpb24aDwoNb3NzOlB1dE9iamVjdBI/Cg5SZXNvdXJjZUVxdWFscxIIUmVzb3VyY2UaIwohYWNzOm9zczoqOio6cmFtLXRlc3QtYXBwL3VzcjAwMS8qShAxODk0MTg5NzY5NzIyMjgzUgUyNjg0MloPQXNzdW1lZFJvbGVVc2VyYABqEjM1NTQwNzg0NzY2MDAyOTQyOHIPcmFtdGVzdGFwcHdyaXRl
    100%  Error Headers:
    [('content-length', '254'), ('server', 'AliyunOSS'), ('connection', 'keep-alive'), ('x-oss-request-id', '564A9C3FB8DE437A91B16772'), ('date', 'Tue, 17 Nov 2015 03:17:19 GMT'), ('content-type', 'application/xml')]
    Error Body:
    <?xml version="1.0" encoding="UTF-8"?>
    <Error>
      <Code>AccessDenied</Code>
      <Message>Access denied by authorizer's policy.</Message>
      <RequestId>564A9C3FB8DE437A91B16772</RequestId>
      <HostId>ram-test-app.oss-cn-hangzhou.aliyuncs.com</HostId>
    </Error>
    Error Status:
    403
    put Failed!

   這裏出現了問題，上傳test.txt失敗了。將本小節開始的時候傳入的Policy格式化之後如下：

    {
        "Version": "1",
            "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "oss:PutObject"
                    ],
                "Resource": [
                    "acs:oss:*:*:ram-test-app/usr001/*"
                    ]
            }
        ]
    }

   這個Policy的意義是僅允許用戶向ram-test-app這個Bucket上傳類似usr001/的文件，如果App用戶是usr002的時候，就可以修改Policy為僅允許上傳類似usr002/這種類型的文件，通過這種對不同的App用戶設定不同的Policy的方式，可以做到不同App用戶之間擁有獨立的存儲空間互不幹擾的目的。

3. 重新試驗，將上傳的目標指定為ram-test-app/usr001/test.txt。

    [admin@NGIS-CWWF344M01C /home/admin/oss_test]
    $./osscmd put test.txt oss://ram-test-app/usr001/test.txt  --host=oss-cn-hangzhou.aliyuncs.com -i STS.rtfx13DYMUbcNlIJlS4U -k 2fsaM8E2maB2dngj7S2KwpsKTyK4ajo7TxFr0zIM --sts_token=CAESkwMIARKAAUh3/Uzcg13YLRBWxy0IZjGewMpg31ITxCleBFU1eO/3Sgpudid+GVs+Olvu1vXJn6DLcvPa8azKJKtzV0oKSy+mwUrxSvUSRVDntrs78CsNfWoOJUMJKjLIxdWnGi1pgxJCBzNZ2YV/6ycTaZySSE1V6kqQ7A+GPwYoBSnWmLpdGhhTVFMucnRmeDEzRFlNVWJjTmxJSmxTNFUiEjM1NTQwNzg0NzY2MDAyOTQyOCoGdXNyMDAxMOPzoJ2RKjoGUnNhTUQ1QnYKATEacQoFQWxsb3cSJwoMQWN0aW9uRXF1YWxzEgZBY3Rpb24aDwoNb3NzOlB1dE9iamVjdBI/Cg5SZXNvdXJjZUVxdWFscxIIUmVzb3VyY2UaIwohYWNzOm9zczoqOio6cmFtLXRlc3QtYXBwL3VzcjAwMS8qShAxODk0MTg5NzY5NzIyMjgzUgUyNjg0MloPQXNzdW1lZFJvbGVVc2VyYABqEjM1NTQwNzg0NzY2MDAyOTQyOHIPcmFtdGVzdGFwcHdyaXRl
    100%  
    Object URL is: https://ram-test-app.oss-cn-hangzhou.aliyuncs.com/usr001%2Ftest.txt
    Object abstract path is: oss://ram-test-app/usr001/test.txt
    ETag is "946A0A1AC8245696B9C6A6F35942690B" 
    0.071(s) elapsed

   可見上傳成功了。

總結

本章主要介紹了使用STS來臨時授權用戶訪問OSS。在典型的移動開發場景中，使用STS可以做到不同的App用戶需要訪問App的時候，可以通過獲取到的臨時授權來訪問OSS。臨時授權可以指定過期時間，因此大大降低了泄露的危害。在獲取臨時授權的時候，可以根據App用戶的不同，傳入不同的授權策略來限製用戶的訪問權限，比如限製用戶訪問的Object路徑，從而達到隔離不同App用戶的存儲空間的目的。