MeetStream Guide: Alibaba Cloud OSS Custom Object Storage

By default, MeetStream stores bot media—audio, video, transcripts, screenshots, chat logs, and meeting manifests—in a MeetStream-managed bucket. Fetch endpoints return presigned download URLs for those files.

Custom object storage lets you send those artifacts directly to your own storage account while keeping the same MeetStream bot and fetch APIs.

For Cloudflare R2, multiple destinations, and selecting a saved destination with storage_config_id, see Custom Object Storage.

Use the alibaba_oss provider for Alibaba Cloud Object Storage Service (OSS), through its S3-compatible API. Authenticate with an Alibaba Cloud RAM AccessKey pair.

Configure your storage destination in the MeetStream dashboard. Artifacts written before a configuration change remain in their original bucket and prefix.

Custom storage is useful for compliance, regional data storage, lifecycle control, or direct ingestion into your data platform.

1) Prerequisites

To set up Alibaba Cloud OSS, you need:

A bucket owned by your organization.
Credentials that can write to the prefix you configure.
Access to the MeetStream dashboard.

For read_write access, the credentials also need to read uploaded objects so MeetStream can generate download URLs and retrieve JSON artifacts.

Create an OSS bucket in the target OSS region.
Create a RAM user or RAM role with an AccessKey pair. RAM identities have no OSS access until you attach a RAM or bucket policy.
Use the OSS region ID in region (for example, us-east-1 or ap-southeast-1).

MeetStream uses OSS’s S3-compatible API with virtual-hosted bucket addressing. For OSS buckets in Chinese mainland regions, new OSS users may need a HTTPS custom domain (CNAME) rather than the default public endpoint; see Alibaba’s AWS SDK compatibility guidance.

2) Configure custom storage

Open Custom Storage in the MeetStream dashboard, add an Alibaba Cloud OSS destination, and enter your bucket, region, and RAM AccessKey pair. Choose the access mode and object-key prefixes you need, then save the destination. Configure, update, and remove storage destinations in the dashboard; storage configuration is not available through the public API or SDK.

endpoint_url is optional for Alibaba OSS. If omitted, MeetStream uses:

https://s3.oss-<region>.aliyuncs.com

For example, the default endpoint for region: "us-east-1" is https://s3.oss-us-east-1.aliyuncs.com. Set endpoint_url only when you must use an approved HTTPS custom domain or another compatible endpoint.

Dashboard settings

Setting	Required	Description
`provider`	Yes	`"alibaba_oss"`.
`bucket_name`	Yes	Name of your OSS bucket.
`region`	Yes	OSS region ID.
`access_key_id`	Yes	Alibaba Cloud RAM AccessKey ID.
`secret_key`	Yes	Alibaba Cloud RAM AccessKey secret.
`access_mode`	No	`"read_write"` (default) or `"write_only"`. See Access modes.
`prefix`	No	Base object-key prefix. Defaults to `"meetstream"`. Leading/trailing slashes are removed and `..` is rejected.
`prefixes`	No	Per-category overrides for `audio`, `video`, `transcript`, and `metadata`. A missing category inherits `prefix`.
`endpoint_url`	No	HTTPS endpoint override. Omit it to use the S3-compatible regional default.

Enter credentials only in the dashboard. Do not put storage secrets in client-side code.

3) Grant bucket permissions

Scope policies to the configured prefix. If you use distinct category prefixes, include one object resource for each distinct prefix.

For a read_write configuration using the meetstream prefix:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:PutObject",
        "oss:GetObject",
        "oss:DeleteObject"
      ],
      "Resource": "acs:oss:*:*:your-oss-bucket/meetstream/*"
    }
  ]
}

For write_only, remove oss:GetObject. oss:PutObject is required; oss:DeleteObject is recommended so validation probes can be cleaned up.

MeetStream does not require oss:ListObjects to upload or fetch a known object. You may still need it when browsing the bucket through the OSS console or CLI. Alibaba documents the distinction between bucket-level listing and object-level access in its RAM policy guide.

4) Access modes

Mode	MeetStream uploads to your bucket	MeetStream fetch APIs
`read_write` (default)	Yes	Return presigned URLs or read JSON artifacts from your bucket
`write_only`	Yes	Return `403`; retrieve objects directly through your own storage access

Use write_only when you want MeetStream to deliver files to your bucket but do not want it to read them back.

Configuration validation

MeetStream validates credentials before saving them:

alibaba_oss first attempts the compatible HeadBucket request. If a RAM policy intentionally omits bucket-level access, MeetStream instead verifies the required object operations with a temporary object under each configured prefix.
write_only configurations use temporary write probes under each distinct effective prefix.

Successful probes are cleaned up on a best-effort basis. Grant oss:DeleteObject to prevent a failed cleanup from leaving a probe object behind.

5) File layout in your bucket

MeetStream writes every artifact below the resolved prefix for its category, followed by the bot ID:

<category-prefix>/<bot_id>/<artifact>

With the default prefix: "meetstream" and no per-category overrides:

meetstream/
  abc123/
    audio.wav
    meeting_recording.mp4
    manifest.json
    participants.json
    chats.json
    screenshot/
    transcription/

With separate category prefixes such as meetstream/audio, meetstream/video, meetstream/metadata, and meetstream/transcripts:

meetstream/audio/abc123/
  audio.wav
  audio_manifest.json
  audio_participants/<participant>.wav
meetstream/video/abc123/
  meeting_recording.mp4
  video_manifest.json
  participants/<participant>.mp4
meetstream/metadata/abc123/
  manifest.json
  participants.json
  chats.json
  screenshot/<image-or-debug-file>
meetstream/transcripts/abc123/
  transcription/<provider>/<transcript_id>/processed_transcript.json

The provider, bucket, and category prefix used for each processed artifact are recorded with the bot or transcript. Keep credentials for earlier buckets available if you need to retrieve older media after changing a destination.

6) Fetch media after configuration

Your MeetStream API calls do not change when custom storage is enabled. With read_write, the API returns a presigned URL generated by the configured provider. OSS URLs use the configured S3-compatible OSS endpoint.

Endpoint	`read_write`	`write_only`
`GET /api/v1/bots/{bot_id}/get_audio`	Presigned mixed-audio URL	`403`
`GET /api/v1/bots/{bot_id}/get_video`	Presigned recording URL	`403`
`GET /api/v1/bots/{bot_id}/get_audio_streams`	Per-participant audio URLs, when requested for the bot	`403`
`GET /api/v1/bots/{bot_id}/get_recording_streams`	Per-participant video URLs, when requested for the bot	`403`
Screenshot, chat, participant, manifest, and transcript fetch endpoints	Read from the configured bucket	`403`

Presigned URL lifetimes vary by artifact; see Usage & Retention. Call the fetch endpoint again for a fresh URL.

7) View, change, or delete configuration

Use Custom Storage in the MeetStream dashboard to view, change, or remove a destination. Removing a configuration affects future processing; it does not delete objects already written to your bucket.

8) Troubleshooting

The dashboard rejects an OSS configuration

Confirm region is the OSS region ID for the bucket.
Omit endpoint_url to use the default https://s3.oss-<region>.aliyuncs.com, or supply a valid HTTPS custom endpoint.
Confirm the RAM AccessKey belongs to an identity with oss:PutObject, and also oss:GetObject for read_write.
For Chinese mainland buckets, ensure your required OSS custom-domain/CNAME setup is complete.

OSS HeadBucket is denied

This can be expected for a prefix-scoped RAM policy. In read_write mode, MeetStream falls back to an object write/read probe. Ensure the policy grants the object-level actions shown in Grant bucket permissions.

A fetch endpoint returns 403 with "access_mode": "write_only"

The configured provider is intentionally write-only. Download the object through your own storage workflow, or update it to read_write with read permissions.

A presigned URL returns 403

It may have expired; fetch a new one from MeetStream.
Verify the configured credentials still have object read access.
For OSS, verify the configured endpoint and region match the bucket.

Files are not in the newly configured bucket

Only artifacts processed after a configuration change use the new destination. Existing artifacts remain in their original bucket.