Metadata-Version: 2.4
Name: cloud-idaas-akless-tencent-adapter
Version: 0.0.1b0
Summary: Python SDK for IDaaS AKless Adapter — obtain STS temporary credentials through IDaaS PAM to access Tencent Cloud services without SecretKey
Author-email: AlibabaCloud IDaaS Team <cloudidaas@list.alibaba-inc.com>
License: Apache-2.0
Keywords: IDaaS,IDaaS SDK,Tencent Cloud,AKless
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Operating System :: OS Independent
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cloud-idaas-core>=0.0.5b0
Requires-Dist: tencentcloud-sdk-python-common>=3.0.0
Requires-Dist: cos-python-sdk-v5>=1.9.0
Provides-Extra: dev
Requires-Dist: pytest>=8.0.0; extra == "dev"
Requires-Dist: pytest-cov>=6.0.0; extra == "dev"
Dynamic: license-file

# idaas-python-akless-tencent-adapter

[![Python Version](https://img.shields.io/badge/python-3.9%2B-blue)](https://www.python.org/)
[![License](https://img.shields.io/badge/license-Apache%202.0-green.svg)](LICENSE)
[![Development Status](https://img.shields.io/badge/status-Beta-orange)](https://github.com/cloud-idaas/idaas-python-akless-tencent-adapter)
[![Version](https://img.shields.io/badge/version-0.0.1--beta-blue)](https://github.com/cloud-idaas/idaas-python-akless-tencent-adapter)

English | [简体中文](README_zh.md)

Python SDK for the IDaaS (Identity as a Service) AKless Adapter — obtain STS temporary credentials through IDaaS PAM (Privileged Access Management) to access Tencent Cloud services without SecretKey.

## Features

- **AK-Free Authentication**: No long-term SecretKey required. Uses OIDC Token to obtain STS temporary credentials via IDaaS PAM, reducing the risk of credential leakage
- **Multi-SDK Adaptation**: Provides credential provider adapters for multiple Tencent Cloud official SDKs, including Tencent Cloud SDK and COS SDK
- **Auto Credential Refresh**: Built-in credential caching and expiration-based auto-refresh mechanism to ensure seamless credential rotation
- **Easy Integration**: Factory class provides one-line credential provider creation, minimizing integration cost

## Requirements

- Python >= 3.9
- Dependencies:
  - cloud-idaas-core >= 0.0.5-beta

## Installation

```bash
pip install cloud-idaas-akless-tencent-adapter
```

## Prerequisites

This SDK depends on [cloud-idaas-core](https://pypi.org/project/cloud-idaas-core/). You need to complete the IDaaS Core SDK initialization before using this adapter.

1. Install and configure `cloud-idaas-core`. See [cloud-idaas-core README](https://github.com/cloud-idaas/idaas-python-core-sdk/blob/main/README.md) for details.

2. In the configuration file, set the `scope` to the IDaaS PAM built-in scope:

   ```json
   {
       "scope": "urn:cloud:idaas:pam|cloud_account_role:obtain_access_credential"
   }
   ```

3. Complete the IDaaS Core SDK initialization:

   ```python
   from cloud_idaas.core import IDaaSCredentialProviderFactory

   IDaaSCredentialProviderFactory.init()
   ```

## Quick Start

The simplest way to use this SDK is through the `IDaaSPamAklessCredentialFactory` factory class:

```python
from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.tencentcloud.pam import IDaaSPamAklessCredentialFactory

# 1. Initialize IDaaS Core SDK
IDaaSCredentialProviderFactory.init()

# 2. Create Tencent Cloud credentials provider
credentials_provider = IDaaSPamAklessCredentialFactory.get_tencent_cloud_credentials_provider(
    role_arn="your-role-arn"
)

# 3. Get credentials
credential = credentials_provider.get_credentials()
print(credential.secretId)
print(credential.secretKey)
print(credential.token)
```

## Usage Examples

### Tencent Cloud SDK (tencentcloud-sdk-python)

```python
from tencentcloud.cvm.v20170312 import cvm_client
from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.tencentcloud.pam import IDaaSPamAklessCredentialFactory

# Initialize
IDaaSCredentialProviderFactory.init()

# Create Tencent Cloud credentials provider
credentials_provider = IDaaSPamAklessCredentialFactory.get_tencent_cloud_credentials_provider(
    role_arn="your-role-arn"
)

# Get credentials and use with Tencent Cloud SDK
credential = credentials_provider.get_credentials()
client = cvm_client.CvmClient(credential, "ap-guangzhou")
```

### COS (cos-python-sdk-v5)

```python
from qcloud_cos import CosS3Client
from cloud_idaas.core import IDaaSCredentialProviderFactory
from cloud_idaas.adapter.tencentcloud.pam import IDaaSPamAklessCredentialFactory

# Initialize
IDaaSCredentialProviderFactory.init()

# Create COS credentials provider
cos_provider = IDaaSPamAklessCredentialFactory.get_cos_credential_provider(
    role_arn="your-role-arn"
)

# Use with COS SDK
cos_config = cos_provider.get_cos_config(region="ap-guangzhou")
cos_client = CosS3Client(cos_config)
```

## API Reference

### IDaaSPamAklessCredentialFactory

Factory class providing static methods to create credential providers.

| Method | Return Type | Description |
|--------|-------------|-------------|
| `get_tencent_cloud_credentials_provider(role_arn)` | `IDaaSPamTencentCloudCredentialsProvider` | Create a Tencent Cloud credentials provider |
| `get_cos_credential_provider(role_arn)` | `IDaaSPamTencentCloudCOSCredentialsProvider` | Create a COS SDK credentials provider |

### Environment Variables

| Variable | Description |
|----------|-------------|
| `CLOUD_IDAAS_CONFIG_PATH` | IDaaS configuration file path |
| `TENCENT_CLOUD_ROLE_ARN` | Fallback for the cloud-account role ARN |
| `TENCENT_CLOUD_OIDC_TOKEN_FILE` | Path to an OIDC token file (used when no `oidc_token_provider` is given) |

## Support & Feedback

- **Email**: cloudidaas@list.alibaba-inc.com
- **Issues**: For questions or suggestions, please submit an [Issue](https://github.com/cloud-idaas/idaas-python-akless-tencent-adapter/issues)

## License

This project is licensed under the [Apache License 2.0](LICENSE).
