Use GET_SIGNED_URL_FROM_OSS for Pre-Signed OSS URLs - MaxCompute

GET_SIGNED_URL_FROM_OSS generates a pre-signed URL for an object in Object Storage Service (OSS). The URL grants temporary HTTP access—GET for download or PUT for upload—without requiring OSS credentials. Anyone with the URL can access the object until it expires.

Use this function when you need to share OSS objects with systems or users that don't have OSS credentials, such as downloading query results from an Elastic Compute Service (ECS) instance or exposing files to an external pipeline.

Limits

Object Tables can only be created within the OSS internal network.
GET_SIGNED_URL_FROM_OSS is not supported for MaxQA query acceleration. Add SET odps.mcqa.disable=true; before the SQL statement.
If the Block Public Access feature is enabled for an OSS bucket, this function cannot generate a publicly accessible pre-signed URL. Make sure the bucket permissions allow signed URL generation and use.

Syntax

STRING GET_SIGNED_URL_FROM_OSS (
  STRING <full_object_table_name>,
  STRING <key>
  [, INT <timeToLiveSeconds>]
  [, DATETIME <expiration>]
  [, STRING <httpMethod>]
)

Parameters

Parameter	Required	Data type	Description	Default
`full_object_table_name`	Yes	STRING	The full path of the Object Table in the Layer 3 model, such as `project.schema.object_table`. If the table was created with RoleARN authentication, this parameter automatically generates a Security Token Service (STS) token to access OSS.	None
`key`	Yes	STRING	The name of the object to access in the Object Table. See the description of the `key` column in View Object Table properties.	None
`timeToLiveSeconds`	No	INT	The validity period of the pre-signed URL in seconds. Minimum: 1 second. Maximum: 604,800 seconds (7 days). Mutually exclusive with `expiration`.	3600
`expiration`	No	DATETIME	The expiration time of the pre-signed URL. Must be at least 1 second and no more than 604,800 seconds (7 days) after the current time. Mutually exclusive with `timeToLiveSeconds`.	3600 seconds after current time
`httpMethod`	No	STRING	The HTTP method for the generated URL: `GET` (download from OSS) or `PUT` (upload to OSS).	`GET`

timeToLiveSeconds and expiration are mutually exclusive. Specify one or the other, not both.

Return value

Returns a STRING containing the generated pre-signed URL.

Examples

Quick example

If you already have an Object Table, generate a pre-signed URL directly:

SELECT GET_SIGNED_URL_FROM_OSS(
  '<project_name>.<schema_name>.your_object_table',
  key
)
FROM your_object_table;

The function returns one pre-signed URL per row, valid for 3600 seconds by default.

End-to-end example: generate a URL and download an OSS object

This example uses the China (Hangzhou) region to show the full flow: create an Object Table, generate a pre-signed URL, and download the object from an ECS instance.

Replace project_name and schema_name with your actual project and schema names.

Step 1: Set up the Object Table

Log on to the OSS console and upload the test file signedget.txt to the object-table-test/object_table_folder directory. For more information, see Upload files.

Use a local client (odpscmd) or create a MaxCompute SQL node in DataWorks to run the following SQL statements:

-- Enable the Layer 3 model for schema support.
SET odps.namespace.schema=true;

-- Select the target MaxCompute project.
USE <project_name>;

-- Select the target schema.
USE SCHEMA <schema_name>;

-- Enable the ODPS 2.0 data type system.
SET odps.sql.type.system.odps2=true;

-- Disable MaxQA query acceleration (required for this function).
SET odps.mcqa.disable=true;

-- Create an Object Table pointing to the OSS path.
CREATE OBJECT TABLE IF NOT EXISTS test_get_signed_url_from_oss
LOCATION 'oss://oss-cn-hangzhou-internal.aliyuncs.com/object-table-test/object_table_folder/';

-- Refresh the metadata cache.
ALTER TABLE test_get_signed_url_from_oss REFRESH METADATA;

Query the Object Table metadata to confirm the object is visible:

SELECT * FROM test_get_signed_url_from_oss;

Expected output:

+---------------+------------+------------+---------------------+---------------+----------------------------------+--------------+------------+--------------------+
| key           | size       | type       | last_modified       | storage_class | etag                             | restore_info | owner_id   | owner_display_name |
+---------------+------------+------------+---------------------+---------------+----------------------------------+--------------+------------+--------------------+
| signedget.txt | 38         | Normal     | 2025-06-04 01:36:52 | Standard      | 96D8258845DAB51BC9B****6E61A2563 | NONE         | 13****     | 13****             |
+---------------+------------+------------+---------------------+---------------+----------------------------------+--------------+------------+--------------------+

(Optional) Read the object content using GET_DATA_FROM_OSS:

SELECT
  STRING(
    GET_DATA_FROM_OSS(
      '<project_name>.<schema_name>.test_get_signed_url_from_oss',
      key
    )
  )
FROM test_get_signed_url_from_oss;

Expected output:

+----------------------------------------+
| _c0                                    |
+----------------------------------------+
| test maxcompute download files by url  |
+----------------------------------------+

Step 2: Generate the pre-signed URL

Run the following query to generate a download URL for each object in the table:

SELECT GET_SIGNED_URL_FROM_OSS(
  '<project_name>.<schema_name>.test_get_signed_url_from_oss',
  key
)
FROM test_get_signed_url_from_oss;

Expected output:

+------------+
| _c0        |
+------------+
| http://object-table-test.oss-cn-hangzhou-internal.aliyuncs.com/object_table_folder%2Fsignedget.txt?Expires=17490****&OSSAccessKeyId=STS.****&Signature=****&security-token=**** |
+------------+

Step 3: Download the object from an ECS instance

Log on to the ECS console. In the left navigation pane, choose Instances & Images > Instances.
Switch to the China (Hangzhou) region, select the target instance, click Remote Connection, and connect using Workbench.

In the terminal, run the following commands to download the object:

# Switch to the /opt directory.
cd /opt

# Download the object using the pre-signed URL.
curl -o /opt/ecs_signed.txt "http://object-table-test.oss-cn-hangzhou-internal.aliyuncs.com/object_table_folder%2Fsignedget.txt?Expires=17490****&OSSAccessKeyId=STS.****&Signature=****&security-token=****"

The following figure shows the result:

yuddd

What's next

For other functions that process unstructured data, see Functions for processing unstructured data.