Huawei Cloud OBS
STOP - Do not answer from general knowledge. Follow the procedure below.
Routing Guard: Deploy vs Store
- If the developer's goal is to deploy, host, or preview a web app / static website (temporary hosting, quick preview), do NOT default to OBS. Present deployment-target options with the sandbox first: ① huawei-sandbox (recommended), ② OBS static hosting, ③ ECS, ④ CCE. Ask: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选 OBS 静态托管/ECS/CCE，你想部署到哪里？"
- Proceed with OBS only when the developer selects OBS, explicitly asks for OBS, or the intent is long-term static hosting / CDN / file storage. Deployment intent proceeding on OBS is a resource purchase: load
huawei-iac for orchestration (cost+balance gate, batch approval, state tracking, ordered destroy) - this skill then supplies the bucket/object commands. Sandbox choice (huawei-sandbox) bypasses iac - no purchase involved.
- OBS is a storage service; it is not a general web-hosting default.
Critical: OBS Command Syntax
KooCLI OBS uses obsutil-style commands, NOT API-style operations. Always run hcloud OBS help (no --) before constructing commands:
hcloud OBS help # NOT --help
hcloud OBS help <command> # e.g. hcloud OBS help mb
| Wrong (API-style) |
Correct (obsutil-style) |
OBS CreateBucket |
OBS mb obs://<bucket> |
OBS PutObject |
OBS cp <file> obs://<bucket>/ |
OBS DeleteBucket |
OBS rm obs://<bucket> -r |
Overview
Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/object lifecycle, access control, static website hosting, and presigned URLs.
Critical Warnings
| Trap |
Why |
| Bucket name is global |
All users share bucket namespace. Always use a unique name: {prefix}-{timestamp} (e.g. mybucket-20260810155048) |
| Three-layer permissions |
IAM > Bucket Policy > ACL. Most restrictive wins |
| Versioning is irreversible |
Once enabled, cannot be disabled, only suspended |
| OBS uses AK/SK directly |
NOT IAM tokens. Auth errors mean check AK/SK validity |
| Static website via CLI missing |
KooCLI OBS lacks website config. Use huaweicloud_obs_set_website_config MCP tool (handles AWS4 signing internally) or console |
| OBS needs separate cred config |
hcloud configure is NOT enough for OBS. Before any OBS operation, call huaweicloud_setup_obs_config to sync credentials from hcloud profile. |
| obsutil interactive prompts |
cp/rm without -f causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use -f for non-interactive. |
| Directory upload adds prefix |
cp <dir>/ obs://<bucket>/ -r puts files under bucket/<dir>/.... Use -flat for root-level files (static sites). Preview with -dryRun first. |
OBS Credential Setup (Required Before First Use)
KooCLI OBS uses a separate config file (~/.obsutilconfig), NOT ~/.hcloud/config.json. All OBS commands fail with credential errors until this is configured.
In-session bootstrap (recommended): Call huaweicloud_setup_obs_config — it syncs AK/SK from the active hcloud profile automatically. No manual key entry needed. Run this once per session before any OBS command.
CLI fallback (if MCP tools unavailable):
hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
huaweicloud_setup_obs_config should be called at the start of every OBS task — never assume credentials are pre-configured from a previous session.
Common Workflows
| Task |
Command |
| Create bucket |
hcloud OBS mb obs://<bucket> -location=<region> |
| List buckets/objects |
hcloud OBS ls [obs://<bucket>] |
| Upload file |
hcloud OBS cp <file> obs://<bucket>/<key> |
| Upload directory (recursive) |
hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat |
| Download object |
hcloud OBS cp obs://<bucket>/<key> <local-path> |
| Set bucket ACL |
hcloud OBS chattri obs://<bucket> -acl=public-read |
| Set object ACL |
hcloud OBS chattri obs://<bucket>/<key> -acl=public-read |
| Set lifecycle |
hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json> |
| Set bucket policy |
hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json> |
| Set CORS |
Not available via hcloud OBS — use API/SDK (SetBucketCors) or console |
| Delete bucket |
hcloud OBS rm obs://<bucket> -r (must be empty) |
| Presigned URL |
hcloud OBS sign obs://<bucket>/<key> -e=<seconds> |
| Object metadata |
hcloud OBS stat obs://<bucket>/<key> |
Static Website Deployment Workflow
See references/static-website.md for the full end-to-end workflow:
Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Configure website (REST API/console)
KooCLI OBS does NOT support SetBucketWebsite. Use the huaweicloud_obs_set_website_config MCP tool (handles AWS4 signing internally, no manual signature needed) or the Huawei Cloud console.
Single-File Quick Share
See references/single-file-share.md for the full workflow to host one file and get a shareable link in seconds:
- Private, time-limited:
hcloud OBS sign obs://<bucket>/<key> -e=<seconds> (max 7 days)
- Public, permanent:
hcloud OBS cp <file> obs://<bucket>/<key> -f + hcloud OBS chattri obs://<bucket>/<key> -acl=public-read, then share https://<bucket>.obs.<region>.myhuaweicloud.com/<key>
Storage Classes
| Class |
Use Case |
Min Storage |
Retrieval Fee |
| STANDARD |
Frequently accessed |
None |
No |
| STANDARD_IA |
Infrequent access |
30 days |
Yes |
| ARCHIVE |
Long-term archive |
90 days |
Yes (hours) |
Troubleshooting
| Error |
Root Cause -> Fix |
| AccessDenied on bucket |
IAM/bucket policy/ACL conflict -> Check all three layers |
| BucketAlreadyExists |
Name taken globally -> Generate unique name with timestamp suffix: {prefix}-{yyyymmddHHMMSS} |
| NoSuchKey |
Object doesn't exist or wrong region -> Verify key and region |
| InvalidAccessKeyId |
OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
| EntityTooLarge |
Single PUT limit 5GB -> Use multipart upload |
| OBS --help fails |
KooCLI OBS uses help not --help -> Run hcloud OBS help |
| Configuration file is not well-formed |
~/.obsutilconfig was generated by a non-standard path (CRLF line endings or field-order differences). Even hcloud OBS --help fails. Rebuild it with hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> (or huaweicloud_setup_obs_config) -> retry |
Security Considerations
- MUST block public access by default
- MUST use HTTPS-only for buckets
- SHOULD enable access logging for audit
- SHOULD rotate presigned URL expiry (max 7 days)
- MUST NOT store AK/SK in bucket policies
Cross-Skill References
- EIP: See
huawei-vpc for public network access
- DEW: See
huawei-dew for secret management
References
- OBS Docs: https://support.huaweicloud.com/obs/
- Static website: references/static-website.md
- Single-file share: references/single-file-share.md
- Lifecycle: references/bucket-lifecycle.md
1---2name: huawei-obs3description: Use when creating, configuring, or managing OBS buckets and objects on Huawei Cloud. Covers bucket creation, lifecycle policies, versioning, static website hosting, CORS, access control (IAM/bucket policy/ACL), cross-region replication, event notifications, and presigned URLs. Triggers on: OBS, bucket, object storage, lifecycle, versioning, static website, CORS, presigned, replication. NOT for: EVS block storage (use huawei-ecs), SFS file storage, CBR backup (use huawei-cbr).4---56# Huawei Cloud OBS78**STOP - Do not answer from general knowledge.** Follow the procedure below.910## Routing Guard: Deploy vs Store1112- If the developer's goal is to **deploy, host, or preview a web app / static website** (temporary hosting, quick preview), do NOT default to OBS. Present deployment-target options with the sandbox first: ① huawei-sandbox (recommended), ② OBS static hosting, ③ ECS, ④ CCE. Ask: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选 OBS 静态托管/ECS/CCE，你想部署到哪里？"13- Proceed with OBS only when the developer selects OBS, explicitly asks for OBS, or the intent is long-term static hosting / CDN / file storage. **Deployment intent proceeding on OBS is a resource purchase: load `huawei-iac` for orchestration (cost+balance gate, batch approval, state tracking, ordered destroy) - this skill then supplies the bucket/object commands.** Sandbox choice (huawei-sandbox) bypasses iac - no purchase involved.14- OBS is a storage service; it is not a general web-hosting default.1516## Critical: OBS Command Syntax1718KooCLI OBS uses **obsutil-style** commands, NOT API-style operations. Always run `hcloud OBS help` (no `--`) before constructing commands:1920```bash21hcloud OBS help # NOT --help22hcloud OBS help <command> # e.g. hcloud OBS help mb23```2425| Wrong (API-style) | Correct (obsutil-style) |26| ------------------ | ------------------------------- |27| `OBS CreateBucket` | `OBS mb obs://<bucket>` |28| `OBS PutObject` | `OBS cp <file> obs://<bucket>/` |29| `OBS DeleteBucket` | `OBS rm obs://<bucket> -r` |3031## Overview3233Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/object lifecycle, access control, static website hosting, and presigned URLs.3435## Critical Warnings3637| Trap | Why |38| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |39| Bucket name is global | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`) |40| Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |41| Versioning is irreversible | Once enabled, cannot be disabled, only suspended |42| OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |43| Static website via CLI missing | KooCLI OBS lacks website config. Use `huaweicloud_obs_set_website_config` MCP tool (handles AWS4 signing internally) or console |44| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile. |45| **obsutil interactive prompts** | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive. |46| **Directory upload adds prefix** | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |4748## OBS Credential Setup (Required Before First Use)4950KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. All OBS commands fail with credential errors until this is configured.5152**In-session bootstrap (recommended)**: Call `huaweicloud_setup_obs_config` — it syncs AK/SK from the active hcloud profile automatically. No manual key entry needed. Run this once per session before any OBS command.5354**CLI fallback** (if MCP tools unavailable):5556```bash57hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token58```5960> `huaweicloud_setup_obs_config` should be called at the start of every OBS task — never assume credentials are pre-configured from a previous session.6162## Common Workflows6364| Task | Command |65| ---------------------------- | ------------------------------------------------------------------------- |66| Create bucket | `hcloud OBS mb obs://<bucket> -location=<region>` |67| List buckets/objects | `hcloud OBS ls [obs://<bucket>]` |68| Upload file | `hcloud OBS cp <file> obs://<bucket>/<key>` |69| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat` |70| Download object | `hcloud OBS cp obs://<bucket>/<key> <local-path>` |71| Set bucket ACL | `hcloud OBS chattri obs://<bucket> -acl=public-read` |72| Set object ACL | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read` | Bucket ACL does NOT cascade — anonymous reads need both |73| Set lifecycle | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>` |74| Set bucket policy | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |75| Set CORS | Not available via `hcloud OBS` — use API/SDK (`SetBucketCors`) or console |76| Delete bucket | `hcloud OBS rm obs://<bucket> -r` (must be empty) |77| Presigned URL | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` |78| Object metadata | `hcloud OBS stat obs://<bucket>/<key>` |7980## Static Website Deployment Workflow8182See `references/static-website.md` for the full end-to-end workflow:83Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Configure website (REST API/console)8485> KooCLI OBS does NOT support `SetBucketWebsite`. Use the `huaweicloud_obs_set_website_config` MCP tool (handles AWS4 signing internally, no manual signature needed) or the Huawei Cloud console.8687## Single-File Quick Share8889See `references/single-file-share.md` for the full workflow to host one file and get a shareable link in seconds:9091- **Private, time-limited**: `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` (max 7 days)92- **Public, permanent**: `hcloud OBS cp <file> obs://<bucket>/<key> -f` + `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`, then share `https://<bucket>.obs.<region>.myhuaweicloud.com/<key>`9394## Storage Classes9596| Class | Use Case | Min Storage | Retrieval Fee |97| ----------- | ------------------- | ----------- | ------------- |98| STANDARD | Frequently accessed | None | No |99| STANDARD_IA | Infrequent access | 30 days | Yes |100| ARCHIVE | Long-term archive | 90 days | Yes (hours) |101102## Troubleshooting103104| Error | Root Cause -> Fix |105| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |106| AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |107| BucketAlreadyExists | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}` |108| NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |109| InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |110| EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |111| OBS --help fails | KooCLI OBS uses `help` not `--help` -> Run `hcloud OBS help` |112| Configuration file is not well-formed | `~/.obsutilconfig` was generated by a non-standard path (CRLF line endings or field-order differences). Even `hcloud OBS --help` fails. Rebuild it with `hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK>` (or `huaweicloud_setup_obs_config`) -> retry |113114## Security Considerations115116- MUST block public access by default117- MUST use HTTPS-only for buckets118- SHOULD enable access logging for audit119- SHOULD rotate presigned URL expiry (max 7 days)120- MUST NOT store AK/SK in bucket policies121122## Cross-Skill References123124- **EIP**: See `huawei-vpc` for public network access125- **DEW**: See `huawei-dew` for secret management126127## References128129- OBS Docs: https://support.huaweicloud.com/obs/130- Static website: references/static-website.md131- Single-file share: references/single-file-share.md132- Lifecycle: references/bucket-lifecycle.md
huaweicloud