Configure origin fetch from a private OSS bucket

How it works

After you enable origin fetch from a private OSS bucket, CDN automatically adds an Authorization field to the request header of each origin fetch request that it sends to your private OSS bucket. The value of this field is a valid signature generated based on the identity information that you authorized (a Security Token Service (STS) temporary security token or an AccessKey pair). OSS authenticates the request based on the signature.

Benefits

• Secure access — You grant CDN restricted read-only permissions on the private bucket, so only legitimate origin fetch requests can access the bucket. This avoids the security risk of making a private bucket public.

• Cost optimization — End-user requests hit the CDN cache. The traffic fees are lower than the internet outbound traffic fees that are generated when users access OSS directly. In addition, traffic from CDN to OSS is counted as origin fetch traffic, whose unit price is lower than that of OSS internet outbound traffic. This reduces the overall cost. For more information, see Billing of OSS content acceleration.

Considerations

Before you enable origin fetch from a private OSS bucket, note the following:

• Access scope — After this feature is enabled, the accelerated domain name can access all resources in the private bucket of its origin server. You cannot restrict access to only some of the resources in the bucket on the CDN side.

• Signature conflict — Make sure that the URL parameters of origin fetch requests do not contain signature information. Otherwise, OSS authentication fails. A single request cannot carry a signature in both the header and the URL at the same time.

• Feature conflict — This feature conflicts with the default homepage configuration of the static website hosting feature of OSS. To use both features at the same time, see documentation.

Prerequisites

• An accelerated domain name is configured, and its origin server is an Alibaba Cloud OSS bucket.

• The OSS bucket is a private bucket, which provides access authentication and prevents traffic theft by unauthorized requests.

Procedure

The configuration consists of two steps. First, complete a one-time, account-level authorization that allows CDN to access OSS. Then, enable the feature for your accelerated domain name.

1. Authorize CDN to access OSS. If no authorization prompt appears, skip this step.

   1. Log on to the CDN console.

   2. In the left-side navigation pane, click Domain Names.

   3. On the Domain Names page, click Manage for the target domain name.

   4. In the left-side navigation pane of the specified domain name, click Origin Fetch.

      In the Alibaba Cloud OSS Private Bucket Access section, the Role Authorization row displays "This account has not authorized the CDN service to access your OSS space", and the Status switch is turned off by default.

   One-click authorization in the CDN console is recommended. Use manual authorization in RAM if you prefer to create the role and authorization policy yourself.

   (Recommended) One-click authorization via the console

   1. In the Alibaba Cloud OSS Private Bucket Access section, click Authorize.

   2. On the authorization confirmation page, click Confirm Authorization.

   (Alternative) Manual authorization via RAM

   1. Log on to the Resource Access Management (RAM) console.

   2. In the left-side navigation pane, choose Permission Management > Access Policy.

   3. On the Access Policy page, click Create Policy.

   4. On the Script Editor tab, enter the following policy content.

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "oss:List*",
                      "oss:Get*"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

   5. Click OK, enter the following information on the Create Policy page, and then click OK.

      • Policy Name: AliyunCDNAccessingPrivateOSSRolePolicy

      • Remarks: The authorization policy for the role that CDN/DCDN uses for origin fetch from private OSS buckets. It contains read-only permissions on OSS.

   6. In the left-side navigation pane, choose Identity Management > Roles.

   7. On the Roles page, click Create Role.

   8. Set Trusted Entity Type to Cloud Account, select Current Cloud Account for Trusted Entity Name, and then click OK.

   9. In the Create Role step, enter the following information:

      • Role Name: AliyunCDNAccessingPrivateOSSRole

   10. After the role is created, in the list on the Roles page, click AliyunCDNAccessingPrivateOSSRole to go to the role editing page.

   11. On the Trust Policy tab, click Edit Trust Policy, enter the following information, and then click OK.

       {
         "Statement": [
           {
             "Action": "sts:AssumeRole",
             "Effect": "Allow",
             "Principal": {
               "Service": [
                 "cdn.aliyuncs.com"
               ]
             }
           }
         ],
         "Version": "1"
       }

   12. Switch to the Permission Management tab. In the Authorize tab, click Grant Permission.

       • Resource Scope: account-level

       • Authorized Principal: select the previously created AliyunCDNAccessingPrivateOSSRole.

       • Access Policy: select Custom Policy, choose the previously created AliyunCDNAccessingPrivateOSSRolePolicy, and then click Confirm New Authorization.

       After the authorization is confirmed, return to the CDN console's Origin Fetch page. You can see that the Alibaba Cloud OSS Private Bucket Access feature has been authorized.

2. Turn on Alibaba Cloud OSS Private Bucket Access and configure the origin fetch type.

   1. Find the Alibaba Cloud OSS Private Bucket Access section and turn on its switch.

   2. In the displayed Alibaba Cloud OSS Private Bucket Access dialog box, select the origin fetch type and click OK.

   The following table describes the applicable scenarios of the two origin fetch types.

After you click OK, origin fetch from the private OSS bucket is enabled for the accelerated domain name.

Use STS for cross-account origin fetch from a private OSS bucket

By default, CDN uses STS temporary security tokens and supports origin fetch only from private OSS buckets under the same account. To use STS temporary security tokens for cross-account origin fetch from a private OSS bucket, enable the STS-based origin fetch type on the CDN side and add a bucket policy on the OSS side.

On the OSS side, configure the bucket policy as follows:

1. Log on to the Alibaba Cloud account where the private bucket resides and go to the OSS console.

2. Click Buckets > target bucket. Open the Permission Control > Bucket Policy tab and click Authorize.

3. For Authorized User, select Other Account. Based on the authorization method used when CDN fetches from OSS, enter the ARN in the corresponding format in Authorized Account:

   • Direct STS authorization: enter arn:sts:uid, where uid is the account ID of the account where CDN resides.

   • AssumeRole: enter arn:sts://{CDN_account_UID}:assumed-role/{CDN_account_role_name}/*, where {CDN_account_UID} is the account ID of the account where CDN resides and {CDN_account_role_name} is the name of the role assumed by the CDN account. If CDN fetches from OSS by assuming a role, you must use this format. Otherwise, a 403 error occurs.

4. For Authorized Operation, select Quick Setup > Read-Only (excluding ListObject), and then click OK to complete the configuration.

   After the authorization is added, the Bucket Policy tab displays the authorization information.

Security hardening recommendations

After origin fetch from a private OSS bucket is enabled, the data on your origin server is secure. However, the resources cached on CDN edge nodes are publicly accessible by default. To prevent traffic theft, use this feature together with the following security features provided by CDN:

• Configure a Referer blacklist or whitelist: allows only requests from specific referrer websites to access your CDN resources.

• Configure URL signing: configures dynamic signatures and expiration times for your resource URLs to defend against malicious downloads.

Disable origin fetch from a private OSS bucket

If you no longer want your accelerated domain name to access the resources in a private bucket under the same account, revoke the authorization of the corresponding role in the Resource Access Management (RAM) console to disable the CDN permission to fetch from the private OSS bucket.

1. Disable the feature in the CDN console.

   1. Log on to the CDN console.

   2. In the left-side navigation pane, click Domain Names.

   3. On the Domain Names page, click Manage for the target domain name.

   4. In the left-side navigation pane of the specified domain name, click Origin Fetch.

   5. In the Alibaba Cloud OSS Private Bucket Access section, turn off the Alibaba Cloud OSS Private Bucket Access switch.

2. Fully remove the authorization in the RAM console.

   1. Log on to the Resource Access Management (RAM) console.

   2. In the left-side navigation pane, choose Identity Management > Roles.

   3. In the role name list, click the AliyunCDNAccessingPrivateOSSRole role.

   4. Remove all permissions from the role AliyunCDNAccessingPrivateOSSRole.

      On the role details page, the Permission Management tab lists the authorized system policy (remark: the authorization policy for the role that CDN uses for origin fetch from private OSS buckets, which contains read-only permissions on OSS). The resource scope is account-level. The Delete Role button is in the upper-right corner of the page.

      a. In the Actions column, click Revoke Authorization.

      b. In the confirmation dialog box for removing permissions, click Revoke Authorization.

   5. Return to the Identity Management > Roles page and delete the AliyunCDNAccessingPrivateOSSRole role.

      a. Click Delete Role for the AliyunCDNAccessingPrivateOSSRole role.

      b. In the Delete Role confirmation dialog box, click Delete Role.

   6. Return to the Permission Management > Access Policy page and delete the AliyunCDNAccessingPrivateOSSRolePolicy policy.

      a. Click Delete Access Policy for the AliyunCDNAccessingPrivateOSSRolePolicy policy.

      b. In the Delete Access Policy confirmation dialog box, enter the Policy Name and click Delete Access Policy.

References

• If errors such as This request is forbidden by kms. or You have no right to access this object because of bucket acl. occur when CDN accesses OSS resources, see Origin fetch troubleshooting for troubleshooting methods.

• Best Practices for using CDN to accelerate OSS resources