Use GET_SIGNED_URL_FROM_OSS for Pre-Signed OSS URLs - MaxCompute - Alibaba Cloud - MaxCompute

Use cases

MaxCompute provides the Object Table feature, which allows the data warehouse engine to access unstructured data and its metadata stored in OSS. For more information, see Object Table definition.

An Object Table stores the metadata of OSS objects in a specified path. You can use the GET_SIGNED_URL_FROM_OSS function to dynamically generate a pre-signed URL for an object, which enables file uploads and downloads. For more information, see Generate a pre-signed URL to upload and download OSS objects.

Limitations

You can create Object Tables only by using the internal endpoint of OSS.
This function is not supported for MaxQA query acceleration. You must include the SET odps.mcqa.disable=true; command with your SQL statement.
If an OSS bucket has the Block Public Access feature enabled, you cannot use the GET_SIGNED_URL_FROM_OSS function to generate a publicly accessible pre-signed URL. Ensure that your bucket permissions allow the generation and use of pre-signed URLs.

Syntax

STRING GET_SIGNED_URL_FROM_OSS (
  STRING <full_object_table_name>, 
  STRING <key>
  [, INT <timeToLiveSeconds>] 
  [, DATETIME <expiration>]
  [, STRING <httpMethod>]
)

Parameters

Parameter	Required	Type	Description	Default
full_object_table_name	Yes	STRING	The full path of the Object Table in the three-layer model, including the project and schema names. Example: `project.schema.object_table`. If you select RoleARN authentication when you create the table, this parameter helps you automatically generate a Security Token Service (STS) token to access OSS.	None
key	Yes	STRING	The name of the object to access within the Object Table. For more information about the key parameter, see the description in the returned results of View Object Table properties.	None
timeToLiveSeconds	No	INT	The lifetime of the pre-signed URL in seconds. Minimum: 1 second. Maximum: 604,800 seconds (7 days). This parameter is mutually exclusive with expiration.	3,600 seconds
expiration	No	DATETIME	The expiration time of the pre-signed URL. The value must be at least 1 second and no more than 604,800 seconds (7 days) after the current time. This parameter is mutually exclusive with timeToLiveSeconds.	3,600 seconds after the current time
httpMethod	No	STRING	The HTTP method for the generated URL, specifying whether to download (read) from or upload (write) to OSS. GET: Download PUT: Upload	GET

Return value

Returns the generated pre-signed URL as a STRING.

Examples

This example shows how to generate a pre-signed URL to download an OSS object from an Elastic Compute Service (ECS) instance in the China (Hangzhou) region.

Before you run the following code, replace project_name and schema_name with your actual project and schema names.

Step 1: Generate a download URL

Log on to the OSS console and upload the test file signedget.txt to the object-table-test/object_table_folder directory. For more information, see Upload files.

Use a local client (odpscmd) or create a MaxCompute SQL node in DataWorks to create an Object Table and refresh the metadata cache.

-- Enable the three-layer model to support schemas in a MaxCompute project. 
SET odps.namespace.schema=true;
-- Select the MaxCompute project. 
USE <project_name>;
-- Select the schema. 
USE SCHEMA <schema_name>;
-- Enable the 2.0 data type system in the MaxCompute project. 
SET odps.sql.type.system.odps2=true;
-- This function is not supported for MaxQA query acceleration. 
SET odps.mcqa.disable=true;
-- Create an Object Table. 
CREATE OBJECT TABLE IF NOT EXISTS test_get_signed_url_from_oss 
LOCATION 'oss://oss-cn-hangzhou-internal.aliyuncs.com/object-table-test/object_table_folder/';
-- Refresh the table cache. 
ALTER TABLE test_get_signed_url_from_oss REFRESH METADATA;

Query the metadata in the Object Table.

SELECT * FROM test_get_signed_url_from_oss;

Expected output:

+---------------+------------+------------+---------------------+---------------+----------------------------------+--------------+------------+--------------------+
| key           | size       | type       | last_modified       | storage_class | etag                             | restore_info | owner_id   | owner_display_name |
+---------------+------------+------------+---------------------+---------------+----------------------------------+--------------+------------+--------------------+
| signedget.txt | 38         | Normal     | 2025-06-04 01:36:52 | Standard      | 96D8258845DAB51BC9B****6E61A2563 | NONE         | 13****     | 13****             |
+---------------+------------+------------+---------------------+---------------+----------------------------------+--------------+------------+--------------------+

Read the object data by using the GET_DATA_FROM_OSS function.

SELECT 
  STRING(   
    GET_DATA_FROM_OSS(
      '<project_name>.<schema_name>.test_get_signed_url_from_oss',
      key
    )
  )
FROM test_get_signed_url_from_oss;

Expected output:

+----------------------------------------+
| _c0                                    |
+----------------------------------------+
| test maxcompute download files by url  |
+----------------------------------------+

Query the Object Table and generate a pre-signed URL.

SELECT GET_SIGNED_URL_FROM_OSS(  
  '<project_name>.<schema_name>.test_get_signed_url_from_oss',    
  key) 
FROM test_get_signed_url_from_oss;

Expected output:

+------------+
| _c0        |
+------------+
| http://object-table-test.oss-cn-hangzhou-internal.aliyuncs.com/object_table_folder%2Fsignedget.txt?Expires=17490****&OSSAccessKeyId=STS.****&Signature=****&security-token=**** |
+------------+

Step 2: Download the object from ECS

Log on to the ECS console. In the left-side navigation pane, choose Instances & Images > Instances.
In the China (Hangzhou) region, select the target instance, click Remote Connection, and then connect to the instance by using Workbench.

In the terminal, run the following commands to download the OSS object:

-- Change the directory to /opt.
cd /opt
-- Download the OSS object by using the pre-signed URL.
curl -o /opt/ecs_signed.txt "http://object-table-test.oss-cn-hangzhou-internal.aliyuncs.com/object_table_folder%2Fsignedget.txt?Expires=17490****&OSSAccessKeyId=STS.****&Signature=****&security-token=****"

Output:

[xxx] opt]# curl -o /opt/ecs_signed.txt "http://object-table-test.oss-cn-hangzhou-inxxx&SAccessKeyId=STS.xxx&Signature=xxx&security-token=CAIS3gJxxx
xxx
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    38  100    38    0     0    263      0 --:--:-- --:--:-- --:--:--   265
opt]# ls
aliyun-security  ecs_signed.txt
[root@iZbp1al9u5z0axrqx50mptZ opt]# cat ecs_signed.txt
test maxcompute download files by url
xxx opt]#

Related functions

GET_SIGNED_URL_FROM_OSS is an unstructured data processing function. For other related functions, see Functions for processing unstructured data.