Initialization

Confirm Endpoint

Before using SDK, please refer to the developer guide section on ENDPOINT Service Domain Name to understand endpoint-related concepts. Baidu AI Cloud currently supports multiple regions. Please refer toRegion Selection Guide.

Currently supported regions are: "North China-Beijing," "South China-Guangzhou," "East China-Suzhou," "Hong Kong," "Central Finance-Wuhan," and "North China-Baoding." Corresponding details:

Retrieve access key

To use the Baidu AI Cloud enterprise security group, users must have a valid AK (Access Key ID) and SK (Secret Access Key) for signature verification. These system-assigned strings identify the user and facilitate the certification process for accessing the enterprise security group.

Your AK/SK information can be obtained and understood through the following steps:

Register a Baidu AI Cloud account

Create AK/SK

Create a new ESG client

The ESG client is the enterprise security group's dedicated client, offering developers a range of methods to interact with the service.

Create a new ESG client with AK/SK

Users can refer to the following code to create ESG client to access enterprise security group with AK/SK:

1import (
2"github.com/baidubce/bce-sdk-go/services/esg"
3)
4func main() {
5 // User’s Access Key ID and Secret Access Key
6ACCESS_KEY_ID, SECRET_ACCESS_KEY := <your-access-key-id>, <your-secret-access-key>
7 // User-specified Endpoint
8ENDPOINT := <domain-name>
9 // Initialize ESG client
10esgClient, err := esg.NewClient(AK, SK, ENDPOINT)
11}

In the code above, ACCESS_KEY_ID corresponds to “Access Key ID” in the console. SECRET_ACCESS_KEY corresponds to “Access Key Secret” in the console. Refer to the Guide - How to Retrieve AKSK. The third parameter ENDPOINT is a user-specified domain name. If left empty, the default domain name will be used as the enterprise security group service address.

Note:The endpoint parameter must be defined with the domain name of the specified region. For example, if the service is located in Beijing, the endpoint will be bcc.bj.baidubce.com.

Create a ESG client with STS

Request STS Token

The enterprise security group allows for temporary third-party access authorization via the STS mechanism. STS (Security Token Service) is a temporary authorization service by Baidu AI Cloud, enabling the issuance of access credentials with customizable validity and permissions. Third-party users can use these credentials to call Baidu AI Cloud APIs or SDKs directly, gaining access to cloud resources.

To access the enterprise security group via STS, users must first obtain a certification string through the STS client.

Create ESG Client with STS Token

Once the STS token is acquired, it needs to be configured into the ESG Client to enable STS-based ESG client creation.

Code example

The GO SDK implements the STS service API. Below is a complete example for requesting an STS Token and creating an ESG Client object:

1import (
2  "fmt"
3 "github.com/baidubce/bce-sdk-go/auth"                    //Import the authentication module
4 "github.com/baidubce/bce-sdk-go/services/esg" //Import ESG service module
5 "github.com/baidubce/bce-sdk-go/services/sts"            //Import the Baige service module
6)
7func main() {
8 //Create a Client object for the STS service, using the default Endpoint
9  AK, SK := <your-access-key-id>, <your-secret-access-key>
10  stsClient, err := sts.NewClient(AK, SK)
11  if err != nil {
12    fmt.Println("create sts client object :", err)
13    return
14  }
15 //Obtain a temporary authentication token with a validity period of 60 seconds and an empty ACL
16  stsObj, err := stsClient.GetSessionToken(60, "")
17  if err != nil {
18    fmt.Println("get session token failed:", err)
19    return
20    }
21  fmt.Println("GetSessionToken result:")
22  fmt.Println("  accessKeyId:", stsObj.AccessKeyId)
23  fmt.Println("  secretAccessKey:", stsObj.SecretAccessKey)
24  fmt.Println("  sessionToken:", stsObj.SessionToken)
25  fmt.Println("  createTime:", stsObj.CreateTime)
26  fmt.Println("  expiration:", stsObj.Expiration)
27  fmt.Println("  userId:", stsObj.UserId)
28 //Create a ESG Client object using the requested temporary STS, with the default endpoint
29  esgClient, err := esg.NewClient(stsObj.AccessKeyId, stsObj.SecretAccessKey, "bcc.bj.baidubce.com")
30  if err != nil {
31    fmt.Println("create esg client failed:", err)
32    return
33  }
34  stsCredential, err := auth.NewSessionBceCredentials(
35    stsObj.AccessKeyId,
36    stsObj.SecretAccessKey,
37    stsObj.SessionToken)
38  if err != nil {
39    fmt.Println("create sts credential object failed:", err)
40    return
41  }
42  esgClient.Config.Credentials = stsCredential
43}

Note: Currently, when configuring a ESG client with STS, regardless of where the corresponding enterprise security group service endpoint is located, the STS endpoint must be set to http://sts.bj.baidubce.com. This default is utilized when creating an STS object in the above code.

Configure HTTPS protocol to access enterprise security group

Enterprise security group supports the HTTPS protocol. By specifying HTTPS in the endpoint when creating a ESG client object, users can access the enterprise security group service via HTTPS in the Sg GO SDK:

1// import "github.com/baidubce/bce-sdk-go/services/esg"
2 ENDPOINT := ""https://bcc.bj.baidubce.com" // Specify the use of HTTPS protocol
3AK, SK := <your-access-key-id>, <your-secret-access-key>
4esgClient, _ := esg.NewClient(AK, SK, ENDPOINT)

Configure the ESG client

If users need to configure specific parameters for the ESG client, they can customize the configuration using the exported Config field of the ESG client object after its creation. This allows for configuring parameters such as proxy and maximum number of connections for the client.

Use a proxy

The following code snippet enables the client to access enterprise security group service using a proxy:

1// import "github.com/baidubce/bce-sdk-go/services/esg"
2 // Create an ESG client object
3AK, SK := <your-access-key-id>, <your-secret-access-key>
4ENDPOINT := "bcc.bj.baidubce.com"
5client, _ := esg.NewClient(AK, SK, ENDPOINT)
6 // Use the local port 8080 for the proxy
7client.Config.ProxyUrl = "127.0.0.1:8080"

Set network parameters

Users can configure network parameters using the following example code:

1// import "github.com/baidubce/bce-sdk-go/services/esg"
2AK, SK := <your-access-key-id>, <your-secret-access-key>
3ENDPOINT := "bcc.bj.baidubce.com"
4client, _ := esg.NewClient(AK, SK, ENDPOINT)
5 // Configure to not retry, default: Back Off retry
6client.Config.Retry = bce.NewNoRetryPolicy()
7 // Configure connection timeout to 30 seconds
8client.Config.ConnectionTimeoutInMillis = 30 * 1000

Configure options for generating signature strings

1// import "github.com/baidubce/bce-sdk-go/services/esg"
2AK, SK := <your-access-key-id>, <your-secret-access-key>
3ENDPOINT := "bcc.bj.baidubce.com"
4client, _ := esg.NewClient(AK, SK, ENDPOINT)
5 // Configure the HTTP request header Host for signing
6headersToSign := map[string]struct{}{"Host": struct{}{}}
7client.Config.SignOption.HeadersToSign = HeadersToSign
8 // Configure the validity period of the signature to 30 seconds
9client.Config.SignOption.ExpireSeconds = 30

Parameter description

When using the GO SDK to access enterprise security group, the Config field of the created ESG client object supports the following parameters, as shown in the table below:

Description:

1. The Credentials is created using the auth.NewBceCredentials and auth.NewSessionBceCredentials functions. The former is used by default, while the latter is used for STS certification. For details, refer to Create a ESG Client with STS.
2. The SignOption field represents options when generating a signature string, as detailed in the table below:

1 Among configuration options, HeadersToSign defaults to `Host`, `Content-Type`, `Content-Length` and `Content-MD5`; TimeStamp is typically set to zero, indicating that the timestamp at the time of generating the certification string shall be used, and users generally shall not explicitly specify the value for this field; ExpireSeconds defaults to 1,800 seconds or 30 minutes.

3. The Retry field specifies the retry policy, currently supporting two types: NoRetryPolicy and BackOffRetryPolicy. By default, the latter is used. This retry policy specifies the maximum number of retries, the maximum retry duration, and the retry base. Retries increase exponentially based on the retry base multiplied by 2 until the maximum number of retries or the maximum retry duration is reached.

Enterprise security group management

Create enterprise security group

Function declaration

1func (c *Client) CreateEsg(args *CreateEsgArgs) (*CreateEsgResult, error)

Parameter meaning

Refer to the OpenAPI documentation: https://cloud.baidu.com/doc/VPC/s/gl5gqhqtk

Response value

Operation succeeded:

1{
2    "enterpriseSecurityGroupId": "esg-nky7qeom"
3}

Operation failed:

Throw an exception. For the exception list, refer to: https://cloud.baidu.com/doc/VPC/s/sjwvyuhe7

Code example

For specific code examples, refer to example_create_esg.go

Query enterprise security group list

Function declaration

1func (c *Client) ListEsg(args *ListEsgArgs) (*ListEsgResult, error)

Parameter meaning

Refer to the OpenAPI documentation: https://cloud.baidu.com/doc/VPC/s/Cl5jbuluf

Response value

Operation succeeded:

1{
2    "nextMarker": "",
3    "marker": "",
4    "maxKeys": 1000,
5    "enterpriseSecurityGroups": [
6        {
7        "desc": "",
8        "id": "esg-4NxWoxeq",
9        "name": "test enterprise sg",
10        "createdTime":"2019-09-24T08:25:59Z",
11        "rules": [
12            {
13                "destIp": "all",
14                "localIp": "all",
15                "direction": "egress",
16                "ethertype": "IPv4",
17                "portRange": "1-65535",
18                "sourcePortRange": "1-65535",
19                "action":"allow",
20                "priority":"1000",
21                "protocol": "all",
22 "remark": "Remarks",
23                "enterpriseSecurityGroupRuleId": "esgr-gkv8yupumvx2",
24                "createdTime": "2020-07-27T13:00:52Z",
25                "updatedTime": "2020-07-27T13:00:52Z"
26            }
27        ],
28        "tags":[
29           {
30            "tagKey": tagKey,
31            "tagValue": tagValue
32           }
33        ]
34        }
35    ],
36    "isTruncated": false
37}  

Operation failed:

Throw an exception. For the exception list, refer to: https://cloud.baidu.com/doc/VPC/s/sjwvyuhe7

Code example

For specific code examples, refer to example_get_esglist.go

Delete enterprise security group

Function declaration

1func (c *Client) DeleteEsg(args *DeleteEsgArgs) error

Parameter meaning

Refer to the OpenAPI documentation: https://cloud.baidu.com/doc/VPC/s/yl5jcu51m

Response value

Operation succeeded:

1{}

Operation failed:

Throw an exception. For the exception list, refer to: https://cloud.baidu.com/doc/VPC/s/sjwvyuhe7

Code example

For specific code examples, refer to example_delete_esg.go

Create enterprise security group rules

Function declaration

1func (c *Client) CreateEsgRules(args *CreateEsgRuleArgs) error

Parameter meaning

Refer to the OpenAPI documentation: https://cloud.baidu.com/doc/VPC/s/Kl5jd2uh0

Response value

Operation succeeded:

1{}

Operation failed:

Throw an exception. For the exception list, refer to: https://cloud.baidu.com/doc/VPC/s/sjwvyuhe7

Code example

For specific code examples, refer to example_authorize_esgrule.go

Delete enterprise security group rules

Function declaration

1func (c *Client) DeleteEsgRule(args *DeleteEsgRuleArgs) error

Parameter meaning

Refer to the OpenAPI documentation: https://cloud.baidu.com/doc/VPC/s/jl5jdnohy

Response value

Operation succeeded:

1{}

Operation failed:

Throw an exception. For the exception list, refer to: https://cloud.baidu.com/doc/VPC/s/sjwvyuhe7

Code example

For specific code examples, refer to example_delete_esgrule.go

Update enterprise security group rules

Function declaration

1func (c *Client) UpdateEsgRule(args *UpdateEsgRuleArgs) error

Parameter meaning

Refer to the OpenAPI documentation: https://cloud.baidu.com/doc/VPC/s/8l5jdu8lx

Response value

Operation succeeded:

1{}

Operation failed:

Throw an exception. For the exception list, refer to: https://cloud.baidu.com/doc/VPC/s/sjwvyuhe7

Code example

For specific code examples, refer to example_update_esgrule.go