> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://developers.alephant.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.alephant.io/_mcp/server. # Tencent Cloud COS > Configure the Tencent Cloud COS connector with minimum read-only access to a specific bucket prefix. Use the Tencent Cloud COS connector to index approved files from object storage. Create one connector per business knowledge directory, and restrict the Tencent Cloud CAM permission to the exact bucket and prefix. ## Use cases | Scenario | Recommendation | | -------------------------- | --------------------------------------------------------------------------------------------------------- | | COS knowledge directory | Use a fixed bucket and prefix, such as `knowledge/`, and sync only objects under that directory. | | Project material retrieval | Use a separate prefix for each project so access, deactivation, and reindexing stay isolated. | | Restricted files | Use AIvis **Private** document access and assign specific users or groups. | | Public-bucket migration | Change the COS bucket to **Private read/write** before connecting it through a minimum-read CAM sub-user. | ## Prepare Tencent Cloud 1. Sign in to the Tencent Cloud console. 2. Open **Cloud Access Management (CAM)** → **Users** → **User List**. 3. Create a sub-user dedicated to this deployment, such as `aivis-cos-reader`. Do not use a root-account key. 4. Open the sub-user detail page, go to **API Key**, and click **Create key**. 5. Save the `SecretId` and `SecretKey` after creation: * Put `SecretId` in the AIvis credential's **Key ID** field. * Put `SecretKey` in the AIvis credential's **Secret key** field. * Leave **Session Token** empty when using a permanent key. Tencent Cloud disabled later `SecretKey` lookup starting on November 30, 2023. A newly created key shows the `SecretKey` only at creation time. If it was not saved, create a new key, verify it, then delete or disable the old key. See [Tencent Cloud sub-account access key management](https://cloud.tencent.com/document/product/598/37140). ## COS files and permissions In the COS console: 1. Open the target bucket, such as `aivis-cos-test-1250000000`. 2. Create the `knowledge/` folder in **File List**. 3. Upload the PDFs, Word documents, Markdown files, TXT files, and other approved documents to that folder. 4. Grant the CAM sub-user read-only access limited to `aivis-cos-test-1250000000/knowledge/*`. At minimum, allow: | Permission | Purpose | | --------------- | ------------------------------------------- | | `cos:GetBucket` | List objects under the `knowledge/` prefix. | | `cos:GetObject` | Read object content for indexing. | Do not grant write or delete permissions. If the bucket is still **Public read/write**, change it to **Private read/write** before creating or enabling the connector. ## Credential fields Create a Tencent Cloud COS credential in AIvis: ![Create Tencent Cloud COS credential dialog with SecretId, SecretKey, and an empty Session Token for a permanent key](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/alephantai.docs.buildwithfern.com/2e6591cb1b734a6c05a1e86372777bd413e08bab81aa3a53ca69946498afff71/assets/aivis/tencent-cos/tencent-cos-credential-form.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260805%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260805T115803Z&X-Amz-Expires=604800&X-Amz-Signature=0fcd99c8faaddca1b130cf5a18f19b6de34406593c2156d980b74794531ac0cf&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) | Field | Value | | ---------------------- | ------------------------------------------------------------------------------------------- | | SecretId / Key ID | The `SecretId` generated for the Tencent Cloud CAM sub-user, usually beginning with `AKID`. | | SecretKey / Secret key | The `SecretKey` paired with that `SecretId`. | | Session Token | Leave empty for a permanent key; fill it only when using a temporary key. | Do not enter a `cli_...` Client ID from another system, and do not send the `SecretKey` to anyone or commit it to source control. ## Connector example This example configures a test connector that indexes only the `knowledge/` directory: ![Tencent Cloud COS connector form with connector name, bucket name, prefix, region, and object ACL restriction confirmation](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/alephantai.docs.buildwithfern.com/4f5ddda82bcb75f488f1f92d53b4de67a52f953da6a63b53554d79bfbca9f413/assets/aivis/tencent-cos/tencent-cos-connector-form.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260805%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260805T115803Z&X-Amz-Expires=604800&X-Amz-Signature=ecc29371d33f56cc5adf5e6b6ed3d0f658b466629dc865ec36ce3b8bc3a5360a&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) | Field | Value | | ---------------------------- | ---------------------------------------------- | | Connector name | Tencent Cloud COS test | | Bucket name | `aivis-cos-test-1250000000` | | Prefix | `knowledge/` | | Region | `ap-guangzhou` | | Advanced Endpoint | Leave empty | | ACL restriction confirmation | Checked | | Document access | Prefer **Private** and assign users or groups. | The prefix should start with a normal directory name, not `/`, and should usually end with `/`. Do not include unapproved directories in the same connector scope. ## Verify ![Tencent Cloud COS connector list showing indexing status, organization-public access, and indexed document count](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/alephantai.docs.buildwithfern.com/34ae57acd3f5dad750d9c312444a862a91e908d7133679b5c2bc0a733bb68858/assets/aivis/tencent-cos/tencent-cos-indexing-list.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260805%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260805T115803Z&X-Amz-Expires=604800&X-Amz-Signature=09f946ed65571b40f458826554899616ec3d2ca8e17edcf2961d06c689f6a16b&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) 1. After creating the credential, confirm credential validation succeeds. 2. Create the connector and run one index attempt. 3. Confirm the indexed results include only objects under the `knowledge/` prefix. 4. Search for a representative title or sentence from an uploaded file and confirm the result cites the source. 5. Test with an unauthorized AIvis user and confirm private connector content is not searchable. ## Troubleshooting | Symptom | Likely cause and action | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Credential is invalid | Confirm the `SecretId` and `SecretKey` belong to the same CAM sub-user, and that a `cli_...` Client ID was not entered as the key ID. | | Objects cannot be listed | Confirm the sub-user has `cos:GetBucket` permission for the target bucket and prefix, and check that the region matches the bucket region, such as `ap-guangzhou`. | | Objects are listed but cannot be read | Confirm the sub-user has `cos:GetObject` permission and that the policy scope covers `knowledge/*`. | | Too many files are indexed | Check whether the prefix is too broad. Use an explicit directory such as `knowledge/`, and restrict the CAM policy to the same prefix. | | Users can search files they should not access | COS file ACLs are not synchronized into AIvis search permissions. Use private document access, or split bucket prefixes and connectors by audience. | ## Related pages * [Connectors & Indexing](/aivis/knowledge/connectors) * [Index Settings](/aivis/knowledge/index-settings)