Authentication using environment variables

Note

The article is being updated.

When using this method, the authentication mode and its parameters are defined by the environment that an application is run in, as described here.

By setting one of the following environment variables, you can control the authentication method:

  • YDB_SERVICE_ACCOUNT_KEY_FILE_CREDENTIALS=<path/to/sa_key_file>: Use a service account file in Yandex.Cloud.
  • YDB_ANONYMOUS_CREDENTIALS="1": Use anonymous authentication. Relevant for testing against a Docker container with YDB
  • YDB_METADATA_CREDENTIALS="1": Use the metadata service inside Yandex.Cloud (a Yandex function or a VM).
  • YDB_ACCESS_TOKEN_CREDENTIALS=<access_token>: Use token-based authentication.

Below are examples of the code for authentication using environment variables in different YDB SDKs.

Go

Java

  1. package main
  3. import (
  4.     "context"
  5.     "os"
  7.     environ "github.com/ydb-platform/ydb-go-sdk-auth-environ"
  8.     "github.com/ydb-platform/ydb-go-sdk/v3"
  9. )
  11. func main() {
  12.     ctx, cancel := context.WithCancel(context.Background())
  13.     defer cancel()
  14.     db, err := ydb.Open(
  15.         ctx,
  16.         os.Getenv("YDB_CONNECTION_STRING"),
  17.         environ.WithEnvironCredentials(ctx),
  18.     )
  19.     if err != nil {
  20.         panic(err)
  21.     }
  22.     defer func() { 
  23.         _ = db.Close(ctx) 
  24.     }()
  25. }

Using environment variables - 图1

  1. public void work(String connectionString) {
  2.     AuthProvider authProvider = CloudAuthHelper.getAuthProviderFromEnviron();
  4.     GrpcTransport transport = GrpcTransport.forConnectionString(connectionString)
  5.             .withAuthProvider(authProvider)
  6.             .build();
  8.     TableClient tableClient = TableClient
  9.         .newClient(GrpcTableRpc.ownTransport(transport))
  10.         .build());
  12.     doWork(tableClient);
  14.     tableClient.close();
  15. }

Using environment variables - 图2