Common errors
When a connection fails, start here: the table lists the usual error codes per provider and what to do.
If you arrived from Guyun with an error code, the matching row is highlighted.
Check these three first
The bucket name is complete (Tencent Cloud COS appends -APPID, which is part of the name).
The endpoint is the service endpoint, not the “access domain” the console shows; it holds the host only — no bucket name, no path.
The key covers this one bucket (never the root account's key).
Error codes and fixes
| Provider | Symptom / code | What it usually is | What to do |
|---|---|---|---|
| Any | 403 AccessDenied | the key has no permission, or the bucket name in the policy is wrong | read the “minimal policy” section of that provider's guide |
| Any | SignatureDoesNotMatch / InvalidAccessKeyId | the key was copied wrongly, or the secret was shown once and not saved | generate a new key pair and copy it whole |
| Any | Test connection & save passes, but uploads fail | only read permission was granted (list buckets, get objects) | add permission to write and delete objects |
| Any | Will not connect, or times out, with no error code | the endpoint or the addressing style is wrong | use the endpoint rule from the guide; make sure it has no bucket name or path |
| Alibaba Cloud OSS | PublicEndpointForbidden | the bucket is in mainland China and the account activated OSS on or after 20 March 2025, but the default public endpoint was used | bind a domain with a completed ICP filing (route 1), or move the bucket to an overseas region |
| Alibaba Cloud OSS | Cannot connect after binding your own domain | DNS has not picked up the CNAME yet, or the certificate is wrong | wait for DNS (usually minutes); check the certificate matches the domain and the addressing mode is custom domain (CNAME) |
| Tencent Cloud COS | 403 AccessDenied (the key looks right) | the bucket name was copied without its -APPID suffix | copy the full bucket name from the console (e.g. my-photos-1234567890) |
| Tencent Cloud COS | The endpoint holds the console's “access domain” | that address already contains the bucket name and is meant for browsers | use https://cos.<region>.myqcloud.com as the endpoint and enter the bucket name separately |
| Tencent Cloud COS | The SecretKey was not saved | the secret is shown once, when the sub-user is created | generate a new key pair for that sub-user in CAM and replace both values in Guyun |
| AWS S3 | AuthorizationHeaderMalformed / PermanentRedirect (301) | the region in the endpoint is not the bucket's actual region | set the endpoint to https://s3.<region>.amazonaws.com for the bucket's own region, and use the same region in the region field |
| AWS S3 | InvalidAccessKeyId / SignatureDoesNotMatch although the key looks right | account and bucket are in different partitions (the global aws and China aws-cn are separate) | make sure the bucket and the account are in the same partition: a China-region bucket needs a key from a China account |
| AWS S3 | 403 AccessDenied even though the policy exists | a bucket name is misspelled in one of the two ARNs, or the bucket ARN has a trailing slash (bucket level is arn:aws:s3:::bucket, object level is …/bucket/*) | copy the policy from the AWS S3 guide: no slash at bucket level, /* at object level |
Codes that are not listed here: check the provider's own error-code documentation, or report it from inside the Guyun app.