Huawei Cloud Obs Website Host

Huawei Cloud OBS Website Host

Overview

Configure an existing Huawei Cloud OBS bucket for static website hosting with Huawei Cloud OBS Python SDK and register a custom domain for the site.

Use this skill when the user wants to:

• enable or repair OBS static website hosting
• set an index document or error document
• make the site reachable through a custom domain backed by the OBS static website endpoint
• add or repair a custom domain, including Huawei Cloud DNS when applicable
• diagnose 403, 404, or DNS issues on a hosted OBS site

What Good Looks Like

• The bucket has static website hosting enabled.
• The bucket can serve index.html from the website endpoint.
• Anonymous users can read the website content.
• A missing path returns the configured error page or a clean 404.
• A custom domain is registered and resolves to the OBS website endpoint through DNS. A custom domain is mandatory — the default OBS bucket domain is not permitted for online object preview per security compliance requirements.
• The setup is not considered complete until the custom domain is registered on the bucket and resolves correctly.
• The OBS website endpoint is used, not the regular bucket API endpoint.
• A 403 usually has two common causes: anonymous/public read is not enabled on the bucket or objects, or the AK/SK used for OBS operations lacks required IAM permissions.
• A 404 usually means the index document name or upload path is wrong.

Security Compliance: Custom Domain Requirement

Based on Huawei Cloud security compliance requirements, the OBS bucket default domain name (<bucket_name>.obs.<region>.myhuaweicloud.com) is prohibited from being used for online preview of objects within the bucket. A custom domain is therefore mandatory for static website hosting.

If the user does not have a custom domain prepared:

1. Direct the user to register a domain through the Huawei Cloud Domain Registration Service, or other common domain registration sites.
2. For users in mainland China, the domain must also complete ICP filing (网站备案) before it can be used for website hosting.
3. Only after the domain is registered (and filed, if applicable) should the static website hosting configuration continue.

Important: Do not proceed with static website hosting configuration until the custom domain prerequisite is confirmed. The default OBS domain is not a valid alternative for website access even in the testing environment.

Required Inputs

Collect these before making changes:

• region
• bucket_name
• custom_domain (required — see Security Compliance section above)
• index_document (optional, default: index.html)
• error_document (optional)
• dns_zone or DNS account context (optional; required only if the user wants Huawei Cloud DNS changes in this run)

Assume static website files are already uploaded by the user.

Dependencies

The skill depends on the following runtime/tooling components:

• Python 3.10+ (required for scripts/set_obs_website_sdk.py and scripts/verify_obs_website.py)
• Huawei OBS Python SDK package: esdk-obs-python
• obsutil (for generating and maintaining .obsutilconfig credential config)
• Huawei Cloud AK/SK credentials (from .obsutilconfig)
• Network access to OBS endpoint and website endpoint
• hcloud CLI (required only when this skill manages Huawei Cloud DNS record operations)
• dig / nslookup (optional)

Install command:

pip install esdk-obs-python

hcloud CLI Reference

Load references/cli-installation-guide.md when hcloud CLI or obsutil installation and configuration is needed. Load references/hcloud-dns-obs-website.md when creating or managing DNS CNAME records for OBS static website custom domains (step-by-step guide with hcloud DNS CreateRecordSet commands).

Security note:

• Never hardcode AK/SK in scripts or checked-in files.
• Prefer environment variables for SDK scripts and secure local profile storage for CLI use.

obsutil Config Dependency

Load references/cli-installation-guide.md when you need obsutil installation or .obsutilconfig setup guidance.

The Python SDK helper script (scripts/set_obs_website_sdk.py) reads credentials by default from:

1. CLI flags (--access-key, --secret-key, --security-token)
2. Environment variables (HW_ACCESS_KEY, HW_SECRET_KEY, HW_SECURITY_TOKEN)
3. .obsutilconfig

If ak/sk are empty across all sources, the script must stop and ask the user to fill missing keys in .obsutilconfig (or provide CLI/env credentials).

Credential check rule:

• Only report presence/absence of keys (ak, sk, securitytoken).
• Never print credential values during checks.
• Never print full lines from .obsutilconfig to console.
• Treat console output as model context; any leaked value is a security incident.

Safe check examples (status only, no secret values):

Linux/macOS:

CFG="${HOME}/.obsutilconfig"
if [ ! -f "$CFG" ]; then
  echo "obsutilconfig_exists=false"
  echo "ak_configured=false"
  echo "sk_configured=false"
  echo "securitytoken_configured=false"
else
  awk -F= '
    BEGIN { ak=0; sk=0; st=0 }
    /^[[:space:]]*#/ { next }
    /^[[:space:]]*(ak|access_key_id)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) ak=1 }
    /^[[:space:]]*(sk|secret_access_key)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) sk=1 }
    /^[[:space:]]*(securitytoken|security_token|token)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) st=1 }
    END {
      print "obsutilconfig_exists=true"
      print "ak_configured=" (ak ? "true" : "false")
      print "sk_configured=" (sk ? "true" : "false")
      print "securitytoken_configured=" (st ? "true" : "false")
    }
  ' "$CFG"
fi

Windows (PowerShell):

$cfg = Join-Path $HOME ".obsutilconfig"
if (-not (Test-Path $cfg)) {
  "obsutilconfig_exists=false"
  "ak_configured=false"
  "sk_configured=false"
  "securitytoken_configured=false"
} else {
  $lines = Get-Content $cfg
  $ak = $false; $sk = $false; $st = $false
  foreach ($line in $lines) {
    if ($line -match '^\s*#') { continue }
    if ($line -match '^\s*(ak|access_key_id)\s*=\s*(\S.*)$') { $ak = $true }
    if ($line -match '^\s*(sk|secret_access_key)\s*=\s*(\S.*)$') { $sk = $true }
    if ($line -match '^\s*(securitytoken|security_token|token)\s*=\s*(\S.*)$') { $st = $true }
  }
  "obsutilconfig_exists=true"
  "ak_configured=$ak"
  "sk_configured=$sk"
  "securitytoken_configured=$st"
}

Do not use:

• cat ~/.obsutilconfig
• grep -E "ak|sk|token" ~/.obsutilconfig

Script Usage Intent

Use the bundled scripts by default for the tasks they were built for:

• scripts/set_obs_website_sdk.py applies or updates the bucket website configuration and registers the required custom domain. Use it whenever the task is to enable, repair, or change OBS static website hosting settings.
• scripts/verify_obs_website.py validates the published website endpoint. Use it after any website configuration change, and also when the user asks whether the site is reachable or when troubleshooting 403/404 behavior.
• Do not replace these scripts with ad hoc one-off code unless the script itself is broken and must be patched.
• Use the scripts to keep credential handling, SDK object construction, and verification behavior consistent across runs.

Workflow

1. Verify Python runtime and OBS SDK are available (pip install esdk-obs-python if missing).
2. Verify the custom domain prerequisite (see Security Compliance section):

• Confirm custom_domain is provided by the user.
• If the user does not have a domain, guide them to register one at Huawei Cloud Domain Registration and complete ICP filing (网站备案) for mainland China regions. Stop here and wait for the user to complete this step.
• Check whether the user manages DNS in Huawei Cloud DNS or with an external provider.