Object Storage Service:Access to OSS resources from ECS instances by using an internal endpoint of OSS

Obtain the internal endpoint of OSS

• Obtain from the OSS console
  Log on to the OSS console. On the Overview tab of the specified bucket, you can view the endpoints and bucket domain names in the Port section. The following figure shows an example.
• Follow the fixed format

  OSS bucket domain names are in the following format: BucketName.Endpoint. In this format, BucketName indicates the name of your bucket. Endpoint indicates the endpoint used to access the region where your bucket is located. For more information, see OSS domain names.

Access from ECS instances within the same region

ECS instances deployed within the same region as an OSS bucket can use the internal network to access resources in the bucket.

• Use URLs
  You can use the internal endpoint of OSS to access OSS resources that you are authorized to access. For example, a bucket named test is located in the China (Hangzhou) region. The bucket contains an object named 1.jpg in the root directory of the bucket, and the access control list (ACL) of the object is public read. In this case, ECS instances in the China (Hangzhou) region can access this object by using http://test.oss-cn-hangzhou-internal.aliyuncs.com/1.jpg. You can embed the access URL of the object in your website and provide the URL to ECS users within the same region or to users who have connected to the internal network by using a leased line.

  Warning For data security reasons, we recommend that you do not set the ACL of your OSS resources to public read or public read/write. You can use bucket policies to authorize other users to access OSS resources. For more information, see Configure bucket policies to authorize other users to access OSS resources.
• Use ossbrowser

  When you set the parameters for logging on to ossbrowser, set Endpoint to the internal endpoint of OSS. For more information, see ossbrowser.

• Use ossutil

  When you set the parameters for logging on to ossutil, set Endpoint to the internal endpoint of OSS. For more information, see ossutil.

• Use SDKs
  When you initialize the client instance, set Endpoint to the internal endpoint of OSS.

  • Java SDK

    String endpoint = "http://oss-cn-hangzhou-internal.aliyuncs.com";// The China (Hangzhou) region is used in the example.
    String accessKeyId = "<yourAccessKeyId>";
    String accessKeySecret = "<yourAccessKeySecret>";
    OSSClient client = new OSSClient(endpoint, accessKeyId, accessKeySecret);          

    For more information, see Initialization.

  • PHP SDK

    $accessKeyId = "<yourAccessKeyId>";
    $accessKeySecret = "<yourAccessKeySecret>";
    $endpoint = "<A data center endpoint that you have selected to access OSS, such as http://oss-cn-hangzhou-internal.aliyuncs.com>";           

    For more information, see Initialization.

  • Python SDK

    auth = oss2.Auth('<yourAccessKeyId>', '<yourAccessKeySecret>')
    endpoint = 'http://oss-cn-hangzhou-internal.aliyuncs.com' # A data center endpoint that you have selected to access OSS. The China (Hangzhou) region is used in the example.
    bucket = oss2.Bucket(auth, endpoint, 'BucketName')         

    For more information, see Initialization.

  • .NET SDK

    const string accessKeyId = "<yourAccessKeyId>";
    const string accessKeySecret = "<yourAccessKeySecret>";
    const string endpoint = "http://oss-cn-hangzhou-internal.aliyuncs.com";
    var ossClient = new OssClient(endpoint, accessKeyId, accessKeySecret);   

    For more information, see Initialization.

  • C SDK

    options->config = oss_config_create(options->pool);
    aos_str_set(&options->config->endpoint, "http://oss-cn-hangzhou-internal.aliyuncs.com");
    aos_str_set(&options->config->access_key_id, "<yourAccessKeyId>");
    aos_str_set(&options->config->access_key_secret, "<yourAccessKeySecret>");
    options->config->is_cname = 0;
    options->ctl = aos_http_controller_create(options->pool, 0);         

    For more information, see Initialization.

Access OSS resources by configuring a reverse proxy on ECS instances

After you complete the preceding steps, users can access the OSS resources by using the public IP address of the ECS instance. Then, the ECS instance requests OSS resources over the internal network and returns the OSS resources to the users.