Aliyun Python SDK Core

aliyun-python-sdk-core is the foundational package that every Alibaba Cloud (Aliyun) V1.0 Python service SDK depends on. It provides the shared HTTP transport, credential handling, request signing, endpoint resolution, and response parsing that the per-product client libraries (ECS, RDS, KMS, OSS metadata, and dozens more) build upon.

Applications rarely use it alone; instead they install a product SDK such as aliyun-python-sdk-ecs, which pulls in this core to construct an AcsClient, sign API requests with an access key, and send them to the correct regional Alibaba Cloud endpoint. Note that the V1.0 SDK is now in basic security-maintenance mode, with Alibaba Cloud recommending the V2.0 SDK for new projects.

What You Get

• The AcsClient that issues signed requests against Alibaba Cloud OpenAPI
• Access-key, STS token, RAM-role, and other credential providers
• Request signing (HMAC) and endpoint/region resolution
• Base request classes (RPC and ROA styles) reused by every product SDK
• Response formatting and error handling shared across the V1.0 SDK family

Common Use Cases

• Serving as the transitive dependency of a specific Aliyun product SDK
• Constructing an authenticated AcsClient for Alibaba Cloud API calls
• Signing and sending custom CommonRequest calls to Aliyun OpenAPI
• Managing Alibaba Cloud credentials and STS tokens in Python services

Under The Hood

Architecture — The package centers on AcsClient, which composes a credential provider, a signer, an endpoint resolver, and an HTTP transport. Product SDKs subclass shared request base classes (RPC-style and ROA-style) and hand them to the client, which signs the request, resolves the regional endpoint, executes the call, and formats the response. It is the hub of a large monorepo where each Alibaba Cloud service is its own sibling package depending on this core.

Tech Stack — Pure Python targeting a broad range of interpreter versions, with cryptographic signing for request authentication and pluggable credential providers. Continuous integration runs via GitHub Actions with coverage reported to Codecov.

Code Quality — A very mature, high-adoption project (1,000+ stars, 4,600+ commits, 47 contributors, ~1.78M weekly downloads for this package) with CI and code coverage. It is now in basic security-maintenance mode: no new features are added and the vendor steers new work to the V2.0 SDK.

API Design — The AcsClient abstraction keeps signing and endpoint logic out of application code, so callers focus on constructing product-specific request objects. The V1.0 API is more verbose than the newer V2.0 SDK, which the README explicitly recommends for new projects.