Help Center/ Content Delivery Network/ User Guide/ Custom Domain Name Configuration/ OBS Authorization
Updated on 2024-12-10 GMT+08:00
View PDF
Share

OBS Authorization

If you configure a Huawei Cloud OBS private bucket as the origin server, enable OBS authorization so that CDN can pull content from your private bucket.

Constraints

By default, an account administrator has all permissions. You do not need to add permissions when configuring an agency as an account administrator. IAM users can enable OBS authorization only when they have the following permissions:

IAM permissions

  • iam:agencies:listAgencies
  • iam:agencies:createAgency
  • iam:permissions:grantRoleToAgencyOnProject

CDN permissions

  • cdn:configuration:modifyChargeMode
  • CDN ReadOnlyAccess

Procedure

  1. Log in to Huawei Cloud console. Choose Service List > Content Delivery & Edge Computing > Content Delivery Network.

    The CDN console is displayed.

  2. In the navigation pane, choose Domains.
  3. In the upper right corner of the Domains page, click Enable OBS Authorization.

  1. Click Authorize. The system creates an agency named CDNAccessPrivateOBS for you on the IAM console. CDN now has the read-only permission to access your private OBS buckets.
    • Do not delete the CDNAccessPrivateOBS agency. Otherwise, CDN cannot pull resources from OBS private buckets.

If files in your OBS bucket are encrypted using KMS, assign the kms:cmk:get and kms:dek:crypto policies to the CDNAccessPrivateOBS agency so that CDN can read and accelerate delivery of the encrypted files.

  1. (Optional) Assign the kms:cmk:get and kms:dek:crypto policies to the CDNAccessPrivateOBS agency.
    1. Log in to Huawei Cloud console. Choose Service List > Management & Government > Identity and Access Management to access the IAM console.
    2. In the navigation pane, choose Agencies.

    3. On the Agencies page, click Authorize in the Operation column of the row containing CDNAccessPrivateOBS.

      The Select Policy/Role page is displayed.

    4. Click Create Policy in the upper right corner and set the parameters as follows:
      • Policy Name: Enter a custom name.
      • Policy View: Select Visual editor.
      • Policy Content:
        • Select Allow.
        • Service: Select Key Management Service.
        • Actions: Select kms:cmk:get and kms:dek:crypto.
        • Resources: Select All.
    5. Click Next.
    6. Select the policy created in the previous step and click Next,
    7. Set Scope to Region-specific projects and select the region based on the region of the OBS bucket.
    8. Click OK.

FAQ

  1. When an OBS Private Bucket Is Used as the Origin Server, Agency Creation for OBS Fails