Access OSS through Global Accelerator

Use case

This topic uses the following scenario as an example. A company's headquarters is in the US (Virginia) region, and its large files are stored in an Alibaba Cloud OSS bucket. Due to unstable cross-border network conditions, the office in China (Hong Kong) often experiences high latency, jitter, and packet loss when accessing the OSS resources in US (Virginia).

You can deploy Global Accelerator and set the backend service to the OSS address. By leveraging Alibaba Cloud's high-quality BGP bandwidth and global transmission network, clients in the China (Hong Kong) office can accelerate access to the OSS resources in US (Virginia).

Prerequisites

You have an OSS bucket in the US (Virginia) region with resources stored in it.

Procedure

Note

This topic uses a pay-as-you-go standard Global Accelerator instance as an example to show you how to configure the Global Accelerator service to accelerate access to OSS resources. Before you create a pay-as-you-go standard Global Accelerator instance, take note of the following information:

GA instances use the pay-by-data-transfer metering method. You do not need to associate a basic bandwidth plan with pay-as-you-go GA instances. The billing of data transfer over the GA network is managed by Cloud Data Transfer (CDT). For more information, see Data transfer billing.
The first time you use a pay-as-you-go GA instance, you must Activate Service.

Step 1: Configure basic information about an instance

Log on to the GA console.
On the Instances page, click Create Standard Pay-as-you-go Instance.

In the Basic Instance Configuration step, configure the parameters based on the following table and click Next.

Parameter	Description
GA Instance Name	Enter a name for the GA instance.
Instance Billing Method	Pay-As-You-Go is selected by default. You are charged instance fees, Capacity Unit (CU) fees, and data transfer fees for pay-as-you-go standard Global Accelerator instances. For more information about instance fees and CU fees, see Billing of pay-as-you-go Global Accelerator instances. For more information about data transfer fees, see Data transfer billing.
Resource Group	Select the resource group to which the standard Global Accelerator instance belongs. The resource group must be created by the current Alibaba Cloud account in Resource Management. For more information, see Create a resource group.

Step 2: Configure an acceleration area

Specify acceleration regions and allocate bandwidth to each acceleration region.

In the Configure Acceleration Area step, configure the parameters based on the following table and click Next.

Parameter	Description
Acceleration Area	Select one or more regions from the drop-down list and click Add. In this example, the China (Hong Kong) region in the Asia Pacific section is selected.
Assign Bandwidth
Maximum Bandwidth	Specify the maximum bandwidth for the acceleration region. Each acceleration region supports a bandwidth range of 2 to 10,000 Mbit/s. The maximum bandwidth is used for bandwidth throttling. The data transfer fees are managed by CDT. In this example, the default value 200 Mbit/s is used. Important If you specify a small value for the maximum bandwidth, throttling may occur and packets may be dropped. Specify a maximum bandwidth based on your business requirements.
IP Protocol	Select the IP version that is used to connect to Global Accelerator. In this example, the default value IPv4 is selected.
ISP Line Type	Select an ISP line type for the Global Accelerator instance. BGP (Multi-ISP) is selected in this example.

Step 3: Configure a listener

A listener listens for connection requests and distributes the requests to endpoints based on the port and the protocol that you specify. Each listener is associated with an endpoint group. You can associate an endpoint group with a listener by specifying the region to which you want to distribute network traffic. After you associate an endpoint group with a listener, network traffic is distributed to the optimal endpoint in the endpoint group.

In the Configure Listeners step, configure the listener and click Next.

This section describes only the parameters that are relevant to this use case. You can use the default values for other parameters. For more information, see Add and manage intelligent routing listeners.

Parameter	Description
Listener Name	Enter a name for the listener.
Routing Type	Select a routing type. In this example, select Intelligent Routing.
Protocol	Select a protocol for the listener. In this example, select TCP. Note OSS supports access over HTTP and HTTPS by default. For file transfer scenarios: for small file transfers, we recommend that you use an HTTP or HTTPS listener (only for accessing OSS resources by using a custom domain name). For large file transfers, you can use an HTTP, HTTPS, or TCP listener. Because the HTTP and HTTPS protocols transfer data over TCP connections, you can configure a TCP listener.
Port	Specify the listener port that is used to receive and forward requests to endpoints. The port number must be in the range of 1 to 65499. You can specify up to 30 ports for each listener. Separate multiple ports with commas (,), for example, `80,90,8080`. If you have multiple consecutive ports, you can use a hyphen (-) to specify a port range, for example, `80-85`. In this example, enter 80,443.
Client Affinity	Specifies whether to maintain client affinity. If enabled, all requests from the same client are routed to the same endpoint. This is useful for stateful applications. In this example, select Source IP Address.

Step 4: Configure an endpoint group and endpoints

In the Configure an Endpoint Group step, configure the endpoint group and endpoints based on the following information, and then click Next.

This section describes only the parameters that are relevant to this use case. For more information about endpoint parameters, see Add and manage endpoint groups for intelligent routing listeners.

Parameter	Description
Region	Select the region where the endpoint group is located. In this example, select US (Virginia).
Endpoint Configuration	Endpoints are the destinations to which client requests are routed. You can configure endpoints based on the following information: Backend Service Type: Select OSS. Backend Service: Select the bucket that you want to accelerate. Weight: Enter a weight for the endpoint. The value must be in the range of 0 to 255. Global Accelerator routes traffic to endpoints based on their configured weights. In this example, the default value 255 is used. Warning If the weight of an endpoint is set to 0, Global Accelerator stops distributing traffic to that endpoint. Proceed with caution.
Preserve Client IP	Select whether to preserve client IP addresses. If you enable this option, backend servers can retrieve client source IP addresses. For more information, see Preserve client IP addresses. In this example, the default setting is Off.

On the Configuration Review page, review the settings and click Submit.

Note
Creating a GA instance takes about 3 to 5 minutes.
Optional: After the instance is created, click Go to Instance Details. On the instance details page, you can view the instance configuration on the Instance Information, Listeners, and Acceleration Areas tabs.

Step 5: Configure hosts or DNS resolution

If you use the standard OSS domain name to access your backend OSS resources, you need to configure local hosts resolution. If you use a custom domain name to access your backend OSS resources, you need to configure DNS resolution. After resolution is configured, requests to access backend OSS resources are routed through Global Accelerator.

Hosts resolution

Configure the local hosts file to map the OSS access domain name to the accelerated IP address. For information about the format of OSS access domain names, see Access OSS over IPv6.

Note

This example uses the Alibaba Cloud Linux 3 operating system. Test commands may vary based on the operating system. For more information, see the documentation for your operating system.

Open a command-line window on a computer in the China (Hong Kong) office.
Configure the hosts file.
1. Run the following command to open the /etc/hosts file.
```
vim /etc/hosts
```
2. Press the i key to enter edit mode and add the following line at the end of the file.
```
<accelerated_IP> <source_bucket_name>.<endpoint_of_the_source_bucket> 
```
  After making the change, press the Esc key, enter :wq!, and press the Enter key to save the changes and exit.

Run the following command to restart the network service.

systemctl restart NetworkManager

After the configuration is complete, you can run the following commands to check the /etc/hosts file and verify that the hosts resolution is in effect.

cat /etc/hosts
ping <OSS_access_domain_name>

The verification shows that the mapping between the OSS access domain name and the accelerated IP address is added to the /etc/hosts file and the hosts resolution is in effect.

[root@iZj6c4yu    ~]# cat /etc/hosts
::1    localhost    localhost.localdomain    localhost6    localhost6.localdomain6
127.0.0.1    localhost    localhost.localdomain    localhost4    localhost4.localdomain4
10.0.xxx.xxx    iZj6c4yut    iZj6c4yu
8.210.xxx.xxx    zybuckxxx.oss-us-east-1.aliyuncs.com
[root@iZj6c4xxx    ~]# ping zybuckxxx.oss-us-east-1.aliyuncs.com
PING zybuckxxx.oss-us-east-1.aliyuncs.com (8.210.xxx.xxx) 56(84) bytes of data.
64 bytes from zybuckxxx.oss-us-east-1.aliyuncs.com (8.210.xxx.xxx): icmp_seq=1 ttl=101 time=3.34 ms
64 bytes from zybuckxxx.oss-us-east-1.aliyuncs.com (8.210.xxx.xxx): icmp_seq=2 ttl=101 time=3.26 ms
64 bytes from zybuckxxx.oss-us-east-1.aliyuncs.com (8.210.xxx.xxx): icmp_seq=3 ttl=101 time=3.26 ms
^C
--- zybuckxxx.oss-us-east-1.aliyuncs.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 3.255/3.282/3.338/0.076 ms

DNS resolution

Configure DNS resolution to route requests for backend OSS resources through Global Accelerator. You can use one of the following methods:

Add an A record to map the bucket domain name to an IPv4 address, which is the accelerated IP address allocated by the Global Accelerator instance.
Add a CNAME record to map the bucket domain name to another domain name, which is the CNAME address allocated by the Global Accelerator instance.

Before you configure DNS resolution, make sure that you have bound the custom domain name to the resource bucket. Otherwise, the domain name will fail OSS verification. The custom domain name is in the format of <source_bucket_name>.<your_domain_name>. For more information, see Map custom domain names.

Log on to the Alibaba Cloud DNS console.
If your domain name is not registered with Alibaba Cloud, add the domain name to the Alibaba Cloud DNS console.

Note
If your domain name is not registered with Alibaba Cloud, add it to the Alibaba Cloud DNS console before you configure DNS records. For more information, see Add a domain name. If your domain name is registered with Alibaba Cloud, skip this step.
On the Authoritative DNS Resolution page, find the target domain name, and in the Actions column, click Settings.
Configure DNS resolution based on your business requirements.
- If you did not enable Add CNAME Record Automatically when you bound the custom domain name to the bucket, click Add Record.
- If you enabled Add CNAME Record Automatically when you bound the custom domain name to the bucket, find the existing CNAME record and click Modify in the Actions column.

In the Add Record or Edit Record panel, complete the following configurations and click OK.

A record

Parameter	Description
Type	Select A. An A record maps a domain name to an IPv4 address.
Host	Enter the prefix of the accelerated domain name. If you did not enable Add CNAME Record Automatically when you bound the custom domain name to the bucket, enter the source bucket name as the hostname. If you enabled Add CNAME Record Automatically when you bound the custom domain name to the bucket, make sure that the hostname is the source bucket name. You do not need to modify the value.
DNS Request Source	Keep the default value.
TTL	The time-to-live (TTL) value, which specifies how long the DNS record remains cached on a DNS server. A smaller value means that DNS record updates propagate faster. In this example, the default value of 10 minutes is used.
Value	Enter the accelerated IP address allocated by the Global Accelerator instance.

CNAME record

Parameter	Description
Type	Select CNAME. A CNAME record maps a domain name to another domain name.
Host	Enter the prefix of the accelerated domain name. If you did not enable Add CNAME Record Automatically when you bound the custom domain name to the bucket, enter the source bucket name as the hostname. If you enabled Add CNAME Record Automatically when you bound the custom domain name to the bucket, make sure that the hostname is the source bucket name. You do not need to modify the value.
DNS Request Source	Keep the default value.
TTL	The time-to-live (TTL) value, which specifies how long the DNS record remains cached on a DNS server. A smaller value means that DNS record updates propagate faster. In this example, the default value of 10 minutes is used.
Value	Enter the CNAME address allocated by the Global Accelerator instance. You can view the CNAME address allocated to the Global Accelerator instance on the Instances page.

After the configuration is complete, you can run the following command to check whether the DNS resolution is in effect.

ping <custom_domain_name>

The following verification process uses a CNAME record configuration as an example. The DNS resolution configuration has taken effect if the custom domain name resolves to the CNAME of Global Accelerator when you ping it.

[root@iZj6c4xxx          ~]# ping zybuckxxx.fun
PING ga-bp10wrunxxx.com (8.210.xxx.xxx) 56(84) bytes of data.
64 bytes from 8.210.xxx.xxx (8.210.xxx.xxx): icmp_seq=1 ttl=101 time=3.21 ms
64 bytes from 8.210.xxx.xxx (8.210.xxx.xxx): icmp_seq=2 ttl=101 time=3.11 ms
64 bytes from 8.210.xxx.xxx (8.210.xxx.xxx): icmp_seq=3 ttl=101 time=3.13 ms
^C
--- ga-bp10xxx.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 3.108/3.148/3.206/0.077 ms

Step 6: Test access

Test whether clients in China (Hong Kong) can use an OSS access domain name or a custom domain name to access OSS resources in the US (Virginia) headquarters and verify the acceleration performance.

This topic uses ossutil, a command-line tool provided by Alibaba Cloud OSS, as an example to copy files from the source bucket in US (Virginia) to a client in China (Hong Kong). For information about how to install ossutil, see Download and install ossutil.

Open a command-line window on a client computer in China (Hong Kong).
Run the following command to copy a file from the source bucket in US (Virginia) to the client in China (Hong Kong).
- Before you use Global Accelerator:
```
ossutil64 --retry-times 10 -e <endpoint_of_the_source_bucket> -k <access_key_secret_of_the_source_account> -i <access_key_id_of_the_source_account> -f cp oss://<source_bucket_name>/<source_file> ./
```
  Note
  When you copy files without using Global Accelerator, the domain name that you access is <source_bucket_name>.<endpoint_of_the_source_bucket>. Example: testBucketName.oss-us-west-1.aliyuncs.com.
  Figure 1. Access response before acceleration
```
[root@iZj6xxx ~]# ossutil64 --retry-times 10 -e oss-us-east-1.aliyuncs.com -k xxx -i LTAxxx -f cp oss://zybucketxxx/example.pptx ./
Succeed: Total num: 1, size: 25,141,693. OK num: 1(download 1 objects).
average speed 6064000(byte/s)
4.147363(s) elapsed
```
- With Global Accelerator, the command varies depending on whether you use a custom domain name.
  - Accelerated access without a custom domain name:
```
ossutil64 --retry-times 10 -e <endpoint_of_the_source_bucket> -k <access_key_secret_of_the_source_account> -i <access_key_id_of_the_source_account> -f cp oss://<source_bucket_name>/<source_file> ./
```
    Note
    
    The accessed domain name and command are the same as without Global Accelerator. However, you must ensure the hosts file is configured to route requests to the Global Accelerator IP address. For more information, see Step 5: Configure hosts or DNS resolution.
    
    When you copy files without using a custom domain name, the domain name that you access is <source_bucket_name>.<endpoint_of_the_source_bucket>. Example: testBucketName.oss-us-west-1.aliyuncs.com.
    Figure 2. Accelerated access response without a custom domain name
    
    [root@iZj6c4 ~]# ossutil64 --retry-times 10 -e oss-us-east-1.aliyuncs.com -k xxx -i LTAxxx -f cp oss://zybuxxxxx3/example.pptx ./ Succeed: Total num: 1, size: 25,141,693. OK num: 1(download 1 objects). average speed 7681000(byte/s) 3.273830(s) elapsed
  - Accelerated access with a custom domain name:
```
ossutil64 --retry-times 10 -e <your_domain_name> -k <access_key_secret_of_the_source_account> -i <access_key_id_of_the_source_account> -f cp oss://<source_bucket_name>/<source_file> ./
```
    Note
    
    Make sure that you have configured DNS resolution to direct access requests to Global Accelerator. For more information, see Step 5: Configure hosts or DNS resolution.
    
    When you copy files by using a custom domain name, the domain name that you access is <source_bucket_name>.<your_domain_name>. Example: testBucketName.example.com
    Figure 3. Performance of accelerated access with a custom domain name
    
    [root@iZj6c4yxxx ~]# ossutil64 --retry-times 10 -e xxx.fun -k xxx -i LTAxxx -f cp oss://zybuckxxx/example.pptx ./ Succeed: Total num: 1, size: 25,141,693. OK num: 1(download 1 objects). average speed 7851000(byte/s) 3.202332(s) elapsed
The test results show that Global Accelerator reduces access times for clients in China (Hong Kong) to OSS resources in US (Virginia).

Note
Actual acceleration performance may vary.