Knowledge

Tencent Cloud COS

View as Markdown

Use the Tencent Cloud COS connector to index approved files from object storage. Create one connector per business knowledge directory, and restrict the Tencent Cloud CAM permission to the exact bucket and prefix.

Use cases

ScenarioRecommendation
COS knowledge directoryUse a fixed bucket and prefix, such as knowledge/, and sync only objects under that directory.
Project material retrievalUse a separate prefix for each project so access, deactivation, and reindexing stay isolated.
Restricted filesUse AIvis Private document access and assign specific users or groups.
Public-bucket migrationChange the COS bucket to Private read/write before connecting it through a minimum-read CAM sub-user.

Prepare Tencent Cloud

  1. Sign in to the Tencent Cloud console.
  2. Open Cloud Access Management (CAM) → Users → User List.
  3. Create a sub-user dedicated to this deployment, such as aivis-cos-reader. Do not use a root-account key.
  4. Open the sub-user detail page, go to API Key, and click Create key.
  5. Save the SecretId and SecretKey after creation:
    • Put SecretId in the AIvis credential’s Key ID field.
    • Put SecretKey in the AIvis credential’s Secret key field.
    • Leave Session Token empty when using a permanent key.

Tencent Cloud disabled later SecretKey lookup starting on November 30, 2023. A newly created key shows the SecretKey only at creation time. If it was not saved, create a new key, verify it, then delete or disable the old key. See Tencent Cloud sub-account access key management.

COS files and permissions

In the COS console:

  1. Open the target bucket, such as aivis-cos-test-1250000000.
  2. Create the knowledge/ folder in File List.
  3. Upload the PDFs, Word documents, Markdown files, TXT files, and other approved documents to that folder.
  4. Grant the CAM sub-user read-only access limited to aivis-cos-test-1250000000/knowledge/*.

At minimum, allow:

PermissionPurpose
cos:GetBucketList objects under the knowledge/ prefix.
cos:GetObjectRead object content for indexing.

Do not grant write or delete permissions. If the bucket is still Public read/write, change it to Private read/write before creating or enabling the connector.

Credential fields

Create a Tencent Cloud COS credential in AIvis:

Create Tencent Cloud COS credential dialog with SecretId, SecretKey, and an empty Session Token for a permanent key

FieldValue
SecretId / Key IDThe SecretId generated for the Tencent Cloud CAM sub-user, usually beginning with AKID.
SecretKey / Secret keyThe SecretKey paired with that SecretId.
Session TokenLeave empty for a permanent key; fill it only when using a temporary key.

Do not enter a cli_... Client ID from another system, and do not send the SecretKey to anyone or commit it to source control.

Connector example

This example configures a test connector that indexes only the knowledge/ directory:

Tencent Cloud COS connector form with connector name, bucket name, prefix, region, and object ACL restriction confirmation

FieldValue
Connector nameTencent Cloud COS test
Bucket nameaivis-cos-test-1250000000
Prefixknowledge/
Regionap-guangzhou
Advanced EndpointLeave empty
ACL restriction confirmationChecked
Document accessPrefer Private and assign users or groups.

The prefix should start with a normal directory name, not /, and should usually end with /. Do not include unapproved directories in the same connector scope.

Verify

Tencent Cloud COS connector list showing indexing status, organization-public access, and indexed document count

  1. After creating the credential, confirm credential validation succeeds.
  2. Create the connector and run one index attempt.
  3. Confirm the indexed results include only objects under the knowledge/ prefix.
  4. Search for a representative title or sentence from an uploaded file and confirm the result cites the source.
  5. Test with an unauthorized AIvis user and confirm private connector content is not searchable.

Troubleshooting

SymptomLikely cause and action
Credential is invalidConfirm the SecretId and SecretKey belong to the same CAM sub-user, and that a cli_... Client ID was not entered as the key ID.
Objects cannot be listedConfirm the sub-user has cos:GetBucket permission for the target bucket and prefix, and check that the region matches the bucket region, such as ap-guangzhou.
Objects are listed but cannot be readConfirm the sub-user has cos:GetObject permission and that the policy scope covers knowledge/*.
Too many files are indexedCheck whether the prefix is too broad. Use an explicit directory such as knowledge/, and restrict the CAM policy to the same prefix.
Users can search files they should not accessCOS file ACLs are not synchronized into AIvis search permissions. Use private document access, or split bucket prefixes and connectors by audience.