Object Storage Service:Traffic fees

If you experience a sudden and abnormal increase in outbound traffic over the Internet for your bucket, you can use the following methods to troubleshoot the issue.

1. Identify the traffic abnormality.

   If real-time log query is enabled for the bucket

   1. Log on to the OSS console.

   2. In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.

   3. In the navigation pane on the left, choose Logging > Real-time Log Query.

   4. On the Real-time Log Query tab, enter the following query statement to query the most frequently accessed files and their corresponding hot-spot IP addresses in examplebucket. The results are sorted by the number of access requests, and the top 5 records are returned.

      * and __topic__: oss_access_log and bucket: examplebucket
      | SELECT 
          client_ip AS ip_address, 
          request_uri AS file_path, 
          COUNT(*) AS access_count, 
          SUM(content_length_out) AS total_bytes_sent
      FROM 
          log
      WHERE 
          http_status = 200
      GROUP BY 
          request_uri, client_ip
      ORDER BY 
          access_count DESC
      LIMIT 5;

      The following figure shows the query result.

      

   If real-time log query is not enabled for the bucket

   1. Log on to the OSS console.

   2. In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.

   3. In the navigation pane on the left, choose Data Usage > Ranking Statistics, and then click the Referer/IP Address Rankings tab to view the top 10 referers/IP addresses.

   4. In the navigation pane on the left, choose Data Usage > Object Access Statistics to view the names of frequently accessed files and the outbound traffic that they generate.

2. Determine whether the traffic is abnormal.

   • If you find that certain IP addresses frequently request specific objects, this may indicate malicious behavior. Proceed to Step 3 to check the relevant configurations.

   • If you find that multiple IP addresses are accessing different objects, the content may be widely distributed, such as through social media. Proceed to Step 4 to configure CDN to accelerate access to OSS.

3. Check the relevant configurations.

   Configuration item	Threat description	Solution
   The bucket ACL is set to public-read or public-read-write.	Anyone, including anonymous visitors, can read the files in the bucket. This generates a large amount of outbound data transfer fees.	Set the bucket ACL to private. After you set the ACL to private, all requests without a signature or permission fail. For more information, see Bucket ACL.
   The ACL of a frequently accessed file is set to public-read or public-read-write.	Anyone, including anonymous visitors, can read the file. This generates a large amount of outbound data transfer fees.	Set the object ACL to private. For more information, see Object ACL. After you complete this configuration, users can access the file only using a signed URL within the specified validity period.
   The bucket policy does not restrict the IP addresses that are allowed to access the bucket.	If IP addresses from unknown sources frequently request specific objects, a large amount of outbound data transfer fees are generated.	Use a bucket policy to block access from the hot-spot IP addresses of unknown sources that you found in Step 1. For more information, see Use a bucket policy to grant permissions to access OSS.
   Referer hotlink protection is not configured to prevent other websites from referencing OSS files.	Other websites can directly reference the URLs of your OSS files, such as images and videos, and shift the traffic load to your OSS. This causes a surge in your OSS outbound traffic and results in high bandwidth fees.	Configure a Referer blacklist to restrict access from the malicious referers that you found in Step 1. You can also configure a Referer whitelist to prevent your OSS resources from being used by others. For more information, see Configure hotlink protection.

4. Configure CDN to accelerate access to OSS.

   If you confirm that the surge in outbound traffic is caused by content delivery, you can use CDN to distribute static resources such as images, videos, and documents in OSS. This reduces OSS outbound traffic fees and improves the resource loading speed. For more information, see Accelerate access to OSS using CDN.

If you want the requester, instead of the bucket owner, to pay for outbound traffic over the Internet and origin traffic, you can enable the pay-by-requester mode. For more information, see Pay by requester.

Outbound traffic over the Internet is traffic generated when data is transferred from OSS to a client. This data transfer is performed by calling OSS API operations. OSS charges request fees based on the number of API calls. Therefore, request fees are usually incurred along with fees for outbound traffic over the Internet.