Docs

Torch Object Storage

Best Practices

Accessing TOS using PrivateLink

PrivateLink allows you to access TOS via a dedicated line from an on-premises Internet data center (IDC). This topic explains how to do so.

Background information

First, enable communication between a virtual private cloud (VPC) and an on-premises IDC using a VPN, CEN, or Direct Connect. Next, use the VPC's interface endpoint and endpoint service to establish a network connection between the VPC and TOS. This will ultimately allow you to access TOS from your IDC.

The following example uses Direct Connect to illustrate how to access TOS from an on-premises IDC.

Notes

Category	Description
PrivateLink	The maximum bandwidth for an endpoint is 10 Gbps. Ensure that you do not exceed this limit when accessing TOS. For more information, see Creating an interface endpoint.
TOS	By default, accessing TOS via PrivateLink uses the HTTP protocol and the endpoint domain name. To use the original TOS domain name or the HTTPS protocol over PrivateLink, you must configure a Private DNS name. For instructions, see Access TOS through a custom domain name. You cannot use the SourceIP and SourceVpc conditions in bucket policies or IAM policies when using PrivateLink to access TOS.
Private DNS	After enabling Private DNS, you can access TOS via the Private DNS domain name. This domain name supports the HTTPS protocol. In contrast, the endpoint domain name only supports HTTP. Private DNS only adds resolution records within the VPC where the endpoint is located. Therefore, if you require cross-VPC access, you must manually add the resolution records.
Costs	Accessing TOS using PrivateLink incurs endpoint instance fees and traffic processing fees. For billing details, see Billing Description.

Prerequisites

You have created a VPC. For more information, see Creating a VPC.

You have established a connection between your VPC and your on-premises IDC using Direct Connect, CEN, or VPN. We recommend using Direct Connect. For instructions, see Configure a DC connection.

Steps

In the top menu bar, select the region in which you want to create a private endpoint.

In the left navigation pane, select PrivateLink > Endpoint.

From the Endpoint page, click the Interface Endpoint tab, and then click Create Endpoint.

On the Create Endpoint page, configure the following parameters.

Category	Parameter	Description
Basic information	Region	Select the region in which you want to create the endpoint.
		Name	Enter a name for the endpoint.
		Type	Select the type of the endpoint. For this scenario, select Interface.
		Description	Provide additional information about the endpoint.
		Project	Select the project to which the endpoint belongs. For more information, see Project management.
Endpoint Service	Enable cross-region	Select whether to allow the endpoint to connect to the endpoint service across regions. This option is disabled by default.
		Add method	Choose the Add method for the endpoint service. For this scenario, select VolcanoEngine Services.
		Endpoint Service	Select the endpoint service that you want to connect to TOS. Two endpoint services are available by default for connecting to TOS, so there is no need to create them manually. The options are explained below. com.volces.privatelink.cn-<region>.tos-s3: An endpoint service that follows the S3 protocol. After selecting this service, you must use S3-compliant SDKs and APIs to access TOS. com.volces.privatelink.cn-<region>.tos: An endpoint service that follows the TOS protocol. After selecting this service, you must use the SDKs and APIs that comply with the TOS protocol to access TOS.
Network configuration	IP Address type	The Internet Protocol version used by the endpoint. You can select either IPv4 or IPv6. IPv4 is selected by default.
		VPC	Select the VPC used for configuring the dedicated line.
		Availability Zone and Subnet	Select the availability zone and subnet where the connection will be established.
		Security Group	Select a security group. tip A security group named "Default" is automatically created when a VPC is created. For more information on security groups, see Security Group Overview.
Advanced options	Private DNS name	Select whether to enable private DNS names. The options are explained below. Enable: This option allows access using a custom domain name provided by the endpoint service. You can only enable a DNS name for an endpoint if the selected endpoint service has a private DNS name enabled and the public domain name has been validated. Disable: Default.
Advanced options		Tags	A tag is a key-value pair that is used to classify and search for resources. For more information, see Tag Management. To tag the endpoint service, click Add tag and enter a tag key and tag value.

Check the box that says "I have read and agree to Product and service agreements, PrivateLink Service Terms, PL Service Level Agreement, Unsubscribe instructions and Safety rules". Then, click Buy now.

Click Go to console. On the Interface Endpoint tab of the Endpoint page, locate the endpoint domain name in the Endpoint Domain name column.

Ping the endpoint domain name in your on-premises IDC. If the ping is successful, then the network connection between your IDC and TOS is normal.

After replacing the Endpoint with the endpoint domain name, you can access TOS via APIs or SDKs. The code example below shows how to list objects from an on-premises IDC using the GO SDK.

package main

import (
"context"
"fmt"

"github.com/volcengine/ve-tos-golang-sdk/v2/tos"
)

func checkErr(err error) {
if err != nil {
if serverErr, ok := err.(*tos.TosServerError); ok {
fmt.Println("Error:", serverErr.Error())
fmt.Println("Request ID:", serverErr.RequestID)
fmt.Println("Response Status Code:", serverErr.StatusCode)
fmt.Println("Response Header:", serverErr.Header)
fmt.Println("Response Err Code:", serverErr.Code)
fmt.Println("Response Err Msg:", serverErr.Message)
} else if clientErr, ok := err.(*tos.TosClientError); ok {
fmt.Println("Error:", clientErr.Error())
fmt.Println("Client Cause Err:", clientErr.Cause.Error())
} else {
fmt.Println("Error:", err)
}
panic(err)
}
}

func main() {
var (
accessKey = "*** Provide your access key ***"
secretKey = "*** Provide your secret key ***"
// Enter the endpoint domain name
endpoint = "ep-3rf21wq2bsh6o5zsk2ipt****.tos.cn-beijing.privatelink.volces.com"
region = "cn-beijing"
// Enter the bucket name
bucketName = "*** Provide your bucket name ***"

ctx = context.Background()
)
// Initialize the client
client, err := tos.NewClientV2(endpoint, tos.WithRegion(region), tos.WithCredentials(tos.NewStaticCredentials(accessKey, secretKey)))
checkErr(err)

// Retrieve up to ten objects from the bucket
output, err := client.ListObjectsV2(ctx, &tos.ListObjectsV2Input{
Bucket: bucketName,
ListObjectsInput: tos.ListObjectsInput{
MaxKeys: 10,
},
})
checkErr(err)
for _, obj := range output.Contents {
// Object key
fmt.Println("Object Key:", obj.Key)
// The last modified time of the object
fmt.Println("Object LastModified:", obj.LastModified)
// Object ETag
fmt.Println("Object ETag:", obj.ETag)
// Object size
fmt.Println("Object Size:", obj.Size)
// Object owner
fmt.Println("Object Owner:", obj.Owner)
// The storage type of the object
fmt.Println("Object StorageClass:", obj.StorageClass)
// Object CRC64 value
fmt.Println("Object HashCrc64ecma:", obj.HashCrc64ecma)
}

}

Last updated: 2026.08.25 10:39:45