Object Storage Service:Domain name access and network connection overview

HTTPS

OSS bucket domain names support HTTPS access by default, requiring no extra configuration. When you access OSS by using a custom domain name, you must configure an SSL certificate for that domain name. If CDN is not enabled, configure Upload Certificate for the custom domain name mapped to the bucket in the OSS console. If CDN is enabled, configure an SSL Certificate for the CDN domain name in the CDN console. For production environments, we recommend enforcing HTTPS access with a bucket policy that denies all HTTP requests. Alibaba Cloud SSL certificates support automatic renewal through certificate hosting. For more information, see Access OSS over HTTPS.

PrivateLink

PrivateLink creates a dedicated private endpoint for OSS within your Virtual Private Cloud (VPC). All traffic is routed over the Alibaba Cloud backbone network instead of the public internet. This provides stronger security isolation than the default OSS internal access domain name.

Connect on-premises devices or data centers to your VPC with an SSL-VPN or Express Connect circuit to access OSS through PrivateLink. For more information, see Access OSS over a private network by using PrivateLink.

Hotlink protection

If other websites hotlink your OSS resources and increase your traffic costs, you can configure Referer-based blacklists and whitelists to control access. OSS enforces access control in the following order of priority: empty Referer check > blacklist check > whitelist check. Hotlink protection applies only to anonymous access and signed URLs. This restriction does not apply to API calls signed with an AccessKey. If you use CDN acceleration for OSS, you must also configure hotlink protection rules at the CDN layer. Otherwise, hotlinking requests might hit the CDN cache and bypass OSS verification. For more information, see Hotlink protection.

ECS reverse proxy

OSS provides dynamic IP addresses through DNS resolution. This dynamism can complicate firewall whitelisting and specific system integrations. You can deploy an Nginx reverse proxy on an ECS instance with a static public IP address to forward requests to OSS. This lets you access OSS resources through a fixed IP address. For production environments, we recommend a high-availability architecture that uses a load balancer with an ECS instance group across multiple availability zones. For more information, see Access OSS by using an ECS reverse proxy.

Access point

An access point provides a dedicated entry point for a bucket. When multiple applications or teams with different permission levels need to access the same bucket, you can create a separate access point for each. This lets you manage permissions individually through access point policies, avoiding complex rules in a single bucket policy. Each access point has its own alias, access policy, and network origin configuration (public internet or a specified VPC). It supports federated authentication with RAM policies and bucket policies in a three-layer policy model. For more information, see Access point.

Static website hosting

OSS lets you publish static files (such as HTML, CSS, and JavaScript) in a bucket directly as a publicly accessible website, without requiring server maintenance. You can configure a default homepage, subdirectory homepages, and a custom 404 error page. It also supports routing for single-page applications (SPAs) by setting the 404 page to index.html and the error response code to 200. For more information, see Static website hosting.

CORS configuration

When your website loads resources from OSS, the browser may report a blocked by CORS policy error. This is due to the browser's same-origin policy, which restricts cross-origin resource access. By configuring CORS rules for your bucket (such as Origin, Allowed Methods, and Allowed Headers), you can authorize specified websites to access your OSS resources. When using multiple sources or wildcards, enable Vary: Origin to prevent cache pollution. If your bucket uses CDN acceleration, you must either configure cross-origin rules in the CDN console or set CDN to pass through the CORS response headers from OSS. For more information, see CORS configuration.

Access with long-term, non-signed URLs

You can use one of the following methods:

• Set the object ACL to public-read: Anyone can access the object without restrictions. To prevent extra costs from unauthorized use, make sure to configure hotlink protection to restrict access sources.

• Access OSS by using CDN acceleration: Keep the object permission private and enable CDN's private bucket back-to-origin feature to provide public access. CDN offers better access performance and caching. You must configure hotlink protection rules at the CDN layer to prevent unauthorized use.

Troubleshoot slow uploads or downloads

OSS transfer speed depends on client network bandwidth, link quality, and transfer strategy. Troubleshoot and optimize using the following guidelines:

• Bandwidth and link quality: Confirm that your current bandwidth does not exceed the bucket's bandwidth limit. Use an MTR tool to analyze the network link for packet loss, high latency, or routing anomalies. For cross-border or long-distance transfers, we recommend enabling transfer acceleration.

• Tool selection: Use ossutil for transferring large or numerous files. You can use its probe command to check the current network status.

• SDK tuning: For large files, always use multipart upload and resumable upload. Configure the part size (part_size) and number of concurrent threads (num_threads) appropriately. On a good network, increase the part size to reduce the number of requests. When you initialize the client, you can disable CRC64 validation (for example, set enable_crc=False in Python) and use the Content-MD5 request header for integrity checks. This can improve transfer performance while ensuring data security.

Troubleshoot network errors

If the request has reached OSS (the response contains a Request ID), get the Request ID and use the OSS self-service diagnostic tool to perform a check.

If the request has not reached OSS (the Request ID is empty), troubleshoot based on the error type: