Islet

English

简体中文

English

简体中文

Configure Alibaba Cloud OSS for cloud sync ​

Islet can sync encrypted data to your own object storage over the S3 protocol. This guide walks you through creating an Alibaba Cloud OSS bucket, configuring access, and connecting it to Islet.

The examples use the China North 2 (Beijing) region. Replace the Endpoint and Region values with those for your bucket.

Keep your AccessKey secure

Create a dedicated RAM user and AccessKey for Islet. Do not use the AccessKey of your Alibaba Cloud account (root account). The AccessKey Secret is displayed only once when it is created. Never share it in screenshots, public documents, or chat messages.

Before you begin ​

You need:

Step 1: Create a bucket ​

Open the OSS console. Go to the bucket list and select Create Bucket.

Use these recommended settings:

SettingRecommended value
Bucket nameA distinct, recognizable name such as my-islet-backup
RegionA region close to you; the region cannot be changed later
Storage classStandard
ACLPrivate
Block Public AccessEnabled

After creating the bucket, note its name and region ID. You will enter the region ID in Islet. For example, China North 2 (Beijing) uses oss-cn-beijing.

Public endpoint restrictions in Chinese mainland regions

Alibaba Cloud states that, starting March 20, 2025, newly activated OSS users may be restricted from using default public endpoints for data API operations on buckets in Chinese mainland regions. If this policy applies to your account, use a region outside the Chinese mainland, such as Singapore. See the OSS console quick start for details.

Step 2: Configure CORS ​

Islet connects to OSS directly from a browser or Chrome extension, so the bucket needs a Cross-Origin Resource Sharing (CORS) rule.

  1. Open the bucket you created.
  2. Go to Data Security → CORS.
  3. Select Create Rule.
  4. Enter the following values and save the rule.
SettingValue
Allowed Origins*
Allowed MethodsGET, POST, PUT, DELETE, HEAD
Allowed Headers*
Exposed HeadersETag and x-oss-request-id, one per line
Cache Timeout (seconds)0
Vary: OriginEnabled

Set Allowed Headers to *. Islet uses the S3 protocol and sends headers such as authorization, x-amz-*, and amz-sdk-*. Allowing only x-oss-* headers causes the connection test to fail.

Exposed Headers determine which OSS response headers Islet can read. ETag identifies an upload result, while x-oss-request-id helps troubleshoot requests. This setting does not change the bucket's access permissions.

CORS does not make the bucket public

An Allowed Origins value of * permits cross-origin requests, but the bucket remains private. A request still needs a valid AccessKey signature to read or write data.

This guide uses * to support browsers, Chrome extensions, and multiple devices. If you access OSS only from a fixed website, you can replace it with that website's full Origin.

A CORS rule can take up to 15 minutes to become effective. If the list does not update immediately, wait and refresh the page.

Step 3: Create a RAM user and policy ​

Do not use a root-account AccessKey. Create a dedicated RAM user and grant it access only to the sync directory in the selected bucket.

  1. Open the Resource Access Management console.
  2. Go to Identities → Users, then create a RAM user for Islet sync.
  3. Create a custom policy. Replace YOUR_BUCKET and YOUR_PREFIX with your values.
json
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:PutObject"
      ],
      "Resource": "acs:oss:*:*:YOUR_BUCKET/YOUR_PREFIX/*"
    }
  ]
}

For example, if the bucket is my-islet-backup and the Islet Prefix is chat-diary, use:

text
acs:oss:*:*:my-islet-backup/chat-diary/*
  1. Attach the custom policy to the RAM user.
  2. Open the user's credential settings and create an AccessKey.
  3. Save the AccessKey ID and AccessKey Secret. The secret cannot be viewed again after you close the creation dialog.

To allow the RAM user to read and write the whole bucket, use acs:oss:*:*:YOUR_BUCKET/* as the Resource instead.

Step 4: Enter the settings in Islet ​

In Islet's cloud sync setup, select S3 and enter:

Islet fieldWhat to enterChina North 2 (Beijing) example
EndpointThe public endpoint for the bucket's region, without the bucket namehttps://oss-cn-beijing.aliyuncs.com
RegionThe bucket's region IDoss-cn-beijing
BucketThe bucket name from Step 1my-islet-backup
Access Key IDThe RAM user's AccessKey ID—
Secret Access KeyThe RAM user's AccessKey Secret—
PrefixThe directory prefix for Islet sync datachat-diary
Force path styleOff—

Alibaba Cloud OSS uses virtual-hosted style for its S3-compatible API, so keep Force path style off. Select Next after entering the settings. Islet writes and reads a health-check object to verify the connection.

Troubleshooting ​

CORS error or Failed to fetch ​

Check that the CORS rule is effective and that:

  • Allowed Origins and Allowed Headers are both *
  • Allowed Methods includes GET, PUT, and HEAD
  • No other CORS rule conflicts with this rule

Wait a few minutes after changing the rule, reopen Islet, and try again.

AccessDenied ​

The RAM user does not have enough permission, or the Bucket and Prefix in the policy do not match the Islet settings. Check the Resource in the custom policy and make sure the policy is attached to the correct RAM user.

SignatureDoesNotMatch ​

Check that:

  • Endpoint and Region refer to the same region
  • AccessKey ID and AccessKey Secret are complete and contain no leading or trailing spaces
  • Force path style is off

The connection still fails after changing CORS ​

Alibaba Cloud notes that a CORS rule can take up to 15 minutes to become effective. After waiting, try again. If the problem continues, open the browser developer tools and inspect the status codes of the OPTIONS and PUT requests in the Network panel.