OSS distributed denial of service attack (DDoS) protection is a proxy-based mitigation service that integrates OSS with DDoS protection. When your protected OSS bucket suffers DDoS attacks, OSS DDoS protection diverts malicious traffic to an Anti-DDoS Pro or Anti-DDoS Premium instance for scrubbing and then redirects normal traffic to the bucket. This way, your business can continue to function normally even after DDoS attacks.


A custom domain name is bound to a bucket. For more information, see Map custom domain names.

Background information

OSS DDoS protection is in public preview in the China (Shanghai), China (Qingdao), and China (Shenzhen) regions.Contact technical support to apply for a trial.

When you use OSS DDoS protection, take note of the following items:

  • OSS DDoS protection instances must be retained for at least seven days after the instances are created. If the instances are deleted within seven days, OSS charges basic resource fees for the instances for a period of seven days.
  • You can create only one OSS DDoS protection instance in each region. Each instance can be attached to up to 10 buckets within the same region.

For more information, see OSS DDoS protection.


  1. Create an OSS DDoS protection instance.
    1. Log on to the OSS console.
    2. In the left-side navigation pane, click Anti-DDoS Pro.
    3. Click Create Anti-DDoS Instance.
    4. In the Create Anti-DDoS Instance panel, select the required region.
    5. Click OK.
      After the OSS DDoS protection instance is created, it enters the Initializing state. You can attach the instance to a bucket when the instance enters the Defending state.
  2. Attach the OSS DDoS protection instance to a bucket.
    1. Click View and Attach Buckets to the right of the instance that you want to attach.
    2. In the View and Attach Buckets panel, click Attach Buckets.
    3. In the Attach Buckets panel, select a bucket you want to attach from the Buckets drop-down list.
      Buckets to which OSS DDoS protection instances are attached or custom domain names are not bound are not displayed in the Attach Buckets drop-down list.
    4. Click OK.
      After the instance is attached to the bucket, the bucket is in the Initializing state. When the status becomes Defending, the OSS DDoS protection instance has started to protect the bucket.