Using a Cloud Storage Bucket as Your Origin

Web CDN can pull content directly from a cloud storage bucket (Amazon S3, Google Cloud Storage, and other providers) instead of a web server. This is commonly used to serve static assets or downloads straight from storage while reducing egress costs and improving delivery speed through the CDN edge network.

There are two ways to use a bucket as your origin, depending on whether the bucket allows public read access:

• Public bucket — objects are readable by anyone. No extra configuration is required beyond pointing Web CDN at the bucket's hostname.
• Private bucket — objects require an authenticated request. Web CDN can sign outgoing requests to the origin on your behalf using Request Signing.

TIP

This page covers Web CDN. For Live Streaming CDN (HLS), private-bucket credentials are configured differently — embedded directly in the origin stream URL — see Using a Cloud Storage Bucket as a Stream Origin.

Setting Up a Public Bucket

If your bucket already allows public read access, set it up the same way as any other origin:

1. Log in to ByteArk Fleet (opens new window) and click Setup New Service, then select Web CDN.
2. Fill in the setup form:
   • Your website: the domain or subdomain you want to serve through the CDN (e.g. cdn.example.com)
   • Your server address: the bucket's virtual-hosted-style hostname, for example my-bucket.s3.ap-southeast-1.amazonaws.com (Amazon S3) or my-bucket.storage.googleapis.com (Google Cloud Storage)
3. Click Setup.
4. Once validated, point your domain's DNS record to the CNAME shown on the Service page.

You can change the bucket hostname later from Settings > Origin, see Changing Origin Server Address.

Setting Up a Private Bucket with Request Signing

If the bucket blocks public/anonymous reads, enable Request Signing so Web CDN authenticates every request it makes to the bucket on your behalf. This only works for buckets from providers whose hostname Web CDN recognizes, listed below.

Supported Providers

Web CDN recognizes the following origin hostnames automatically. Recognizing the hostname is what allows the Request Signing feature to activate.

Provider	Origin hostname pattern	Example
Amazon S3	*.s3.amazonaws.com, *.s3-<region>.amazonaws.com, *.s3.<region>.amazonaws.com	my-bucket.s3.ap-southeast-1.amazonaws.com
Google Cloud Storage	*.storage.googleapis.com	my-bucket.storage.googleapis.com
Firebase Hosting/Storage	*.firebaseapp.com	my-project.firebaseapp.com
Tencent Cloud COS	*.<region>.myqcloud.com	my-bucket.cos.ap-bangkok.myqcloud.com
IBM Cloud Object Storage	*.cloud-object-storage.appdomain.cloud	my-bucket.s3.us-south.cloud-object-storage.appdomain.cloud
Huawei Cloud OBS	*.obs.<region>.myhuaweicloud.com	my-bucket.obs.ap-southeast-1.myhuaweicloud.com
ByteArk Storage	*.s3.byteark.com, *.st-th-1.byteark.com, *.st-th-2.byteark.com, *.st-th.byteark.com	my-bucket.s3.byteark.com

TIP

Use the bucket's virtual-hosted-style hostname (<bucket>.<provider-domain>), not the path-style form (<provider-domain>/<bucket>). Path-style origins won't match the patterns above.

WARNING

Other S3-compatible storage services — such as DigitalOcean Spaces, Backblaze B2, Wasabi, or Azure Blob Storage — can still be used as an origin, but their hostnames aren't recognized above. This means Web CDN cannot sign requests to them: only their public buckets/containers can be used as an origin. If you need Request Signing for another provider, or your origin's hostname doesn't match any pattern above, please contact ByteArk support at support@byteark.com.

1. Set up the service first as described above, using the bucket's hostname as Your server address.
2. Open the service, go to the Settings tab, and find the Origin Request Setting panel.
3. Under Request Signing, set Authentication Type to AWS S3 (Signature V2).
4. Fill in:
   • Bucket Name — the bucket name only (not the full hostname)
   • Access Key — the storage access key ID
   • Access Secret — the storage secret access key
5. Click Save.

WARNING

Request Signing currently supports AWS Signature Version 2 only.

Notes:

• A Web CDN service supports one origin bucket and one set of credentials at a time. There's no per-path or multi-bucket routing for Web CDN (that capability exists only for ByteArk's streaming/HLS CDN product).
• When updating an existing configuration, leaving Access Secret blank keeps the previously saved secret unchanged — only fill it in when you want to replace it.
• To stop signing requests and switch back to a public bucket, set Authentication Type back to None.

Troubleshooting

• 403 Forbidden from the origin — check that the bucket/object is public-read, or that Request Signing is enabled with the correct Bucket Name, Access Key, and Access Secret, and that the bucket's region still supports Signature V2.
• Origin not reachable / setup validation fails — make sure you used the bucket's virtual-hosted-style hostname and that the bucket exists in the region specified in that hostname.
• Content doesn't update after replacing an object — this is a caching behavior, not an origin issue. See Purging Cache and Cache Settings.