Function Compute:Configure an OSS file system

Limits

• You can configure a maximum of five NAS mount targets and five OSS mount targets for a service in Function Compute in a region.

• The local directories in the function runtime of the NAS mount target cannot be the same as the local directories in the function runtime of the OSS mount target.

For more information about how to configure a mount target of a NAS file system, see Configure a NAS file system.

Before you start

• OSS

  • Activate OSS

  • Create a bucket in the OSS console.

• Function Compute

  • Creates a service. For more information, see Create a service.

  • Configure permissions. When you enable the OSS mounting feature, you need to configure a role that has permissions on OSS for the service in Function Compute. For more information, see Grant Function Compute permissions to access other Alibaba Cloud services.

Configure OSS mounting

After an OSS mount target is configured for a service in Function Compute, all functions in the service can access files in the specified OSS bucket.

1. Log on to the Function Compute console. In the left-side navigation pane, click Services & Functions.

2. In the top navigation bar, select a region. On the Services page, find the desired service and click Configure in the Actions column.

3. In the Storage Configuration section on the Modify Service page, configure the following parameters and click Save.

   • Mount OSS: Specify whether to enable OSS mounting. Valid values:

     • Enable

     • Disable

   • OSS Mount Target: Configure the OSS mount targets.

     • Bucket: Select an existing bucket. To create an OSS bucket, click Create OSS Bucket in the lower part to go to the OSS console and create a bucket. For more information about the billing of OSS, see Billing overview.

     • Bucket Subdirectory: Specify a subdirectory in the bucket. The subdirectory must be an absolute path. If you leave this parameter empty or set this parameter to /, the root directory of the bucket is mounted.

     • OSS Endpoint: Select the endpoint. By default, the endpoint of the bucket is used. You can select Custom Endpoint to change the value of the endpoint based on your business requirements. For more information about OSS endpoints in different regions, see Regions and endpoints.

     • Local directory of a function: Specify the local directory in the function runtime environment. The directory must be a subdirectory of /home, /mnt, or /data.

     • Permissions on the local directory of the function: Select the permissions on the directory after the bucket is mounted to the local directory in the function runtime. You can select Read-only or Read and Write.

     Note

     • If you select a bucket in the same region as the service in Function Compute, we recommend that you use an OSS internal endpoint. If you select a bucket in a different region, you must use a public endpoint. In this case, you are charged for outbound traffic over the Internet. For more information about the formats of OSS endpoints, see Regions and endpoints.

     • The OSS mounting feature depends on the network configurations of the service. If you set Access to VPC to Yes and Access to Internet to No, you must use a public OSS endpoint so that the functions can access the Internet through the specified VPC. For more information, see Configure static public IP addresses.

FAQ

What do I do when OSS mounting failed and the bucket not found error message is reported?

Make sure that the OSS endpoint and bucket name are correct:

What do I do if OSS mounting fails and the host resolv error or deadline exceeded error is reported?

What do I do if OSS mounting fails and the invalid credentials error is reported?

What do I do if the Transport endpoint is not connected error is reported when I access a mount target within a function instance.

This error may be reported when the OSS mounting feature becomes unavailable due to insufficient memory, which may be caused by low memory specifications or large memory usage. We recommend that you increase the memory specification of your function based on your business requirements. Set the memory capacity to at a value greater than or equal to 512 MB if you use OSS mount targets.

How do I use a permission policy to allow only read-only accesses to a specified bucket?

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "oss:ListObjects",
        "oss:GetObject"
      ],
      "Resource": [
        "acs:oss:*:*:bucketName",
        "acs:oss:*:*:bucketName/*"
      ],
      "Effect": "Allow"
    }
  ]
}

How do I use a permission policy to allow read and write accesses to a specified bucket?

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "oss:ListObjects",
        "oss:GetObject",
        "oss:PutObject",
        "oss:DeleteObject",
        "oss:AbortMultipartUpload",
        "oss:ListParts"
      ],
      "Resource": [
        "acs:oss:*:*:bucketName",
        "acs:oss:*:*:bucketName/*"
      ],
      "Effect": "Allow"
    }
  ]
}

How do I use a permission policy to allow only read-only accesses to the subdirectories of a specified bucket?

{
  "Version": "1",
  "Statement": [
    {
      "Action": "oss:ListObjects",
      "Effect": "Allow",
      "Resource": [
        "acs:oss:*:*:bucketName"
      ],
      "Condition": {
        "StringLike": {
          "oss:Prefix": [
            "bucketPath/*"
          ]
        }
      }
    },
    {
      "Action": [
        "oss:GetObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:oss:*:*:bucketName/bucketPath/*"
      ]
    }
  ]
}

How do I use a permission policy to allow read and write accesses to subdirectories of a specified bucket?

{
  "Version": "1",
  "Statement": [
    {
      "Action": "oss:ListObjects",
      "Effect": "Allow",
      "Resource": [
        "acs:oss:*:*:bucketName"
      ],
      "Condition": {
        "StringLike": {
          "oss:Prefix": [
            "bucketPath/*"
          ]
        }
      }
    },
    {
      "Action": [
        "oss:GetObject",
        "oss:PutObject",
        "oss:DeleteObject",
        "oss:AbortMultipartUpload",
        "oss:ListParts"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:oss:*:*:bucketName/bucketPath/*"
      ]
    }
  ]
}

What do I do if I cannot see the data I write from the OSS mount target on the OSS side?

When you write a file from an OSS mount target, the system uploads the content to OSS only when you call Flush or close the file.

What do I do if operations, such as compression, decompression, and file transmission, in an OSS mount target are slow?

OSS does not support file system APIs. After you mount an OSS bucket as a directory, Function Compute encapsulates OSS API as the file system API. For example, OSS does not support random writes. If you need to use the file system API to change an existing file on an OSS mount target, Function Compute downloads the source file from OSS, rewrites the file, and then uploads it to OSS again.

When the features of file system API correspond to those of OSS API, such as the sequential file read and write feature, the performance of general operations is usually better. However, for operations that require OSS APIs to be combined and encapsulated, such as random read and write operations on files during compression and decompression, multiple interactions with OSS may be required. Therefore, the performance is slightly lower than that of the local file system.

Are operations synchronized among function instances on the same OSS target?

No. Function instances are independent of each other. The content of OSS mount targets accessed by different instances may be different. For example, when Instance A creates the file F in the OSS mount target, Instance B may not be able to access the file right away.