Skip to main content
Guyun
Language 简体 繁體 English

Tencent Cloud COS

About 10 minutes and no money: this is how you prepare one bucket and one key pair in Tencent Cloud COS for Guyun.

If the console appears in Chinese, match the buttons by meaning.

Step by step

  1. Step 1

    Create the bucket

    • First, be sure which site you are on: international www.tencentcloud.com (console console.intl.cloud.tencent.com) or China cloud.tencent.com (console console.cloud.tencent.com) — the accounts do not carry over.
    • In the Tencent Cloud console open COS → Bucket list → Create bucket, enter a name, pick a region close to you (say ap-guangzhou) and set the access mode to private read/write.
    • Your APPID is appended to the bucket name, giving something like my-photos-1234567890: copy the whole name, suffix included — that is the name Guyun needs.

  2. Step 2

    Create a sub-user and its key

    • Open CAM → Users → Create user and tick programmatic access only — not console login.
    • Copy the SecretId and SecretKey of that sub-user. The secret is shown once, so save both values now; never use the root account's key.

  3. Step 3

    Give the sub-user permission

    • In CAM go to Policies → Create custom policy → create by policy syntax, paste the JSON below into the policy and save it.
    • Open that sub-user under Users and use Associate policies to attach it — or attach the two preset policies below instead.

  4. Step 4

    Fill it in and test

    • In Guyun open Add storage, choose Tencent Cloud COS and enter the bucket name, APPID, endpoint and key from the table below.
    • Choose Test connection & save; the storage then appears in Guyun's list.

APPID and endpoint: the two easy mistakes

APPID is the digits of your account (1234567890 in these examples): find it under account information in the console, or at the end of any bucket you have. Tencent Cloud COS and Cloudflare R2 each have one more field than other providers (APPID / Account ID); pasting the full bucket name works too.

Use the service endpoint https://cos.<region>.myqcloud.com, with no bucket name in it. The console overview shows an address like https://<bucket>.cos.<region>.myqcloud.com — that is the access domain, meant for browsers, and pasting it as the endpoint will fail.

What the sub-user needs: one CAM custom policy

Replace the bucket name, APPID and region with your own (the examples are made up):

json 
{
  "version": "2.0",
  "statement": [
    { "effect": "allow", "action": ["cos:*"],
      "resource": ["qcs::cos:ap-guangzhou:uid/1234567890:your-bucket-name-1234567890/*"] }
  ]
}

The policy deliberately leaves out deleting buckets. In CAM, permission names are actions, not policy names, so searching the policy list finds nothing — create the policy by syntax instead.

Other cases (skip if not needed)

Both consoles exist, so pick whichever is yours: international https://www.tencentcloud.com/ (console https://console.intl.cloud.tencent.com/), China https://cloud.tencent.com/ (console https://console.cloud.tencent.com/).

  • Guyun only accesses the single bucket you enter (it neither lists nor creates buckets), so the bucket-level statement is all you need.
  • Want a smaller permission: replace cos:* in the bucket-level statement with just the actions you use (read, upload, list).

Buckets created after 1 January 2024

  • The default domain does not preview: reaching files through the COS default domain downloads them instead of previewing them.
  • APK / IPA files cannot be served from the default domain: such requests answer DownloadForbidden. To share those two file types, bind a custom domain (and for a mainland China bucket the domain also needs an ICP filing).

Copy these values

They go into the matching fields on Guyun's "Add storage" screen (Tencent Cloud COS has one extra field, APPID): Place: pick the matching entry in the app (Beijing / Hong Kong / Guangzhou / us-west-004 …) — the region and the HTTPS endpoint are filled in for you.

This valueWhere it goes in Guyun
Bucket name
The whole name from the console, including the -APPID suffix, e.g. my-photos-1234567890.		Bucket name
APPID
The digits at the end of the bucket name, e.g. 1234567890 — see account information in the console, or any bucket you have.		APPID
Endpoint
The service endpoint, e.g. https://cos.ap-guangzhou.myqcloud.com, with no bucket name.		Endpoint
Key
The SecretId and SecretKey of the sub-user you just created.		SecretId and SecretKey

How to tell it worked

  • The connection test passes, which means the key can read this bucket; Guyun only lists the root of the bucket you entered and changes nothing.
  • The storage then appears in Guyun's list, and you can open it to see the files in the bucket.
  • If it fails, see common errors.

Go back to Guyun and choose Test connection & save.