1---
2layout: "docs"
3page_title: "Vault Agent Auto-Auth AliCloud Method"
4sidebar_title: "AliCloud"
5sidebar_current: "docs-agent-autoauth-methods-alicloud"
6description: |-
7  AliCloud Method for Vault Agent Auto-Auth
8---
9
10# Vault Agent Auto-Auth AliCloud Method
11
12The `alicloud` method performs authentication against the [AliCloud Auth
13method](https://www.vaultproject.io/docs/auth/alicloud.html).
14
15## Credentials
16
17The Vault agent will use the first credential it can successfully obtain in the following order:
18
191. [Environment variables](https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/sdk/auth/credentials/providers/env.go)
202. A static credential configuration
213. Instance metadata (recommended)
22
23Wherever possible, we recommend using instance metadata for credentials. These rotate every hour
24and require no effort on your part to provision, making instance metadata the most secure of the three methods. If
25using instance metadata _and_ a custom `credential_poll_interval`, be sure the frequency is set for
26less than an hour, because instance metadata credentials expire every hour.
27
28Environment variables are given first precedence to provide the ability to quickly override your
29configuration.
30
31## Configuration
32
33### General
34
35- `role` `(string: required)` - The role to authenticate against on Vault.
36
37- `region` `(string: required)` - The AliCloud region in which the Vault agent resides. Example: "us-west-1".
38
39- `credential_poll_interval` `(integer: optional)` - In seconds, how frequently the Vault agent should check for new credentials.
40
41### Optional Static Credential Configuration (Not Preferred)
42
43If instance metadata is not available, you may provide credential information through the parameters below.
44
45- `access_key` `(string: optional)` - The access key to use.
46
47- `secret_key` `(string: optional)` - The secret key to use.
48
49- `access_token` `(string: optional)` - The access token to use.
50
51- `role_arn` `(string: optional)` - The role ARN to use.
52
53- `role_session_name` `(string: optional)` - The role session name to use.
54
55- `role_session_expiration` `(string: optional)` - The role session expiration to use.
56
57- `private_key` `(string: optional)` - The private key to use.
58
59- `public_key_id` `(string: optional)` - The public key ID to use.
60
61- `session_expiration` `(string: optional)` - The session expiration to use.
62
63- `role_name` `(string: optional)` - The role name to use.
64