All Products
Search

This Product

    CDN:Accelerate OSS resources with CDN

    Document Center

    CDN:Accelerate OSS resources with CDN

    Last Updated:Jul 03, 2026

    Cache static resources from Object Storage Service (OSS) on global CDN edge nodes for faster user access and reduced origin load.

    Note: If you use a default OSS domain name (for example, {bucket}.oss-cn-hangzhou.aliyuncs.com), you cannot enable CDN acceleration on it directly. To use CDN, you must associate a custom domain name with your bucket and update your application's URLs to use that custom domain name.

    Use cases

    Combining low-cost OSS storage with CDN acceleration offers these benefits:

    • CDN routes all user resource requests, reducing the load on the origin.

    • CDN outbound traffic costs less per unit than direct OSS internet egress traffic.

    • CDN serves resources from the edge node closest to the client, reducing network distance and access latency.

    Light video workloads: This solution pairs low-cost OSS storage with CDN edge delivery to reduce latency at minimal cost. For advanced features such as transcoding, encryption, or player integration, use ApsaraVideo VOD instead.

    Static image workloads: CDN outbound traffic costs less than OSS internet egress. For users within the Chinese mainland, the speed difference between CDN+OSS and direct OSS access is minimal, but CDN still improves the experience by caching content on closer edge nodes. The OSS transfer acceleration domain name is better suited for cross-region scenarios or as a CDN back-to-origin address for cross-border access.

    How it works

    When a user requests a resource, CDN routes the request to the nearest edge node:

    • Cache hit: If the node has the requested resource cached, it serves the resource directly to the user, providing the fastest response.

    • Cache miss: If the node does not have the resource cached, it sends a back-to-origin request to the origin (the OSS bucket) to retrieve the resource. The node then returns the resource to the user and caches it for subsequent requests.

    Procedure

    Step 1: Register domain and complete ICP filing

    According to the regulations of the Ministry of Industry and Information Technology (MIIT) of the People's Republic of China, all websites that provide services in the Chinese mainland must complete ICP filing. Domain names purchased on the Alibaba Cloud International site do not currently support ICP filing. If you need to provide services in the Chinese mainland (by resolving the domain name to a server in the Chinese mainland), you must first complete the ICP filing process or learn about the GoChina ICP filing service.

    Step 2: Add accelerated domain and configure OSS origin

    Add an accelerated domain name in the CDN console and associate it with the OSS bucket that serves as the origin.

    1. Log on to the CDN console.

    2. Click Add Domain Name and configure the basic information for your accelerated domain name:

      • Domain Name to Accelerate: Enter your custom domain name (for example, www.example.com). Wildcard domains (for example, *.example.com) are supported. This is the public-facing domain name you want to accelerate with CDN, not the default OSS domain name.

      • Region: Select a region based on the geographic location of your primary user base.

      • Business Type: Select a type based on your content. For example, for images and small web files under 20 MB, select "Image and Small File".

        • When you add a domain name for the first time, you must verify domain ownership. You can use file-based verification or DNS-based verification.

        • If you select Chinese mainland or Global as the acceleration region, the accelerated domain name must have an ICP filing. Otherwise, the system blocks it during ICP validation.

        • If DNS verification fails, check whether the domain name has completed ICP filing (for acceleration in the Chinese mainland) and whether your DNS records conflict.

    3. Click Add Origin Server and enter the OSS information:

      • Origin Info: Select OSS Domain as the origin type.

      • Domain Name: When the origin type is OSS Domain, you can select the public endpoint of an existing OSS bucket under your account from the drop-down list.

      When configuring multiple origins, you can set the following parameters:

      Parameter

      Description

      Priority

      Primary (20) or backup (30).

      Weight

      The valid range is 1 to 100. For single-origin scenarios, you can keep the default value.

      Port

      The default port is 80 for HTTP and 443 for HTTPS. Custom ports from 1 to 65535 are supported. When the origin type is Function Compute, the port is automatically set to 80.

    4. Click OK. After the domain name is added, you are redirected to the Recommended Configuration tab.

    Step 3: Configure core acceleration policies

    Configure cache expiration, Range back-to-origin, and parameter filtering to improve cache hit rates, access performance, and security.

    Configure cache expiration

    Caching rules are evaluated in order, and the first matching rule applies. In the CDN console, navigate to the management page for your domain name and select the Cache feature. The following table provides recommended settings:

    File type

    File extension

    Expiration time

    Description

    Images/Audio/Video

    jpg,png,gif,mp3,mp4

    30 days

    For content that does not change often.

    Static scripts

    js,css

    1 hour

    For content that may change frequently with new releases.

    Website homepage

    html

    Do not cache (0 seconds)

    Ensures users always get the latest page structure.

    If you serve both large videos and small audio files, configure separate cache policies by file type. For large video files such as MP4, set a longer expiration time (for example, 30 days) and enable Range back-to-origin for chunked retrieval and faster initial playback. For small files such as MP3s, a long expiration time is sufficient without Range back-to-origin. Add separate cache rules for the .mp4 and .mp3 extensions.

    Configure parameter filtering

    In the CDN console, navigate to the management page for your domain name and select Ignore Parameters under Optimization. When parameter filtering is enabled, CDN strips query parameters after the ? from the cache key, so requests for the same resource hit the same cached object regardless of query parameters. This increases the cache hit rate and reduces back-to-origin traffic.

    Enable Range back-to-origin

    With Range back-to-origin enabled, OSS returns only the requested byte range instead of the entire file, reducing back-to-origin traffic and response time for large files such as audio and video. This feature is not recommended for small files such as images.

    Configure automatic OSS cache refresh

    To keep CDN content in sync with OSS, go to the Bucket Settings > Domain Names page in the OSS console. For the target domain name, enable OSS target domain binding and Auto CDN Cache Update, then select the operations that trigger an automatic refresh. OSS then automatically triggers a CDN refresh task when content is updated.

    This feature is event-driven and does not guarantee 100% delivery or real-time updates. Under high-concurrency writes or network jitter, refresh events may be lost. For scenarios that require real-time updates, use the CDN refresh and prefetch features directly.

    Step 4: Configure DNS and verify configuration

    1. Go to the domain name management list in the CDN console, find the domain name you added, and copy its CNAME value. If the value is empty, wait a few seconds and refresh the page.

    2. Using the Alibaba Cloud account that owns the accelerated domain name, log on to the Alibaba Cloud DNS console. On the Public Zone page, find the target domain name and click Settings.

    3. Click Add record to create a CNAME record:

      • Record Type: Select CNAME.

      • Hostname: Enter the prefix of the subdomain (for example, www).

      • Record Value: Paste the CNAME value you copied from the CDN console.

      • Keep the default values for the other parameters, and then click Confirm.

    Verify that traffic is routed through CDN

    After configuring DNS, verify that CDN is routing your traffic using one of the following methods:

    • Use curl -I to inspect the response header: Run curl -I https://your-domain.com/file in a terminal and check the X-Cache field in the response header. A response of X-Cache: HIT or X-Cache: MISS indicates that the request was served by CDN. If the X-Cache field does not appear, the request may have gone directly to OSS.

    • Check the monitoring data in the CDN console: Log on to the CDN console and check whether the domain name has traffic data. If data appears after the configuration takes effect, traffic is flowing through CDN.

    • Check the CNAME status: In the CDN console, check that the CNAME status for the target domain name is Configured. There are three CNAME statuses: Configured (green), Pending Configuration (yellow), and Detection Timed Out.

    If your domain name resolves to both OSS and CDN, requests may bypass CDN and go directly to OSS. Ensure that your DNS settings contain only the CNAME record pointing to CDN, and remove any A records or CNAME records that point directly to the OSS domain name.

    Step 5: Configure security

    Enable HTTPS

    If your domain name used HTTPS before you added it to CDN, you must configure an SSL certificate in the CDN console. Otherwise, CDN cannot serve HTTPS content for that domain.

    Note

    Enabling HTTPS incurs charges for static HTTPS requests. Charges for HTTPS requests cannot be offset by CDN data transfer plans. Please ensure that your account has a sufficient balance or purchase an HTTPS request pack to avoid service suspension due to overdue payments. For more information, see Static HTTPS requests.

    1. Go to the domain name management list in the Alibaba Cloud CDN console, find the domain name you added, and click its name to go to the domain configuration page.

    2. Select the HTTPS tab, then under SSL Certificate, click Modify.

    3. On the Modify HTTPS Settings page, turn on the HTTPS Secure Acceleration switch and select a certificate:

      Certificate type

      Description

      SSL Certificates Service

      Select an existing certificate from your account's Certificate Management Service.

      Custom Certificate (Certificate+Private Key)

      Manually upload the certificate content and private key in PEM format. You need to set a certificate name and upload the certificate and private key.

      A free DV certificate from Alibaba Cloud and Digicert, valid for one year with automatic renewal. Wildcard domains are not supported. You must select the authorization consent checkbox.

      CSR Certificate

      To be used after you submit a CSR (Certificate Signing Request).

      If you have purchased a certificate from Alibaba Cloud Certificate Management Service, select SSL Certificates Service and select the purchased certificate.

      If you cannot select the purchased certificate, check whether the domain name bound to the certificate is the same as the accelerated domain name. If you are using a certificate issued by a third-party service provider, select Custom Certificate (Certificate+Private Key) and upload the Certificate (Public Key). The certificate will be saved to Alibaba Cloud Certificate Management Service. You can go to My Certificates to view it.

    Authorize CDN access to private buckets

    If your OSS bucket is private, you must authorize CDN to access it. Otherwise, all back-to-origin requests from CDN will fail due to insufficient permissions.

    1. Go to the domain name management list in the Alibaba Cloud CDN console, click the domain name you added previously to go to its configuration page.

    2. In the Origin Fetch section, turn on Alibaba Cloud OSS Private Bucket Access, and then select Bucket in the Same Account. If you need to configure cross-account back-to-origin, see Back-to-origin to private OSS bucket.

    Configure URL authentication

    URL authentication (hotlink protection with timestamp) adds a signature and expiration time to access URLs, preventing unauthorized hotlinking and resource theft.

    1. Go to the domain name management list in the Alibaba Cloud CDN console, click the domain name you added previously to go to its configuration page.

    2. On the Access Control tab, select Set URL Signing and click Modify.

    3. On the configuration page, select Type A, set a Primary Key and a Secondary Key (at least one key is required), and keep them secure. These keys are used on the server to validate signed URLs. For a usage example, see Description of authentication Type A.

    4. Set the validity period of the authenticated URL based on your business needs, for example, 1800 seconds.

    Configure usage cap

    A usage cap limits bandwidth, traffic, and static HTTPS request count for the domain name, helping prevent unexpected bills from attacks or traffic spikes.

    1. Go to the Domain Management page in the Alibaba Cloud CDN console, find the target domain name, and click Manage in the Actions column.

    2. In the left-side navigation pane for the specified domain name, click Traffic Throttling.

    3. On the Usage Cap tab, refer to the feature description to configure a usage cap policy.

    4. Click Configure. You can choose a suitable Statistical Period, Cap, and Unblocking Time based on your business needs. For specific parameter configurations, see the feature description.

    5. Click OK. The capping rule is created and takes effect immediately.

    Monitoring and alerts

    Set up real-time monitoring: Monitor peak bandwidth of a specified domain name in CDN. When bandwidth reaches the configured threshold, the system notifies administrators for early risk detection.

    Set up billing alerts: In the top navigation bar of the console, select Billing and cost management and use the following features to control your account's spending:

    • Available credit alert: Configure an alert to be sent to your designated contacts when your account balance falls below a specified amount.

    Billing

    When you use OSS as a CDN origin, you may incur the following charges:

    • CDN outbound traffic fees: Charged for outbound traffic when users access resources through CDN. CDN outbound traffic typically costs less than direct OSS internet egress traffic. You can purchase a CDN data transfer plan to further reduce costs — the system applies the plan automatically with no additional configuration.

    • Back-to-origin traffic fees: Fees for outbound traffic from OSS generated when CDN fetches content from your origin.

    • Static HTTPS request fees: Fees incurred after you enable HTTPS secure acceleration.

      Charges for HTTPS requests cannot be offset by CDN data transfer plans. You must purchase a static HTTPS request resource plan separately or ensure that your account has a sufficient balance.

    FAQ

    FAQs for accelerating OSS with CDN