This topic explains how to create and configure a converged access point. It covers configuring resource scope, access domains, and IP address type.

Prerequisites

Cross-service authorization: The first time you use a converged access point, you must authorize TOS to access related cloud resources, such as Virtual Private Cloud (VPC), PrivateLink, and PrivateZone.

Certificate authorization: You have authorized TOS to access the Certificate Center.

Feature activation: You have enabled the converged access point feature for your account.

Region support: Make sure that the region in which you wish to create a converged access point offers the necessary network access (public or private).

Network resources: To create an access point for private access, prepare the necessary resources in advance, including VPCs, subnets, and security groups.

Resource scope: Confirm which TOS resources you plan to access through the access point, such as specific buckets, any bucket, or ObjectSets.

Creating a converged access point

Log in to the TOS console.

In the left navigation pane, select Access point > Converged Access Point.

On the Converged Access Point page, click Create converged access points.

On the Create converged access points page, configure the following parameters.

Parameter	Description
Access Point Name	Enter a name for the access point. After you create the access point, you cannot change its name. The name must: Be between 3 and 50 characters long. Contain only lowercase (a–z), hyphens (-), and numbers. Start and end with a number or letter.
Region	Select the region in which you want to create the access point.
Network type	Select the network location type: public network or Virtual Private Cloud. This setting cannot be changed after the access point is created.

Click complete to return to the access point list, and wait for the Status to change to Ready.

Configuring a converged access point

When configuring a converged access point, it is important to complete each configuration item in the correct order. After completing and saving each item, proceed to the next one.

Each time you modify the resources, network, or domain settings, the access point enters the "Updating" state. This process may involve multiple systems, such as VPC endpoint creation, PrivateZone association, and DNS record changes. We recommend avoiding submitting multiple types of configuration changes in rapid succession.

Specifying resource scope

The resource scope determines which resources are accessible via a converged access point. In other words, it determines which buckets or ObjectSets clients can access through the access point. This setting cannot be changed after the access point is created. The options are:

Option	Description
Arbitrary bucket	All buckets under your account are accessible through the access point.
Specify bucket	Select one or more buckets that your workloads need to access. Only the selected buckets will be accessible through the access point. You can add or remove buckets later.
Arbitrary ObjectSet	Access is granted based on ObjectSets. You can access ObjectSets using their dedicated domain names.

Configuring IP address type

This configuration is only necessary when the Network type for your converged access point is set to private network. This setting cannot be changed after the access point is created. The details are as follows:

Category	Parameter	Description
Private address	VPC	Select the VPC for the access point. The drop-down menu displays all the VPCs in the current region under your account. If no VPCs are available, click Create Virtual Private Cloud on the right to create a new one. Converged access points only process private requests from the VPCs they are associated with.
		Availability zones and subnets	Select one or more availability zones for the access point, and then choose the corresponding subnets. Private IP addresses from the subnet are used as the target addresses for domain name resolution when creating a new access link for the access point. Each availability zone must have a subnet selected from the associated VPC. This field cannot be left empty. If no subnet is available, click Create Subnet on the right to create a new one.
		Security Group	Select the security group for the access point. For your convenience, the system automatically creates a default security group when you set up a VPC. This group contains several commonly used rules. For more information, see Default Security Group. If the Default Security Group does not meet your needs, you can create custom security groups to control inbound and outbound traffic on the network interfaces. For more information, see Security group.
Shared address	-	Use shared IP addresses maintained by the platform.

Configuring access domains

The access domain determines the format of the domain used by clients to access TOS through the converged access point. This setting cannot be changed after the access point is created. The following domain types are supported:

Intranet domain name

Public domain name

Custom endpoint

TOS automatically generates an intranet domain name that can only be resolved and accessed within the associated VPC. The following configuration is required:

Parameter	Description
VPC parsing	Configure DNS resolution for the intranet domain in the specified VPCs to allow the resources within them to access the access point domain. Region: Select the region where you want to resolve the domain. VPC: From the drop-down list, select the VPC where you want to resolve the domain. You can choose from the VPCs associated with your account. Click Add a new line to add more region and VPC combinations, extending the resolution across availability zones and VPCs. tip Once VPC resolution has been configured, the corresponding domain records will be hosted in your PrivateZone. You will have read-only access. The system makes all configuration changes, which cannot be modified manually.
Public network parsing	Public resolution can be enabled for the access point simultaneously if the following conditions are met: Network type: Private network Resource scope: Specified bucket(s)

Common configuration scenarios

Scenario	Recommended configuration	Use cases
Public access to specific buckets	Network type: Public network Resource scope: Specified bucket(s) Access domain: Public domain name or custom endpoint	Suitable for public‑facing services, internet downloads, and SDK access over the public network.
Private access to specific buckets	Network type: Private network Resource scope: Specified bucket(s) IP address type: Shared or private address Access domain: Private domain associated with the VPC where your workloads run	Suitable for services running within the VPC, data processing, and backup tasks.
Dedicated private access	Network type: Private network Resource scope: Specified bucket(s) Access IP type: Private address with at least two available zones	Suitable for workloads that require high levels of network isolation and availability.

Category	Parameter	Description
Select Existing Endpoints	-	For quick access, select an existing custom endpoint from the drop-down list under your account.
Create Endpoint	Domain name	The domain must be valid in the Chinese mainland, have an Internet Content Provider (ICP) license, and allow public access. It must also be unique within your account.
		Protocol	Both the TOS protocol and the S3‑compatible protocol are supported. Select the protocol that best aligns with your needs and current technology stack.
		Attribution verification	This section only appears when a valid domain is entered. It is used to verify ownership of the provided domain. The system will automatically generate a TXT record. Add this record to your DNS provider, and then return to the console to finish the verification process. You can only save the endpoint configuration after verification is complete.
		Certificate ID	After the domain verification process is complete, select the corresponding certificate. This field can be left empty.

Torch Object Storage