Traffic fees

If your bucket shows a sudden spike in outbound Internet traffic, use these steps to troubleshoot.

1. Identify the traffic abnormality.

   If real-time log query is enabled for the bucket

   1. Log on to the OSS console.

   2. In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.

   3. In the navigation pane on the left, choose Logging > Real-time Log Query.

   4. On the Real-time Log Query tab, enter the following query statement to query the most frequently accessed files and their corresponding hot-spot IP addresses in examplebucket. The results are sorted by the number of access requests, and the top 5 records are returned.

      * and __topic__: oss_access_log and bucket: examplebucket
      | SELECT 
          client_ip AS ip_address, 
          request_uri AS file_path, 
          COUNT(*) AS access_count, 
          SUM(content_length_out) AS total_bytes_sent
      FROM 
          log
      WHERE 
          http_status = 200
      GROUP BY 
          request_uri, client_ip
      ORDER BY 
          access_count DESC
      LIMIT 5;

      The following figure shows the query result.

      

   If real-time log query is not enabled for the bucket

   1. Log on to the OSS console.

   2. In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.

   3. In the navigation pane on the left, choose Data Usage > Ranking Statistics, and then click the Referer/IP Address Rankings tab to view the top 10 referers/IP addresses.

   4. In the navigation pane on the left, choose Data Usage > Object Access Statistics to view the names of frequently accessed files and the outbound traffic that they generate.

2. Determine whether the traffic is abnormal.

   • If certain IP addresses frequently request specific objects, this may indicate malicious behavior. Proceed to Step 3 to check configurations.

   • If multiple IP addresses access different objects, the content may be widely shared (e.g., via social media). Proceed to Step 4 to configure CDN acceleration.

3. Check the relevant configurations.

   Configuration item	Threat description	Solution
   The bucket ACL is set to public-read or public-read-write.	Anyone, including anonymous users, can read bucket files, generating excessive outbound traffic fees.	Set the bucket ACL to private. All unsigned or unauthorized requests will then fail. Bucket ACL
   The ACL of a frequently accessed file is set to public-read or public-read-write.	Anyone, including anonymous users, can read the file, generating excessive outbound traffic fees.	Set the object ACL to private. Object ACL. Users can then access the file only via a signed URL within its validity period.
   The bucket policy does not restrict the IP addresses that are allowed to access the bucket.	Unknown IP addresses frequently requesting objects generate excessive outbound traffic fees.	Use a bucket policy to block the suspicious IP addresses identified in Step 1. Use a bucket policy to grant permissions to access OSS
   Referer hotlink protection is not configured to prevent other websites from referencing OSS files.	Other websites can embed your OSS file URLs (images, videos), shifting traffic to your account and causing a surge in outbound traffic fees.	Configure a Referer blacklist to restrict access from malicious referers found in Step 1, or configure a Referer whitelist to prevent unauthorized use of your OSS resources. Configure hotlink protection.

4. Configure CDN to accelerate access to OSS.

   If the traffic surge is caused by content delivery, use CDN to distribute static resources (images, videos, documents) in OSS. This reduces outbound traffic fees and improves loading speed. Accelerate access to OSS using CDN.

To have the requester pay for outbound Internet traffic and origin traffic instead of the bucket owner, enable pay-by-requester mode. Pay by requester.

Outbound Internet traffic is generated by calling OSS API operations (e.g., GetObject) to transfer data to clients. Since each API call incurs a request fee, request fees naturally accompany outbound traffic fees.