diff --git a/credentials/internal/providers/env.go b/credentials/internal/providers/env.go
new file mode 100644
index 0000000..27fe33b
--- /dev/null
+++ b/credentials/internal/providers/env.go
@@ -0,0 +1,55 @@
+package providers
+
+import (
+	"fmt"
+	"os"
+)
+
+type EnvironmentVariableCredentialsProvider struct {
+}
+
+type EnvironmentVariableCredentialsProviderBuilder struct {
+	provider *EnvironmentVariableCredentialsProvider
+}
+
+func NewEnvironmentVariableCredentialsProviderBuilder() *EnvironmentVariableCredentialsProviderBuilder {
+	return &EnvironmentVariableCredentialsProviderBuilder{
+		provider: &EnvironmentVariableCredentialsProvider{},
+	}
+}
+
+func (builder *EnvironmentVariableCredentialsProviderBuilder) Build() (provider *EnvironmentVariableCredentialsProvider, err error) {
+	provider = builder.provider
+	return
+}
+
+func (provider *EnvironmentVariableCredentialsProvider) GetCredentials() (cc *Credentials, err error) {
+	accessKeyId := os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")
+
+	if accessKeyId == "" {
+		err = fmt.Errorf("unable to get credentials from enviroment variables, Access key ID must be specified via environment variable (ALIBABA_CLOUD_ACCESS_KEY_ID)")
+		return
+	}
+
+	accessKeySecret := os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")
+
+	if accessKeySecret == "" {
+		err = fmt.Errorf("unable to get credentials from enviroment variables, Access key secret must be specified via environment variable (ALIBABA_CLOUD_ACCESS_KEY_SECRET)")
+		return
+	}
+
+	securityToken := os.Getenv("ALIBABA_CLOUD_SECURITY_TOKEN")
+
+	cc = &Credentials{
+		AccessKeyId:     accessKeyId,
+		AccessKeySecret: accessKeySecret,
+		SecurityToken:   securityToken,
+		ProviderName:    provider.GetProviderName(),
+	}
+
+	return
+}
+
+func (provider *EnvironmentVariableCredentialsProvider) GetProviderName() string {
+	return "env"
+}
diff --git a/credentials/internal/providers/env_test.go b/credentials/internal/providers/env_test.go
new file mode 100644
index 0000000..cb03956
--- /dev/null
+++ b/credentials/internal/providers/env_test.go
@@ -0,0 +1,38 @@
+package providers
+
+import (
+	"os"
+	"testing"
+
+	"github.com/aliyun/credentials-go/credentials/internal/utils"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEnvironmentVariableCredentialsProvider(t *testing.T) {
+	rollback := utils.Memory("ALIBABA_CLOUD_ACCESS_KEY_ID", "ALIBABA_CLOUD_ACCESS_KEY_SECRET", "ALIBABA_CLOUD_SECURITY_TOKEN")
+	defer rollback()
+
+	p, err := NewEnvironmentVariableCredentialsProviderBuilder().Build()
+	assert.Nil(t, err)
+	_, err = p.GetCredentials()
+	assert.EqualError(t, err, "unable to get credentials from enviroment variables, Access key ID must be specified via environment variable (ALIBABA_CLOUD_ACCESS_KEY_ID)")
+	os.Setenv("ALIBABA_CLOUD_ACCESS_KEY_ID", "akid")
+	_, err = p.GetCredentials()
+	assert.EqualError(t, err, "unable to get credentials from enviroment variables, Access key secret must be specified via environment variable (ALIBABA_CLOUD_ACCESS_KEY_SECRET)")
+
+	os.Setenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET", "aksecret")
+	cc, err := p.GetCredentials()
+	assert.Nil(t, err)
+	assert.Equal(t, "akid", cc.AccessKeyId)
+	assert.Equal(t, "aksecret", cc.AccessKeySecret)
+	assert.Equal(t, "", cc.SecurityToken)
+	assert.Equal(t, "env", cc.ProviderName)
+
+	os.Setenv("ALIBABA_CLOUD_SECURITY_TOKEN", "token")
+	cc, err = p.GetCredentials()
+	assert.Nil(t, err)
+	assert.Equal(t, "akid", cc.AccessKeyId)
+	assert.Equal(t, "aksecret", cc.AccessKeySecret)
+	assert.Equal(t, "token", cc.SecurityToken)
+	assert.Equal(t, "env", cc.ProviderName)
+}