Object Storage Service:Traffic fees

OSS outbound Internet traffic fees can be reduced or shifted using various methods. The following lists available solutions by popularity. You can use one or a combination based on your business needs.

Solution 1: Use outbound data transfer plans to offset fees

Scenario: Stable and predictable public download traffic. Purchase an outbound data transfer plan that matches your bucket's region (China mainland general or region-specific). The system prioritizes deducting outbound Internet traffic from the plan quota. For more information, see Resource plan purchase guide.

Note: Outbound data transfer plans only offset outbound Internet traffic fees. They do not cover storage or request fees. After pay-by-requester mode is enabled, outbound data transfer plans no longer take effect (see Solution 4).

Solution 2: Use an internal endpoint for access

Scenario: The downloader is an Alibaba Cloud service in the same region as the bucket (e.g., ECS or Function Compute). Accessing OSS through an internal endpoint (e.g., oss-cn-hangzhou-internal.aliyuncs.com) does not incur outbound Internet traffic fees, only request fees. Cross-region scenarios can be implemented indirectly through an ECS reverse proxy in the same region. For details, see Access OSS by using an ECS reverse proxy.

Solution 3: Use CDN acceleration

Scenario: Distributing popular content to a large number of public users. Bind your custom domain to the bucket and configure CDN acceleration, allowing users to retrieve data from the nearest CDN node. CDN origin traffic back to OSS incurs origin traffic fees (at a lower unit price than OSS outbound Internet traffic fees), plus CDN traffic fees. Higher cache hit ratios save more costs. Not suitable for frequently updated dynamic files.

Solution 4: Enable pay-by-requester mode

Scenario: Sharing data externally, distributing public datasets, cross-account downloads — when you want the data requester to bear the download traffic costs. After enabling pay-by-requester mode for a bucket, outbound Internet traffic fees and origin traffic fees are borne by the requester, while the bucket owner mainly bears storage fees. Anonymous access will be disabled after activation, and the requester must include the x-oss-request-payer: requester header in HTTP requests.

Note: After enabling pay-by-requester mode, neither outbound data transfer plans nor origin traffic plans take effect. Only buckets with region attribute are supported. For activation steps, see Pay by requester.

Solution 5: Disable transfer acceleration

Scenario: Transfer acceleration is enabled but not strictly needed. Accessing through a transfer acceleration endpoint incurs transfer acceleration fees in addition to outbound Internet traffic fees. Without low-latency long-distance access requirements, disabling the transfer acceleration endpoint eliminates transfer acceleration fees. For more information, see Transfer acceleration fees.

Solution comparison

The following table summarizes the applicable scenarios and cost attribution for each solution to help you make a quick selection.

Solution	Scenario	Additional product required	Outbound traffic fee bearer	Traffic fees waived
Outbound data transfer plan	Stable, predictable public downloads	No (resource plan)	Bucket owner	Offset within plan, excess is pay-as-you-go
Internal endpoint	Alibaba Cloud services in the same region	No	No outbound traffic fees incurred	Yes (request fees only)
CDN acceleration	Distributing popular content to public users	CDN	Bucket owner	No (origin traffic + CDN traffic)
Pay-by-requester	External sharing/cross-account downloads	No	Requester	Yes for owner; No for requester
Disable transfer acceleration	No need for transfer acceleration	No	Bucket owner	No (outbound traffic fees still apply)

If you experience an unexpected spike in outbound Internet traffic, see "How do I handle an unexpected increase in outbound traffic over the Internet?" below for troubleshooting. For detailed information about the mutual exclusion between resource plans and pay-by-requester mode, see "Can the requester, instead of the bucket owner, pay for outbound traffic?" below.

If your bucket shows a sudden spike in outbound Internet traffic, use these steps to troubleshoot.

1. Identify the traffic abnormality.

   If real-time log query is enabled for the bucket

   1. Log on to the OSS console.

   2. In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.

   3. In the navigation pane on the left, choose Logging > Real-time Log Query.

   4. On the Real-time Log Query tab, enter the following query statement to query the most frequently accessed files and their corresponding hot-spot IP addresses in examplebucket. The results are sorted by the number of access requests, and the top 5 records are returned.

      * and __topic__: oss_access_log and bucket: examplebucket
      | SELECT 
          client_ip AS ip_address, 
          request_uri AS file_path, 
          COUNT(*) AS access_count, 
          SUM(content_length_out) AS total_bytes_sent
      FROM 
          log
      WHERE 
          http_status = 200
      GROUP BY 
          request_uri, client_ip
      ORDER BY 
          access_count DESC
      LIMIT 5;

      After running the preceding query, 5 records are returned, sorted in descending order by access_count. The access counts are 26, 24, 16, 16, and 16, with corresponding total_bytes_sent values of 6630, 5508, 20728, 21060, and 21096.

   If real-time log query is not enabled for the bucket

   1. Log on to the OSS console.

   2. In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.

   3. In the navigation pane on the left, choose Data Usage > Ranking Statistics, and then click the Referer/IP Address Rankings tab to view the top 10 referers/IP addresses.

   4. In the navigation pane on the left, choose Data Usage > Object Access Statistics to view the names of frequently accessed files and the outbound traffic that they generate.

2. Determine whether the traffic is abnormal.

   • If certain IP addresses frequently request specific objects, this may indicate malicious behavior. Proceed to Step 3 to check configurations.

   • If multiple IP addresses access different objects, the content may be widely shared (e.g., via social media). Proceed to Step 4 to configure CDN acceleration.

3. Check the relevant configurations.

   Configuration item	Threat description	Solution
   The bucket ACL is set to public-read or public-read-write.	Anyone, including anonymous users, can read bucket files, generating excessive outbound traffic fees.	Set the bucket ACL to private. All unsigned or unauthorized requests will then fail. Bucket ACL
   The ACL of a frequently accessed file is set to public-read or public-read-write. In the OSS file details panel, you can view the current value of File ACL. Click Set Read/Write Permission to modify the permission.	Anyone, including anonymous users, can read the file, generating excessive outbound traffic fees.	Set the object ACL to private. Object ACL. Users can then access the file only via a signed URL within its validity period.
   The bucket policy does not restrict the IP addresses that are allowed to access the bucket.	Unknown IP addresses frequently requesting objects generate excessive outbound traffic fees.	Use a bucket policy to block the suspicious IP addresses identified in Step 1. In the Add Authorization panel, set the authorized user to All Accounts (*), set the authorized action to Deny Access, select IP = in the condition area, and enter the IP addresses to be blocked. Use a bucket policy to grant permissions to access OSS
   Referer hotlink protection is not configured to prevent other websites from referencing OSS files.	Other websites can embed your OSS file URLs (images, videos), shifting traffic to your account and causing a surge in outbound traffic fees.	Configure a Referer blacklist to restrict access from malicious referers found in Step 1, or configure a Referer whitelist to prevent unauthorized use of your OSS resources. Configure hotlink protection.

4. Configure CDN to accelerate access to OSS.

   If the traffic surge is caused by content delivery, use CDN to distribute static resources (images, videos, documents) in OSS. This reduces outbound traffic fees and improves loading speed. Accelerate access to OSS using CDN.

To have the requester pay for outbound Internet traffic and origin traffic instead of the bucket owner, enable pay-by-requester mode. Pay by requester.

Outbound Internet traffic is generated by calling OSS API operations (e.g., GetObject) to transfer data to clients. Since each API call incurs a request fee, request fees naturally accompany outbound traffic fees.