OBS Authorization

Constraints

By default, an account administrator has all permissions. You do not need to add permissions when configuring an agency as an account administrator. IAM users can enable OBS authorization only when they have the following permissions:

IAM permissions

• Listing agencies: iam:agencies:listAgencies
• Creating an agency: iam:agencies:createAgency
• Granting permissions to an agency for a region-specific project: iam:permissions:grantRoleToAgencyOnProject

CDN permissions

• Changing the billing option: cdn:configuration:modifyChargeMode
• Granting CDN read-only permissions: CDN ReadOnlyAccess

Precautions

• CDN depends on other cloud services. Therefore, after enabling OBS authorization, configure related policies to make the OBS private bucket available for CDN acceleration by referring to Dependencies Between CDN and Other Services.
• Since April 2, 2025 (Beijing time), Huawei Cloud CDN has enabled the new OBS agency. It has fewer permissions than the old one. If you have enabled the OBS agency of the old version, you can reduce permissions by referring to How Do I Replace the Old OBS Agency Permissions with New Ones?

Procedure

1. Log in to Huawei Cloud console. Choose Service List > Content Delivery & Edge Computing > Content Delivery Network.

   The CDN console is displayed.

2. In the navigation pane, choose Domains.
3. In the upper right corner of the Domains page, click Enable OBS Authorization.

4. Click Authorize. The system creates an agency named CDNAccessPrivateOBS for you on the IAM console. CDN now has the read-only permission to access your private OBS buckets.

If files in your OBS bucket are encrypted using KMS, assign the kms:cmk:get and kms:dek:crypto policies to the CDNAccessPrivateOBS agency so that CDN can read and accelerate delivery of the encrypted files.

5. (Optional) Assign the kms:cmk:get and kms:dek:crypto policies to the CDNAccessPrivateOBS agency.
   1. Log in to Huawei Cloud console. Choose Service List > Management & Government > Identity and Access Management to access the IAM console.
   2. In the navigation pane, choose Agencies.

   3. On the Agencies page, click Authorize in the Operation column of the row containing CDNAccessPrivateOBS.

      The Select Policy/Role page is displayed.

   4. Click Create Policy in the upper right corner and set the parameters as follows:
      • Policy Name: Enter a custom name.
      • Policy View: Select Visual editor.
      • Policy Content:
        • Select Allow.
        • Service: Select Key Management Service.
        • Actions: Select kms:cmk:get and kms:dek:crypto.
        • Resources: Select All.
   5. Click Next.
   6. Select the policy created in the previous step and click Next.
   7. Set Scope to Region-specific projects and select the region based on the region of the OBS bucket.
   8. Click OK.

FAQ

1. When an OBS Private Bucket Is Used as the Origin Server, Agency Creation for OBS Fails