Accessing a Bucket Using a User-Defined Domain Name

Step 1: Bind a user-defined domain name.

1. In the navigation pane of OBS Console, choose Buckets.
2. In the bucket list, click the desired bucket. The Objects page is displayed.
3. In the navigation pane, choose Basic Configurations > Domain Name Mgmt.
   Figure 3 Domain name management page
   

4. Click Configure User Domain Name in the upper part of the page.

   If you have not bound any user-defined domain names before, you can also click Configure User Domain Name in the lower part of the page.

   Figure 4 Configuring a user domain name

   

5. Specify a user-defined domain name for User Domain Name.

   The domain name:

   • Must start with a letter or digit.
   • Can contain uppercase and lowercase letters, digits, hyphens (-), and periods (.).

   By default, a bucket can have up to 20 user-defined domain names bound.

   

   If you want to select one of the existing Huawei Cloud domain names from the drop-down list on OBS Console, you must have the Domains:domains:getDetails permission. You can contact the administrator to use role/policy-based authorization of IAM to grant you this permission. For details, see Assigning Permissions to an IAM User.

6. Click OK.

Step 2: Add a CNAME record set.

Add a CNAME record set to map the user-defined domain name to the default domain name of the bucket.

1. Click Resolve to automatically add a CNAME record set.
   • If you specified a Huawei Cloud domain name, click Resolve for DNS to add a CNAME record set.
   • If you specified a domain name that is not registered with Huawei Cloud, skip this step and manually add a CNAME record set by referring to 2.

2. Manually add a CNAME record set.
   • If you are not using a Huawei Cloud domain name, follow the CNAME resolution guide provided by your DNS provider.
   • If you are using a Huawei Cloud domain name, do as follows:
     1. Log in to the DNS console.
     2. In the navigation pane, choose Public Zones.
     3. (Optional) Create a public zone. If you have already created one, skip this step.
        1. On the Public Zones page, click Create Public Zone in the upper right corner.
        2. Configure parameters by referring to the following table. Retain the default settings for other parameters.

           Table 2 Parameters for creating a public zone

           Parameter	Example Value	Description
           Domain Name	example.com	The domain name purchased from a domain name registrar Enter the user-defined domain name bound to the bucket here.
           Enterprise Project	default	The enterprise project to be associated with the public zone. You can manage public zones by enterprise project. This parameter is available and mandatory only when you are using an enterprise account. Notes: If you do not manage zones by enterprise project, select the default enterprise project. If you manage zones by enterprise project, select another existing enterprise project. To create an enterprise project, see Creating an Enterprise Project.

        3. Click OK.
     4. Locate the row that contains the domain name to which you want to add a record set and click the domain name.
     5. On the Record Sets tab, click Add Record Set.
     6. Configure parameters by referring to Table 3. Keep the default settings for the parameters that are not listed in the following table.
        For details, see Adding a CNAME Record Set.

        Table 3 Parameters for adding a CNAME record set

        Parameter	Example Value	Description
        Type	CNAME – Map one domain to another	Choose a record set type depending on the purpose of the domain name. Select CNAME – Map one domain to another here. A message may be displayed, indicating that the record set you are trying to add conflicts with an existing record set of the zone. For details, see Why Is a Message Indicating Conflict with an Existing Record Set Displayed When I Add a Record Set?
        Name	Left blank	The prefix of the domain name to be resolved For example, if the domain name is example.com, its prefix can be: www: used for website resolution. The domain name to be resolved is www.example.com. Left blank: used for website resolution. The domain name to be resolved is example.com. To use an at sign (@), leave this parameter blank. abc: The domain name to be resolved is abc.example.com, a subdomain of example.com. mail: The domain name to be resolved is mail.example.com. *: The domain name to be resolved is *.example.com, any subdomain of example.com.
        Line	Default	The line type. It defines the rule used by the DNS server to return DNS resolution results based on the visitor's source. The default value is Default. This parameter can only be configured for public zone record sets. Default: returns the default resolution result irrespective of where the visitors come from. ISP: returns the resolution result based on visitors' carrier networks. For details, see Configuring ISP Lines. Region: returns the resolution result based on visitors' geographical locations. For details, see Configuring Region Lines. Custom line: returns a specific IP address based on the IP address range of visitors. For details, see Configuring Custom Lines.
        TTL (s)	300	The length of time (in seconds) for which a local DNS server caches a record set The default value is 300, which is 5 minutes. (value range: 1 to 2147483647). If your service address changes frequently, set TTL to a smaller value. Otherwise, set TTL to a larger value. For more information about TTL, see What Is TTL?
        Value	example-bucket.obs.cn-north-4.myhuaweicloud.com	Domain name alias. You can enter only one domain name. If CDN acceleration is not used, set this parameter to the bucket domain name. If CDN acceleration is used, set this parameter to the CNAME domain name allocated by CDN.

     7. Click OK.
     8. Verify that the added CNAME record set is in effect.

        Open the Windows command line interface and run the following command:

        nslookup -type = cname example.name

        In this command, example.name indicates the user-defined domain name or CDN acceleration domain name specified for the bucket. Replace it with your actual domain name.

        • Without CDN acceleration: If the output is the bucket domain name, the CNAME record set is in effect.
        • With CDN acceleration: If the output is the CNAME domain name allocated by CDN, the CNAME record set is in effect.

Step 3 (Optional) Configure HTTPS.

1. On OBS Console, open the Configure User Domain Name dialog box and click Next under the Resolve CNAME step.
2. (Optional) On the (Recommended) Configure HTTPS page, if you do not need to configure HTTPS, click OK in the lower right corner.
3. (Optional) If you need to configure HTTPS, set the parameters based on Table 4.

   Table 4 Configuring HTTPS for a user-defined domain name

   Parameter	Description
   Custom domain name	Select the custom domain name for which you want to configure an HTTPS certificate.
   Certificate	Select an SCM certificate, a server digital certificate provided by Cloud Certificate & Manager (CCM). If you do not have a certificate, click Buy Certificate to purchase one on the CCM console. For details, see Purchasing an SSL Certificate. If you want to use your own certificate, upload it on the SSL Certificates page of the CCM console. For details, see Uploading an External Certificate to SCM. Each certificate has an expiration time. Ensure that the certificate you chose has not expired. Replace the certificate before it expires, or services may be affected.

4. Click Configure in the lower right corner.

Configuring a Custom Domain Name for a Bucket

Command Line Structure

• Windows

  obsutil custom-domain obs://bucket -method=put -cname=xxx [-config=xxx] [-e=xxx] [-i=xxx] [-k=xxx] [-t=xxx]

• macOS or Linux

  ./obsutil custom-domain obs://bucket -method=put -cname=xxx [-config=xxx] [-e=xxx] [-i=xxx] [-k=xxx] [-t=xxx]

Examples

obsutil custom-domain obs://test-bucket -method=put -cname=www.obs-example.com 

Start at 2024-09-30 07:59:28.8675681 +0000 UTC

Put customDomain configuration succeed for bucket [test-bucket], customDomain is [www.obs-example.com], requestId is [00000199765243C44018D688E9F5CFF5]

Parameter Description

When calling object APIs, for example, the API for downloading an object, replace the bucket domain name (bucketName.obs.regionID.myhuaweicloud.com) with a user-defined domain name (for example, example.com).

Sample request: The bucket is not bound to a user-defined domain name.

GET /objectkey HTTP/1.1 
Host: bucketname.obs.regionid.myhuaweicloud.com  
Date: date 
Authorization: authorization

Sample request: The bucket is bound to a user-defined domain name.

GET /objectkey HTTP/1.1
Host: example.com
Date: date
Authorization: authorization

1. Obtain a pre-signed URL.

   The following are example codes in common programming languages:

   • Java

     import com.obs.services.ObsClient;
     import com.obs.services.ObsConfiguration;
     import com.obs.services.model.HttpMethodEnum;
     import com.obs.services.model.TemporarySignatureRequest;
     import com.obs.services.model.TemporarySignatureResponse;
     public class GetObject {
         public static void main(String[] args) {
             // Obtain an AK/SK pair using environment variables or import it in other ways. Using hard coding may result in leakage.
             // Obtain an AK/SK pair on the management console.
             String ak = System.getenv("ACCESS_KEY_ID");
             String sk = System.getenv("SECRET_ACCESS_KEY_ID");
             // (Optional) If you are using a temporary AK/SK pair and a security token to access OBS, you are advised not to use hard coding, which may result in information leakage.
             // Obtain an AK/SK pair and a security token using environment variables or import them in other ways. If you use a temporary AK/SK pair and a security token to make an API call, uncomment the following line.
             // String securityToken = System.getenv("SECURITY_TOKEN");
     
             // Set the endpoint to the bucket's user-defined domain name. If the user-defined domain name has a certificate configured, you can use https.
             String endpoint = "http://example.com";
             // Obtain an endpoint using environment variables or import it in other ways.
             //String endPoint = System.getenv("ENDPOINT");
     
             ObsConfiguration obsConfiguration = new ObsConfiguration();
             obsConfiguration.setCname(true);
             obsConfiguration.setEndPoint(endpoint);
             try {
                 // Create an ObsClient instance.
                 // Use the permanent AK/SK pair to initialize the client.
                 ObsClient obsClient = new ObsClient(ak, sk, obsConfiguration);
                 // Use a temporary AK/SK pair and security token to initialize the client.
                 // ObsClient obsClient = new ObsClient(ak, sk, securityToken, obsConfiguration);
     
                 // Set the validity period of the URL to 3600 seconds.
                 long expires = 3600L;
                 TemporarySignatureRequest request = new TemporarySignatureRequest(HttpMethodEnum.GET, expireSeconds);
                 request.bucketName("bucketname");
                 request.objectKey("objectkey");
                 TemporarySignatureResponse response = obsClient.createTemporarySignature(request);
                 System.out.println("Getting object using temporary signature url:");
                 System.out.println("SignedUrl:" + response.getSignedUrl());
             } catch (Exception e) {
                 System.out.println("create temporary signature failed");
                 e.printStackTrace();
             }
         }
     }

   • Python

     from obs import ObsClient
     import os
     import traceback
     # Obtain an AK and SK pair using environment variables (recommended) or import it in other ways. Using hard coding may result in leakage.
     # Obtain an AK/SK pair on OBS Console by referring to https://support.huaweicloud.com/en-us/usermanual-ca/ca_01_0003.html.
     ak = os.getenv("ACCESS_KEY_ID")
     sk = os.getenv("SECRET_ACCESS_KEY_ID")
     # (Optional) If you use a temporary AK/SK pair and a security token to access OBS, obtain them using environment variables.
     # security_token = os.getenv("SecurityToken")
     # Set the server to the bucket's user-defined domain name. If the user-defined domain name has a certificate configured, you can use https.
     server = "http://example.domain"
     # Create an ObsClient instance.
     obsClient = ObsClient(access_key_id=ak, secret_access_key=sk, server=server, is_cname=True)
     
     # If you use a temporary AK/SK pair and a security token to access OBS, you must specify security_token when creating an instance.
     #obsClient = ObsClient(access_key_id=ak, secret_access_key=sk, security_token=security_token, server=server, is_cname=True)
     
     try:
         # Create a signed URL for downloading an object.
         res = obsClient.createSignedUrl(method='GET', bucketName='bucketname', objectKey='objectkey', expires=3600)
         print('signedUrl:', res.signedUrl)
     except:
         print(traceback.format_exc())

2. Access the pre-signed URL in a browser.

obsutil allows you to configure a user-defined domain name to access OBS (currently, you can only list, upload, or download objects). The procedure is as follows:

1. Configure a user-defined domain name.
2. In file .obsutilconfig, set cname to true.

   cname=true

3. In file .obsutilconfig, set endpoint to the user-defined domain name configured in Step 1.

   endpoint=https://example.com

4. Check whether the configuration is correct:

   obsutil ls obs://bucketname

   Check the command output:

   • If the command output contains Object number, the configuration is correct.
   • If the command output contains Http status [403], the configuration has something wrong.

1. This function is supported only in 5.5.3 and later versions.
2. The .obsutilconfig file is usually stored in a system's user directory (~ in macOS/Linux and C:\Users\<username> in Windows).
3. After a user-defined domain name is configured, you can only manage resources in the bucket where the domain name is associated.

To improve the speed and stability for accessing static resource files, you can use CDN acceleration. If you have configured a user-defined domain name for a bucket, you can directly enable CDN acceleration for the domain name. If you have not configured a user-defined domain name for the bucket, you can configure a CDN acceleration domain name. For details, see Accessing a Bucket Using a CDN Acceleration Domain Name.

You can also manage HTTPS certificates on the CDN console to allow access over HTTPS. For details, see Configuring an HTTPS Certificate.

• To obtain a permanent, unsigned URL (http://DomainName/ObjectName) for accessing a file, you must set the file to be publicly readable. Once the file is publicly accessible, anyone can access it, which may lead to data leakage and soaring costs from frequent requests. Therefore, it is recommended to use signed URLs with an expiration time to access files.
• If you allow your file to be accessed by a permanent, unsigned URL, you should configure URL validation to prevent the file from being stolen.

You can set an object to be publicly readable in either of the following ways:

• Grant anonymous users read permission for the object and share the object URL with them. The anonymous users can then use the shared URL to access the object. For details, see Granting Anonymous Users the Public Read Permission for Objects.
• Enable acceleration for the configured user-defined domain name and keep the OBS object private. This uses CDN to provide public read access. In such cases, the object URL does not require signature authentication and does not have an expiration time. Anonymous users can access the object.

Some malicious websites hotlink resources from other websites to expand their content without incurring additional costs. This not only infringes on the interests of the original websites but also increases their server load. URL validation is designed to address this issue.

To prevent data stored in buckets from being stolen, you can specify Referer (a whitelisted, blacklisted, or empty Referer) in the HTTP header to allow access only from specific sources. For details, see Configuring URL Validation to Prevent Unauthorized Access to Your Data.

If you want to host your static website on OBS and access it using a user-defined domain name, you must configure static website hosting for the bucket. For details, see Static Website Hosting.

• How Do I Preview OBS Objects in My Web Browser?
• Why Is the Message "NoSuchBucket" Displayed When I Use a User-Defined Domain Name to Access a Bucket That Can Be Accessed by the OBS Domain Name?
• Why Is the CNAME Resolution Status Unknown?
• Why Can Only the Domain Names I Bought on Huawei Cloud Be Automatically Resolved In One Click?