CDN:Origin fetch from private OSS buckets

How it works and benefits

• How it works: After you enable this feature, when CDN or DCDN sends an origin fetch request to your private OSS bucket, they automatically add an Authorization field to the request header. The value of this field is a valid signature generated from the authorized identity information, such as an STS temporary token or an AccessKey. OSS uses this signature to authenticate the request.

• Secure access: By granting CDN or DCDN limited, read-only permissions, you ensure the legitimacy of origin fetch requests and avoid the security risks of making a private bucket public.

• Cost optimization: End-user requests are served from the CDN cache, which is more cost-effective than serving them directly from OSS. Origin fetch traffic from CDN or DCDN to OSS is billed as lower-priced CDN origin fetch traffic, not as more expensive outbound Internet traffic from OSS. This reduces your overall costs. For more information, see Billing of CDN-accelerated OSS resources.

Procedure

The configuration involves two steps: first, grant one-time authorization for your account, and then enable the feature for a specific accelerated domain name.

1. Authorize CDN or DCDN to access OSS. Before you can enable this feature for any domain name in your account, you must grant CDN or DCDN permission to access OSS. This is a one-time, account-level operation. If you are not prompted to grant authorization, skip to the next step.

   (Recommended) One-click authorization

   1. Log on to the CDN console.

   2. In the left-side navigation pane, click Domain Names.

   3. On the Domain Names page, find the domain name that you want to manage and click Manage in the Actions column.

   4. In the left-side navigation pane of the domain name's configuration page, click Origin Fetch.

   5. In the Alibaba Cloud OSS Private Bucket Access section, click Authorize. In the confirmation dialog box that appears, click Authorize.

      The Role Authorization row indicates that the CDN service is not authorized to access your OSS buckets. The Status switch is off by default.

   (Alternative) Manual authorization with RAM

   1. Log on to the RAM console.

   2. In the left-side navigation pane, choose Permissions> Policies.

   3. On the Policies page, click Create Policy.

   4. On the Script Editor tab, enter the following policy content:

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "oss:List*",
                   "oss:Get*"
               ],
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }

   5. Click OK. On the Create Policy page, enter the following information and click OK.

   6. Policy Name: AliyunCDNAccessingPrivateOSSRolePolicy

   7. Remarks: An authorization policy for the role that allows CDN or DCDN to perform origin fetch from a private OSS bucket. This policy grants read-only permissions to OSS.

   In the left-side navigation pane, choose Identities> Roles.

   1. On the Roles page, click Create Role.

   2. Set Trusted Principal Type to Cloud Account, select Current Cloud Account as the Trusted Principal Name, and click OK.

   3. In the Create Role step, enter the following information.

   4. Role Name: AliyunCDNAccessingPrivateOSSRole

   After the role is created, find and click AliyunCDNAccessingPrivateOSSRole in the list on the Roles page to open the role details page.

   1. On the Trust Policy tab, click Edit Trust Policy, enter the following content, and then click OK.

   {
     "Statement": [
       {
         "Action": "sts:AssumeRole",
         "Effect": "Allow",
         "Principal": {
           "Service": [
             "cdn.aliyuncs.com"
           ]
         }
       }
     ],
     "Version": "1"
   }

   2. Switch to the Permissions tab. On the Authorize tab, click Add Authorization.

   3. Resource Scope: Account Level

   4. Principal: Select the AliyunCDNAccessingPrivateOSSRole role that you created.

   5. Policy: Select Custom Policy, select the AliyunCDNAccessingPrivateOSSRolePolicy policy that you created, and then click Confirm New Authorization.

   After you click Confirm New Authorization, return to the Origin Fetch page in the CDN console. You can see that the Alibaba Cloud OSS Private Bucket Access feature is now authorized.

2. Enable Alibaba Cloud OSS Private Bucket Access and configure the origin type.

   1. In the Alibaba Cloud OSS Private Bucket Access section, turn on the switch.

   2. In the Alibaba Cloud OSS Private Bucket Access dialog box that appears, select an origin type and click OK.

      Origin type	Description
      Bucket in the Same Account	(Recommended) Use this option when the CDN or DCDN service and the OSS bucket belong to the same Alibaba Cloud account. The system uses an STS temporary token for authentication, which simplifies configuration, eliminates key management, and improves security. You can also use an STS temporary token for cross-account origin fetch. For more information, see Use STS to access a private OSS bucket in a different account.
      Bucket Across Accounts or in the Same Account	Use this option when the CDN or DCDN service and the OSS bucket belong to different Alibaba Cloud accounts. This option also supports same-account scenarios. You must provide the AccessKey ID and AccessKey Secret of the account that owns the private OSS bucket. For more information, see Create an AccessKey.

      Note

      • Scope of access: After you enable this feature, the accelerated domain name can access all resources in its origin private bucket. You cannot use CDN or DCDN to restrict access to specific resources within the bucket.

      • Signature conflicts: To prevent OSS authentication failures, ensure that an origin fetch request does not contain signatures in both the request header and URL parameters.

      • Feature conflicts: This feature conflicts with the default index page setting of the static website hosting feature in OSS. If you need to use both features at the same time, see the related documentation.

Security recommendations

After you enable origin fetch from a private bucket, your origin data is secure. However, resources cached on CDN POPs are publicly accessible by default. To prevent traffic theft, use additional security features from CDN or DCDN:

• Configure a Referer blacklist or whitelist: Restrict access to your CDN resources to requests from specific websites.

• Configure URL signing: Set a dynamic signature and an expiration time for your resource URLs to effectively prevent malicious downloads.

Disable private OSS bucket origin fetch

If you no longer want an accelerated domain name to access resources in a private bucket, you can go to the Resource Access Management (RAM) console to revoke the authorization for the corresponding role. This revokes the permissions that allow CDN to access the private OSS bucket.

1. Disable the feature in the CDN console.

   1. Log on to the CDN console.

   2. In the left-side navigation pane, click Domain Names.

   3. On the Domain Names page, find the domain name that you want to manage and click Manage in the Actions column.

   4. In the left-side navigation pane, click Origin Fetch.

   5. In the Alibaba Cloud OSS Private Bucket Access section, turn off the Alibaba Cloud OSS Private Bucket Access switch.

2. Permanently delete the authorization in the RAM console.

   1. Log on to the RAM console.

   2. In the left-side navigation pane, choose .

   3. In the Role Name list, click the AliyunCDNAccessingPrivateOSSRole role.

      On the role details page, go to the Permissions tab. You can view the authorized system policy, which has the remark "An authorization policy for the role that allows CDN/DCDN to perform origin fetch from a private OSS bucket and grants read-only permissions to OSS". The resource scope is Account Level. The Actions column provides a Revoke Authorization link, and there is a Delete Role button in the upper-right corner of the page.

   4. Remove all permissions from the AliyunCDNAccessingPrivateOSSRole role.

      1. Click Revoke Authorization for the policy.

      2. In the confirmation dialog box that appears, click Revoke Authorization.

   5. Return to the page and delete the AliyunCDNAccessingPrivateOSSRole role.

      1. Find the AliyunCDNAccessingPrivateOSSRole role and click Delete Role in the Actions column.

      2. In the Delete Role confirmation dialog box, click Delete Role.

   6. Return to the page and delete the AliyunCDNAccessingPrivateOSSRolePolicy policy.

      1. Find the AliyunCDNAccessingPrivateOSSRolePolicy policy and click Delete Policy in the Actions column.

      2. In the Delete Policy confirmation dialog box, enter the policy name and click Delete Policy.

FAQ

Related documentation

Best practices for using CDN to accelerate access to OSS resources