MeetStream Guide: Alibaba Cloud OSS Custom Object Storage

By default, MeetStream stores bot media—audio, video, transcripts, screenshots, chat logs, and meeting manifests—in a MeetStream-managed bucket. Fetch endpoints return presigned download URLs for those files.

Custom object storage lets you send those artifacts directly to your own storage account while keeping the same MeetStream bot and fetch APIs.

Use the alibaba_oss provider for Alibaba Cloud Object Storage Service (OSS), through its S3-compatible API. Authenticate with an Alibaba Cloud RAM AccessKey pair.

Only one S3-compatible custom provider is active at a time. Saving a new aws or alibaba_oss configuration activates it and deactivates the other one. Artifacts written before the change remain pinned to their original provider, bucket, and prefix.

Custom storage is useful for compliance, regional data storage, lifecycle control, or direct ingestion into your data platform.

1) Prerequisites

All providers require:

1. A bucket owned by your organization.
2. Credentials that can write to the prefix you configure.
3. A MeetStream API key.

For read_write access, the credentials also need to read uploaded objects so MeetStream can generate download URLs and retrieve JSON artifacts.

1. Create an OSS bucket in the target OSS region.
2. Create a RAM user or RAM role with an AccessKey pair. RAM identities have no OSS access until you attach a RAM or bucket policy.
3. Use the OSS region ID in region (for example, us-east-1 or ap-southeast-1).

MeetStream uses OSS’s S3-compatible API with virtual-hosted bucket addressing. For OSS buckets in Chinese mainland regions, new OSS users may need a HTTPS custom domain (CNAME) rather than the default public endpoint; see Alibaba’s AWS SDK compatibility guidance.

2) Configure custom storage

1
PUT /api/v1/admin/configs?config_type=storage
2
Authorization: Token <YOUR_API_KEY>
3
Content-Type: application/json

1
{
2
  "provider": "alibaba_oss",
3
  "bucket_name": "your-oss-bucket",
4
  "region": "us-east-1",
5
  "access_key_id": "LTAI...",
6
  "secret_key": "...",
7
  "access_mode": "read_write",
8
  "prefix": "meetstream",
9
  "prefixes": {
10
    "audio": "meetstream/audio",
11
    "video": "meetstream/video",
12
    "transcript": "meetstream/transcripts",
13
    "metadata": "meetstream/metadata"
14
  }
15
}

endpoint_url is optional for Alibaba OSS. If omitted, MeetStream uses:

https://s3.oss-<region>.aliyuncs.com

For example, the default endpoint for region: "us-east-1" is https://s3.oss-us-east-1.aliyuncs.com. Set endpoint_url only when you must use an approved HTTPS custom domain or another compatible endpoint.

Parameters

Secrets are stored as encrypted parameters and are never returned by the API.

3) Grant bucket permissions

Scope policies to the configured prefix. If you use distinct category prefixes, include one object resource for each distinct prefix.

For a read_write configuration using the meetstream prefix:

1
{
2
  "Version": "1",
3
  "Statement": [
4
    {
5
      "Effect": "Allow",
6
      "Action": [
7
        "oss:PutObject",
8
        "oss:GetObject",
9
        "oss:DeleteObject"
10
      ],
11
      "Resource": "acs:oss:*:*:your-oss-bucket/meetstream/*"
12
    }
13
  ]
14
}

For write_only, remove oss:GetObject; keep oss:PutObject and oss:DeleteObject.

MeetStream does not require oss:ListObjects to upload or fetch a known object. You may still need it when browsing the bucket through the OSS console or CLI. Alibaba documents the distinction between bucket-level listing and object-level access in its RAM policy guide.

4) Access modes

Use write_only when you want MeetStream to deliver files to your bucket but do not want it to read them back.

Configuration validation

MeetStream validates credentials before saving them:

• alibaba_oss first attempts the compatible HeadBucket request. If a RAM policy intentionally omits bucket-level access, MeetStream instead verifies the required object operations with a temporary object under each configured prefix.
• write_only configurations use temporary write probes under each distinct effective prefix.

Successful probes are cleaned up. Grant oss:DeleteObject to prevent a failed cleanup from leaving a probe object behind.

5) File layout in your bucket

MeetStream writes every artifact below the resolved prefix for its category, followed by the bot ID:

<category-prefix>/<bot_id>/<artifact>

With the default prefix: "meetstream" and no per-category overrides:

meetstream/
  abc123/
    audio.wav
    meeting_recording.mp4
    manifest.json
    participants.json
    chats.json
    screenshot/
    transcription/

With the OSS example configuration above:

meetstream/audio/abc123/
  audio.wav
  audio_manifest.json
  audio_participants/<participant>.wav
meetstream/video/abc123/
  meeting_recording.mp4
  video_manifest.json
  participants/<participant>.mp4
meetstream/metadata/abc123/
  manifest.json
  participants.json
  chats.json
  screenshot/<image-or-debug-file>
meetstream/transcripts/abc123/
  transcription/<provider>/<transcript_id>/processed_transcript.json

The exact provider, bucket, and category prefix used for each processed artifact are recorded with the bot or transcript. Updating a storage configuration later does not break retrieval of existing media.

6) Fetch media after configuration

Your MeetStream API calls do not change when custom storage is enabled. With read_write, the API returns a presigned URL generated by the configured provider. OSS URLs use the configured S3-compatible OSS endpoint.

Presigned media URLs expire after one hour. Call the fetch endpoint again to obtain a fresh URL.

7) View, change, or delete configuration

View

1
GET /api/v1/admin/configs
2
Authorization: Token <YOUR_API_KEY>

The response includes non-sensitive metadata under StorageConfig, for example:

1
{
2
  "StorageConfig": {
3
    "alibaba_oss": {
4
      "active": true,
5
      "bucket_name": "your-oss-bucket",
6
      "region": "us-east-1",
7
      "endpoint_url": "https://s3.oss-us-east-1.aliyuncs.com",
8
      "access_mode": "read_write",
9
      "prefix": "meetstream",
10
      "prefixes": {
11
        "audio": "meetstream/audio",
12
        "video": "meetstream/video",
13
        "transcript": "meetstream/transcripts",
14
        "metadata": "meetstream/metadata"
15
      }
16
    }
17
  }
18
}

Delete

1
DELETE /api/v1/admin/configs?key_name=alibaba_oss
2
Authorization: Token <YOUR_API_KEY>

Deleting a configuration affects only future processing; MeetStream does not delete objects already written to your bucket.

8) Troubleshooting

Saving an OSS configuration returns 400

• Confirm region is the OSS region ID for the bucket.
• Omit endpoint_url to use the default https://s3.oss-<region>.aliyuncs.com, or supply a valid HTTPS custom endpoint.
• Confirm the RAM AccessKey belongs to an identity with oss:PutObject, and also oss:GetObject for read_write.
• For Chinese mainland buckets, ensure your required OSS custom-domain/CNAME setup is complete.

OSS HeadBucket is denied

This can be expected for a prefix-scoped RAM policy. In read_write mode, MeetStream falls back to an object write/read probe. Ensure the policy grants the object-level actions shown in Grant bucket permissions.

A fetch endpoint returns 403 with "access_mode": "write_only"

The configured provider is intentionally write-only. Download the object through your own storage workflow, or update it to read_write with read permissions.

A presigned URL returns 403

• It may have expired; fetch a new one from MeetStream.
• Verify the configured credentials still have object read access.
• For OSS, verify the configured endpoint and region match the bucket.

Files are not in the newly configured bucket

Only artifacts processed after a configuration change use the new active provider. Existing artifacts remain in their original bucket.

9) Provider references

• Alibaba Cloud: Access OSS with AWS SDKs
• Alibaba Cloud: S3 API compatibility
• Alibaba Cloud: RAM policies for OSS prefixes