Skip to content

Backend object access: use the internal endpoint, not the CDN

A CDN is for last-mile delivery to clients. For server-to-server object access, go straight to object storage over its internal endpoint.

Backend object access: CDN path versus the storage internal endpoint Via the CDN, a backend request crosses CDN points of presence and partner ISPs on the public internet and can reroute to another region. Via the object storage internal endpoint, it stays on the provider backbone in-region. VIA CDN · UNCONTROLLED Backend NAT Partner ISPs / BGP public internet CDN PoP far region on reroute VIA INTERNAL ENDPOINT · STABLE Backend Object storage internal endpoint provider backbone · in-region

Three addresses for one object

public  (CDN):     https://<cdn-domain>/<object>
public  (storage): https://<bucket>.<region>.aliyuncs.com/<object>
private (storage): https://<bucket>.<region>-internal.aliyuncs.com/<object>

(Alibaba Cloud OSS shown. Every cloud has an equivalent private path: AWS S3 via a VPC gateway or interface endpoint, GCS via private access.)

Why not the CDN for a backend

CDN points of presence sit on partner ISPs and do not all peer with every cloud region. A backend request egresses through the NAT gateway onto the public internet, crosses third-party ISPs routed by BGP the cloud does not control, and only then reaches a CDN PoP. An ISP or BGP fault can reroute it to a PoP in a far region, giving non-deterministic latency plus internet egress cost.

CDN vs internal endpoint

Property Backend to CDN PoP (public) Backend to internal endpoint (private)
Network public internet provider backbone
Path control partner ISP / BGP, not yours provider, in-region
Peering guarantee none for every PoP yes
Reroute on ISP or BGP fault yes, to another ISP or region no
Latency under fault non-deterministic stable, intra-region
Internet egress cost billed none
Designed for client, last-mile delivery server-to-server object access

Rule

Backend-originated object access must not traverse the CDN. Use the storage internal endpoint so the traffic stays on the provider backbone, in-region, with no internet egress.

Sources