OBS Authorization
If you configure a Huawei Cloud OBS private bucket as the origin server, enable OBS authorization so that CDN can pull content from your private bucket.
Constraints
IAM users can enable OBS authorization only when they have the following permissions:
IAM permissions
- iam:agencies:listAgencies
- iam:agencies:createAgency
- iam:permissions:grantRoleToAgencyOnProject
CDN permissions
- cdn:configuration:modifyChargeMode
- CDN ReadOnlyAccess
Procedure
- Log in to Huawei Cloud console. Choose .
The CDN console is displayed.
- In the navigation pane, choose .
- In the upper right corner of the Domains page, click Enable OBS Authorization.
- Click Authorize. The system creates an agency named CDNAccessPrivateOBS for you on the IAM console. CDN now has the read-only permission to access your private OBS buckets.
- Do not delete the CDNAccessPrivateOBS agency. Otherwise, CDN cannot pull resources from OBS private buckets.
If files in your OBS bucket are encrypted using KMS, assign the KMS CMKFullAcces policy to the CDNAccessPrivateOBS agency so that CDN can read and accelerate delivery of the encrypted files.
- (Optional) Assign the KMS CMKFullAcces policy to the CDNAccessPrivateOBS agency.
- Log in to Huawei Cloud console. Choose Service List > Management & Deployment > Identity and Access Management to access the IAM console.
- In the navigation pane, choose .
-
On the Agencies page, click Authorize in the Operation column of the row containing CDNAccessPrivateOBS.
The Select Policy/Role page is displayed.
- In the upper right corner of the table, search for KMS CMKFullAcces, select this policy, and click Next.
- Set Scope to Region-specific projects and select the region based on the region of the OBS bucket.
- Click OK.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.