Accessing Huawei Cloud Open APIs Using Access Credentials

Access Credential Type

Access credentials include access keys and temporary security credentials.

• An access key ID/secret access key (AK/SK) pair is a permanent identity credential that you can use to access Huawei Cloud. It cannot be used to log in to the console. An AK is a unique identifier used in conjunction with an SK to sign requests cryptographically, ensuring that the requests are secret, complete, and correct. For details, see Access Keys.
• Temporary security credentials include temporary access keys (AK/SK) and security token. In addition to the access key feature, a temporary security credential has a validity period that can be customized. If it expires, the temporary security credential becomes invalid and you have to obtain a new one. Temporary security credentials are more secure than permanent credentials since they expire after a set time and allow stricter control over access rights. For details, see Temporary Security Credentials.

Typical Access Credential Leakage Scenarios

• Access credentials in plaintext are available in public documents.
• The code containing access credentials is uploaded to public code repositories, such as GitHub.
• Hardcoded access credentials in plaintext are stored in service code and are provided to third-party employees.

Secure Use of Access Credentials

The following table lists the solutions to reduce access credential leakage in typical scenarios.

Configuring Access Credentials in KooCLI Profiles

• Scenarios

  To call a cloud service on KooCLI, add a profile to set access credentials. If multiple profiles are used, you can use --cli-profile to specify the name of the profile you want to operate or use and --cli-mode to specify the authentication mode.

  Available authentication modes:

  • AK/SK: Access keys or temporary security credentials. Access keys are permanent AK/SK pairs. Temporary security credentials include temporary AKs/SKs and security tokens.
  • ecsAgency: The agency will obtain temporary authentication information when you use the KooCLI to call a cloud service on the ECS. You are advised to use this method to prevent plaintext access credentials from being queried in the CLI history.
  • SSO: After you enable IAM Identity Center and complete configurations, your users can log in to the unified portal with their username and password and access allocated resources under multiple accounts. They do not need to pass the authentication again before the authentication information expires.
• Setting access credentials
  • To set the authentication mode to AK/SK, set the authentication parameters to temporary security credentials. Specify the temporary AK for cli-access-key, the SK for cli-secret-key, and the security token for cli-security-token. Temporary security credentials are exposed in a shorter period than access keys.

    hcloud configure set --cli-profile=testAKSKST --cli-mode=AKSK --cli-region=cn-north-4 --cli-access-key=******** --cli-secret-key=******** --cli-security-token=******** --cli-project-id=068119468****************af89d2e --cli-domain-id=094518e46****************cfbc4c0 --cli-read-timeout=10 --cli-connect-timeout=5

  • For a profile in AK/SK authentication mode, if the cli-security-token parameter is configured in the profile, cli-access-key and cli-secret-key are temporary AK/SK. Otherwise, they are permanent AK/SK.
  • Configure a profile in ecsAgency authentication mode. No authentication parameters are required.

    hcloud configure set --cli-profile=testEcsAgency --cli-mode=ecsAgency --cli-region=cn-north-4 --cli-read-timeout=10 --cli-connect-timeout=5

  • When you use the KooCLI to call a cloud service on an ECS, the KooCLI automatically obtains temporary authentication information based on the ECS agency.
  • To configure a profile in SSO authentication mode, set the following authentication parameters: user portal URL (cli-sso-start-url), region of an IAM Identity Center instance (cli-sso-region), account name (cli-sso-account-name), and permission set name (cli-sso-permission-set-name). cli-sso-account-name and cli-sso-permission-set-name are optional.
    1. Create a profile that uses SSO authentication.

       hcloud configure set --cli-profile=testSSO --cli-mode=SSO --cli-region=cn-north-4 --cli-sso-start-url=https://idcenter.huaweicloud.com/d-3********6/portal --cli-sso-region=cn-north-4 --cli-sso-account-name=ACCOUNT_01 --cli-sso-permission-set-name=PERMISSION_01

    2. Log in with SSO. You will be prompted to enter an account name and permission set name if cli-sso-account-name and cli-sso-permission-set-name are not set.

       hcloud configure sso --cli-profile=testSSO

Accessing Other Cloud Services Through Temporary Access Keys of an Agency

• Scenarios
  Assume that you are a developer working on an application that runs on an ECS instance. The code in the application needs to call open APIs to access Huawei Cloud services. Your application can obtain temporary access credentials through a cloud service agency created for the ECS instance on the IAM console to access cloud services in a more secure way.

  Figure 1 Obtaining a temporary access key through an ECS agency
  
• Procedure
  The following figure shows how to obtain a temporary access key through an ECS agency. For details, see Accessing Other Cloud Services from ECS Using Temporary Access Keys of an Agency.

  Figure 2 Obtaining a temporary access key through an ECS agency
  

Security Settings for Using Workload Identity in CCE Clusters

• Scenarios
  Assume that you are a developer of an application that runs in a CCE cluster. The application can access cloud services like an IAM user so there is no need to use the AK/SK of the IAM account.

  Figure 3 Workload identity security settings in CCE clusters
  
• Procedure

  For detailed steps, see Using OIDC to Authenticate Workloads in a CCE Cluster.

Obtaining Temporary Security Credentials for an Agency of a FunctionGraph Function

• Scenarios

  Applications deployed on FunctionGraph functions need access credentials to access other cloud services. A typical practice is to specify access keys in function code or configuration files. This approach can expose credentials and requires periodical key rotation. You can associate an IAM agency with a FunctionGraph function and use temporary security credentials to access cloud resources. This approach is more secure than using permanent credentials.

• Procedure
  1. Configure agency permissions.
     Figure 4 Entering the basic information of the agency
     
  2. Create a FunctionGraph function and associate it with the IAM agency created in step 1. (FunctionGraph can then use the agency to obtain temporary security credentials of the account to call open APIs.)
     Figure 5 Creating a FunctionGraph function
     
  3. In the function code, use the context.getSecurityAccessKey(), context.getSecuritySecretKey(), and context.getSecurityToken() methods of the context class to obtain the temporary AK/SK and security token. The following shows a Python example:

     #- * -coding: utf - 8 - * -
     import json
     import os
     from huaweicloudsdkcore.auth.credentials
     import GlobalCredentials
     from huaweicloudsdkiam.v3.region.iam_region
     import IamRegion
     from huaweicloudsdkcore.exceptions
     import exceptions
     from huaweicloudsdkiam.v3
     import *
     
     def handler(event, context):
     	credentials = GlobalCredentials(
     		ak = context.getSecurityAccessKey(),
     		sk = context.getSecuritySecretKey()
     	).with_security_token(context.getSecurityToken())
     
     client = IamClient.new_builder()\
     	.with_credentials(credentials)\
     	.with_region(IamRegion.value_of("cn-north-4"))\
     	.build()
     	...

Other scenarios

If the preceding scenarios do not fit your scenario and you need access keys, follow these suggestions to manage them securely:

• Do not create access keys for HUAWEI IDs.
• Do not create access keys for IAM users who only need to access the console.
• Do not embed access keys in plaintext into code.
• Keep access keys secure. Do not share them or record them in public documents.
• Grant only the minimum permissions required to IAM users.
• Disable and delete access keys after they are no longer used.
• Regularly rotate access keys. When you enable a key pair for an IAM user, keep the second pair only for rotation purposes.