huaweicloud/huawei-cloud-obs-website-host

Huawei Cloud OBS Website Host

Overview

Configure an existing Huawei Cloud OBS bucket for static website hosting with Huawei Cloud OBS Python SDK and register a custom domain for the site.

Use this skill when the user wants to:

• enable or repair OBS static website hosting
• set an index document or error document
• make the site reachable through a custom domain backed by the OBS static website endpoint
• add or repair a custom domain, including Huawei Cloud DNS when applicable
• diagnose 403, 404, or DNS issues on a hosted OBS site

What Good Looks Like

This skill performs write operations: it enables static website hosting on a bucket (setBucketWebsite) and registers the required custom domain on that bucket (setBucketCustomDomain). When the user asks for it, it also creates/updates DNS records. These writes are executed by the bundled scripts in this skill's own session — they are not simulated, deferred to the user, or replaced with read-only checks. Verification runs after the writes to confirm the result.

• The bucket has static website hosting enabled by this skill.
• The bucket can serve index.html from the website endpoint.
• Anonymous users can read the website content.
• A missing path returns the configured error page or a clean 404.
• A custom domain is registered by this skill and resolves to the OBS website endpoint through DNS. A custom domain is mandatory — the default OBS bucket domain is not permitted for online object preview per security compliance requirements.
• The setup is not considered complete until the custom domain is registered on the bucket and resolves correctly.
• The OBS website endpoint is used, not the regular bucket API endpoint.
• A 403 usually has two common causes: anonymous/public read is not enabled on the bucket or objects, or the AK/SK used for OBS operations lacks required IAM permissions.
• A 404 usually means the index document name or upload path is wrong.

Security Compliance: Custom Domain Requirement

Based on Huawei Cloud security compliance requirements, the OBS bucket default domain name (<bucket_name>.obs.<region>.myhuaweicloud.com) is prohibited from being used for online preview of objects within the bucket. A custom domain is therefore mandatory for static website hosting.

If the user does not have a custom domain prepared:

1. First ask the user where the website will be deployed (deployment region / jurisdiction), and where the domain will be registered. Only apply region-specific requirements (such as ICP filing) when the deployment region actually requires them.
2. Direct the user to register a domain through the Huawei Cloud Domain Registration Service, or other common domain registration sites.
3. If (and only if) the user's deployment region is mainland China, the domain must also complete ICP filing (网站备案) before it can be used for website hosting. For deployments outside mainland China, this step is not required — do not impose it.
4. Only after the region check and, where applicable, the domain registration/filing are confirmed should the static website hosting configuration continue.

Important: Do not proceed with static website hosting configuration until the custom domain prerequisite is confirmed. The default OBS domain is not a valid alternative for website access even in the testing environment.

Required Inputs

Collect these before making changes:

• region
• bucket_name
• custom_domain (required — see Security Compliance section above)
• index_document (optional, default: index.html)
• error_document (optional)
• dns_zone or DNS account context (optional; required only if the user wants Huawei Cloud DNS changes in this run)

Assume static website files are already uploaded by the user.

Dependencies

The skill depends on the following runtime/tooling components:

• Python 3.10+ (required for scripts/set_obs_website_sdk.py and scripts/verify_obs_website.py)
• Huawei OBS Python SDK package: esdk-obs-python
• obsutil (for generating and maintaining .obsutilconfig credential config)
• Huawei Cloud AK/SK credentials (from .obsutilconfig)
• Network access to OBS endpoint and website endpoint
• hcloud CLI (required only when this skill manages Huawei Cloud DNS record operations)
• dig / nslookup (optional)

Install command:

pip install esdk-obs-python

Capability & Permission Scope

This skill declares its exact capability and permission scope so callers and reviewers know what it can and cannot do before invoking it:

What it can write (modify):

• The website configuration of the user-specified OBS bucket only (setBucketWebsite: index document, error document), via scripts/set_obs_website_sdk.py.
• The custom domain binding on that same bucket (setBucketCustomDomain), including an optional HTTPS certificate binding.
• DNS records in a Huawei Cloud DNS zone only when the user explicitly requests Huawei Cloud DNS changes in this run and provides/specifies the zone (hcloud DNS CreateRecordSet).
• These are production-facing changes: they can affect live web traffic for the custom domain and make bucket content publicly reachable. Warnings are given before each write (see Workflow).

Credentials read (and their sources):

• scripts/set_obs_website_sdk.py and scripts/verify_obs_website.py read credentials from, in priority order: (1) CLI flags --access-key/--secret-key/--security-token, (2) environment variables HW_ACCESS_KEY / HW_SECRET_KEY / HW_SECURITY_TOKEN, (3) local ~/.obsutilconfig. hcloud uses its own configured CLI profile for DNS operations.
• Only the presence of credentials is reported; values are never printed, echoed, or written to disk.

Network access:

• Only to the OBS service endpoint (https://obs.<region>.myhuaweicloud.com), the OBS website endpoint, and (only on request) the Huawei Cloud DNS service of the configured region.

What it never does:

• Never uploads, deletes, or modifies objects/content inside the bucket.
• Never touches buckets, domains, DNS zones, or credentials other than the ones the user specified.
• Never creates cron jobs, startup scripts, or state files, and never persists anything between sessions (see "Session Behavior" below).
• Never exposes or forwards the credentials it reads to any third party.

Session Behavior

This skill performs a single-session, one-shot operation: it runs the requested OBS/DNS API calls during the current run and then exits. It does not create cron jobs, launch scripts, background daemons, or state files, and does not persist configuration for later runs. Each invocation is independent and must be triggered by the user; nothing is scheduled or repeated automatically. Any long-running or externally scheduled step (e.g. waiting for DNS propagation) is described to the user as something to check, not installed as a job by this skill.

Credential Disclosure & Confirmation

Because scripts/set_obs_website_sdk.py reads cloud credentials from your environment or local ~/.obsutilconfig and then changes remote bucket/DNS configuration, running it has a real security impact. Before running it you must:

1. Disclose to the user that the script will read credentials from their CLI flags / environment variables / ~/.obsutilconfig, and will modify the remote bucket's website configuration and custom domain (and DNS, if requested).
2. Obtain the user's confirmation that the bucket name, custom domain, and DNS zone (if any) are correct and that they authorize the change.
3. Only after that confirmation run the script.

hcloud CLI Reference

Load references/cli-installation-guide.md when hcloud CLI or obsutil installation and configuration is needed. Load references/hcloud-dns-obs-website.md when creating or managing DNS CNAME records for OBS static website custom domains (step-by-step guide with hcloud DNS CreateRecordSet commands).

Security note:

• Never hardcode AK/SK in scripts or checked-in files.
• Prefer environment variables for SDK scripts and secure local profile storage for CLI use.

obsutil Config Dependency

Load references/cli-installation-guide.md when you need obsutil installation or .obsutilconfig setup guidance.

The Python SDK helper script (scripts/set_obs_website_sdk.py) reads credentials by default from:

1. CLI flags (--access-key, --secret-key, --security-token)
2. Environment variables (HW_ACCESS_KEY, HW_SECRET_KEY, HW_SECURITY_TOKEN)
3. .obsutilconfig

If ak/sk are empty across all sources, the script must stop and ask the user to fill missing keys in .obsutilconfig (or provide CLI/env credentials).

Credential check rule:

• Only report presence/absence of keys (ak, sk, securitytoken).
• Never print credential values during checks.
• Never print full lines from .obsutilconfig to console.
• Treat console output as model context; any leaked value is a security incident.

Safe check examples (status only, no secret values):

Linux/macOS:

CFG="${HOME}/.obsutilconfig"
if [ ! -f "$CFG" ]; then
  echo "obsutilconfig_exists=false"
  echo "ak_configured=false"
  echo "sk_configured=false"
  echo "securitytoken_configured=false"
else
  awk -F= '
    BEGIN { ak=0; sk=0; st=0 }
    /^[[:space:]]*#/ { next }
    /^[[:space:]]*(ak|access_key_id)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) ak=1 }
    /^[[:space:]]*(sk|secret_access_key)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) sk=1 }
    /^[[:space:]]*(securitytoken|security_token|token)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) st=1 }
    END {
      print "obsutilconfig_exists=true"
      print "ak_configured=" (ak ? "true" : "false")
      print "sk_configured=" (sk ? "true" : "false")
      print "securitytoken_configured=" (st ? "true" : "false")
    }
  ' "$CFG"
fi

Windows (PowerShell):

$cfg = Join-Path $HOME ".obsutilconfig"
if (-not (Test-Path $cfg)) {
  "obsutilconfig_exists=false"
  "ak_configured=false"
  "sk_configured=false"
  "securitytoken_configured=false"
} else {
  $lines = Get-Content $cfg
  $ak = $false; $sk = $false; $st = $false
  foreach ($line in $lines) {
    if ($line -match '^\s*#') { continue }
    if ($line -match '^\s*(ak|access_key_id)\s*=\s*(\S.*)$') { $ak = $true }
    if ($line -match '^\s*(sk|secret_access_key)\s*=\s*(\S.*)$') { $sk = $true }
    if ($line -match '^\s*(securitytoken|security_token|token)\s*=\s*(\S.*)$') { $st = $true }
  }
  "obsutilconfig_exists=true"
  "ak_configured=$ak"
  "sk_configured=$sk"
  "securitytoken_configured=$st"
}

Do not use:

• cat ~/.obsutilconfig
• grep -E "ak|sk|token" ~/.obsutilconfig

Script Usage Intent

Use the bundled scripts by default for the tasks they were built for. These scripts perform the write operations this skill advertises — they are not read-only verifiers:

• scripts/set_obs_website_sdk.py writes the bucket website configuration (setBucketWebsite) and registers the custom domain (setBucketCustomDomain) on the specified bucket. Use it whenever the task is to enable, repair, or change OBS static website hosting settings. It reads credentials as declared in Capability & Permission Scope and requires user confirmation before writing (see Credential Disclosure & Confirmation).
• scripts/verify_obs_website.py verifies the published website endpoint (DNS, HTTP, HTTPS) and runs read-only SDK bucket/region checks. Use it after any website configuration change, and also when the user asks whether the site is reachable or when troubleshooting 403/404 behavior.
• Do not replace these scripts with ad hoc one-off code unless the script itself is broken and must be patched; patching a broken script is the only case where you write OBS SDK calls directly.
• Use the scripts to keep credential handling, SDK object construction, and verification behavior consistent across runs.

Workflow

1. Verify Python runtime and OBS SDK are available (pip install esdk-obs-python if missing).
2. Verify the custom domain prerequisite (see Security Compliance section):
   • Confirm custom_domain is provided by the user.
   • Ask the user where the site will be deployed (region/jurisdiction) before applying any region-specific requirement. If the user has no domain and the deployment region is mainland China, guide them to register one at Huawei Cloud Domain Registration and complete ICP filing (网站备案). For non-mainland deployments, do not impose ICP filing. Stop here and wait for the user to complete this step.
   • Check whether the user manages DNS in Huawei Cloud DNS or with an external provider.
   • If Huawei Cloud DNS changes are part of this run, verify hcloud is installed and authenticated.
   • If DNS is managed outside Huawei Cloud or outside this run, collect that constraint explicitly before proceeding.
3. Verify the bucket exists in the requested region (use Bucket Existence and Region Check Method below).
4. Check that the caller has permission to update bucket website settings.
5. Check that anonymous read is allowed for the website files (use the method in Anonymous Read Check Method below).
6. Do not upload or modify website content objects (index.html, assets, etc.). Assume content already exists in the bucket.
7. Confirm before writing. Tell the user that the next step reads their cloud credentials (env vars / ~/.obsutilconfig) and modifies the remote bucket's website configuration and custom-domain binding (and DNS if requested), and that these are production-facing changes affecting live traffic. Only after confirmation proceed. Then run scripts/set_obs_website_sdk.py with --custom-domain <domain> (use index.html if index_document is not provided).
   • The script exists to keep SDK object construction and credential handling consistent.
8. After set_obs_website_sdk.py completes, run scripts/verify_obs_website.py to verify the website endpoint is accessible and the custom domain resolves correctly.
9. If DNS changes were requested, configure DNS (e.g., with hcloud DNS CreateRecordSet) and verify resolution.
10. Report final status to the user.

Bucket Existence and Region Check Method

Use the Huawei Cloud OBS SDK or CLI to check if the specified bucket exists and matches the requested region. Example with obsutil:

obsutil ls obs://<bucket_name>

If the bucket does not exist, inform the user and stop.

Anonymous Read Check Method

Check if the bucket policy allows anonymous read access (e.g., obs:GetObject for Principal: *). Use obsutil bucketpolicy obs://<bucket_name> or the SDK to retrieve and inspect the bucket policy. If anonymous read is not enabled, inform the user that it is required for public website access and guide them to configure it.

Troubleshooting

403 Forbidden

• Check that anonymous read is enabled on the bucket and objects.
• Verify AK/SK permissions (IAM policy must include obs:bucket:PutBucketWebsite and obs:bucket:PutBucketCustomDomainConfiguration).
• Ensure the custom domain is registered on the bucket.

404 Not Found

• Verify the index document name matches the file in the bucket.
• Check the error document configuration if needed.
• Ensure the bucket is in the correct region.

DNS Issues

• Verify the custom domain CNAME record points to the OBS website endpoint.
• Wait for DNS propagation (can take up to 48 hours).

References

• references/cli-installation-guide.md — Installation guide for hcloud CLI and obsutil.
• references/hcloud-dns-obs-website.md — Step-by-step guide for creating and managing DNS CNAME records with hcloud.
• Huawei Cloud OBS Documentation
• Huawei Cloud Domain Registration Service