huawei-cloud-obs-website-host

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Huawei Cloud OBS Website Host

华为云OBS网站托管

Overview

概述

Configure an existing Huawei Cloud OBS bucket for static website hosting with Huawei Cloud OBS Python SDK and register a custom domain for the site.

Use this skill when the user wants to:

enable or repair OBS static website hosting
set an index document or error document
make the site reachable through a custom domain backed by the OBS static website endpoint
add or repair a custom domain, including Huawei Cloud DNS when applicable
diagnose 403, 404, or DNS issues on a hosted OBS site

使用华为云OBS Python SDK将现有华为云OBS存储桶配置为静态网站托管，并为该网站注册自定义域名。

当用户有以下需求时可使用本技能：

启用或修复OBS静态网站托管
设置索引文档或错误文档
通过OBS静态网站端点支持的自定义域名访问网站
添加或修复自定义域名，包括适用时配置华为云DNS
诊断已托管OBS网站的403、404或DNS问题

What Good Looks Like

预期完成效果

The bucket has static website hosting enabled.
The bucket can serve
```
index.html
```
from the website endpoint.
Anonymous users can read the website content.
A missing path returns the configured error page or a clean 404.
A custom domain is registered and resolves to the OBS website endpoint through DNS. A custom domain is mandatory — the default OBS bucket domain is not permitted for online object preview per security compliance requirements.
The setup is not considered complete until the custom domain is registered on the bucket and resolves correctly.
The OBS website endpoint is used, not the regular bucket API endpoint.
A 403 usually has two common causes: anonymous/public read is not enabled on the bucket or objects, or the AK/SK used for OBS operations lacks required IAM permissions.
A 404 usually means the index document name or upload path is wrong.

存储桶已启用静态网站托管。
存储桶可从网站端点提供
```
index.html
```
文件。
匿名用户可读取网站内容。
访问不存在的路径时返回配置的错误页或清晰的404响应。
已注册自定义域名，并通过DNS解析到OBS网站端点。自定义域名是必填项——根据安全合规要求，默认OBS存储桶域名不允许用于在线对象预览。
只有当自定义域名在存储桶上注册并正确解析后，才算完成配置。
使用OBS网站端点，而非常规存储桶API端点。
403错误通常有两个常见原因：存储桶或对象未启用匿名/公共读取权限，或者用于OBS操作的AK/SK缺少必要的IAM权限。
404错误通常意味着索引文档名称或上传路径错误。

Security Compliance: Custom Domain Requirement

安全合规：自定义域名要求

Based on Huawei Cloud security compliance requirements, the OBS bucket default domain name (

<bucket_name>.obs.<region>.myhuaweicloud.com

) is prohibited from being used for online preview of objects within the bucket. A custom domain is therefore mandatory for static website hosting.

If the user does not have a custom domain prepared:

Direct the user to register a domain through the Huawei Cloud Domain Registration Service, or other common domain registration sites.
For users in mainland China, the domain must also complete ICP filing (网站备案) before it can be used for website hosting.
Only after the domain is registered (and filed, if applicable) should the static website hosting configuration continue.

Important: Do not proceed with static website hosting configuration until the custom domain prerequisite is confirmed. The default OBS domain is not a valid alternative for website access even in the testing environment.

根据华为云安全合规要求，OBS存储桶默认域名（

<bucket_name>.obs.<region>.myhuaweicloud.com

）禁止用于存储桶内对象的在线预览。因此，静态网站托管必须使用自定义域名。

如果用户尚未准备好自定义域名：

引导用户通过华为云域名注册服务或其他常见域名注册平台注册域名。
对于中国大陆地区的用户，域名还需完成**ICP备案（网站备案）**后才能用于网站托管。
只有在域名注册完成（如需备案则完成备案）后，才能继续进行静态网站托管配置。

重要提示： 在确认自定义域名已满足前提条件前，请勿继续静态网站托管配置。即使在测试环境中，默认OBS域名也不能作为网站访问的有效替代方案。

Required Inputs

必填输入信息

Collect these before making changes:

```
region
```
```
bucket_name
```
```
custom_domain
```
(required — see Security Compliance section above)
```
index_document
```
(optional, default:
```
index.html
```
)
```
error_document
```
(optional)
```
dns_zone
```
or DNS account context (optional; required only if the user wants Huawei Cloud DNS changes in this run)

Assume static website files are already uploaded by the user.

在进行更改前需收集以下信息：

```
region
```
（区域）
```
bucket_name
```
（存储桶名称）
```
custom_domain
```
（自定义域名，必填——参见上述安全合规部分）
```
index_document
```
（索引文档，可选，默认值：
```
index.html
```
）
```
error_document
```
（错误文档，可选）
```
dns_zone
```
或DNS账户上下文（可选；仅当用户希望本次操作中配置华为云DNS时需要）

假设用户已上传静态网站文件。

Dependencies

依赖项

The skill depends on the following runtime/tooling components:

Python 3.8+ (required for

scripts/set_obs_website_sdk.py

and

scripts/verify_obs_website.py

)

Huawei OBS Python SDK package:
```
esdk-obs-python
```
```
obsutil
```
(for generating and maintaining
```
.obsutilconfig
```
credential config)
Huawei Cloud AK/SK credentials (from
```
.obsutilconfig
```
)
Network access to OBS endpoint and website endpoint
```
hcloud
```
CLI (required only when this skill manages Huawei Cloud DNS record operations)

Install command:

bash

pip install esdk-obs-python

本技能依赖以下运行时/工具组件：

Python 3.8+（运行

scripts/set_obs_website_sdk.py

和

scripts/verify_obs_website.py

所需）

华为OBS Python SDK包：
```
esdk-obs-python
```
```
obsutil
```
（用于生成和维护
```
.obsutilconfig
```
凭证配置文件）
华为云AK/SK凭证（来自
```
.obsutilconfig
```
）
可访问OBS端点和网站端点的网络环境
```
hcloud
```
CLI（仅当本技能管理华为云DNS记录操作时需要）

安装命令：

bash

pip install esdk-obs-python

hcloud CLI Reference

hcloud CLI参考

Load

references/cli-installation-guide.md

when hcloud CLI or obsutil installation and configuration is needed. Load

references/hcloud-dns-obs-website.md

when creating or managing DNS CNAME records for OBS static website custom domains (step-by-step guide with hcloud

DNS CreateRecordSet

commands).

Security note:

Never hardcode AK/SK in scripts or checked-in files.
Prefer environment variables for SDK scripts and secure local profile storage for CLI use.

当需要安装和配置hcloud CLI或obsutil时，加载

references/cli-installation-guide.md

。当为OBS静态网站自定义域名创建或管理DNS CNAME记录时，加载

references/hcloud-dns-obs-website.md

（包含使用hcloud

DNS CreateRecordSet

命令的分步指南）。

安全注意事项：

切勿在脚本或已提交的文件中硬编码AK/SK。
优先为SDK脚本使用环境变量，为CLI使用安全的本地配置文件存储。

obsutil Config Dependency

obsutil配置依赖

Load

references/cli-installation-guide.md

when you need obsutil installation or

.obsutilconfig

setup guidance.

The Python SDK helper script (

scripts/set_obs_website_sdk.py

) reads credentials by default from:

CLI flags (

--access-key

--secret-key

--security-token

)

Environment variables (

HW_ACCESS_KEY

HW_SECRET_KEY

HW_SECURITY_TOKEN

)

```
.obsutilconfig
```

ak

sk

are empty across all sources, the script must stop and ask the user to fill missing keys in

.obsutilconfig

(or provide CLI/env credentials).

Credential check rule:

Only report presence/absence of keys (
```
ak
```
,
```
sk
```
,
```
securitytoken
```
).
Never print credential values during checks.
Never print full lines from
```
.obsutilconfig
```
to console.
Treat console output as model context; any leaked value is a security incident.

Safe check examples (status only, no secret values):

Linux/macOS:

bash

CFG="${HOME}/.obsutilconfig"
if [ ! -f "$CFG" ]; then
  echo "obsutilconfig_exists=false"
  echo "ak_configured=false"
  echo "sk_configured=false"
  echo "securitytoken_configured=false"
else
  awk -F= '
    BEGIN { ak=0; sk=0; st=0 }
    /^[[:space:]]*#/ { next }
    /^[[:space:]]*(ak|access_key_id)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) ak=1 }
    /^[[:space:]]*(sk|secret_access_key)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) sk=1 }
    /^[[:space:]]*(securitytoken|security_token|token)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) st=1 }
    END {
      print "obsutilconfig_exists=true"
      print "ak_configured=" (ak ? "true" : "false")
      print "sk_configured=" (sk ? "true" : "false")
      print "securitytoken_configured=" (st ? "true" : "false")
    }
  ' "$CFG"
fi

Windows (PowerShell):

powershell

$cfg = Join-Path $HOME ".obsutilconfig"
if (-not (Test-Path $cfg)) {
  "obsutilconfig_exists=false"
  "ak_configured=false"
  "sk_configured=false"
  "securitytoken_configured=false"
} else {
  $lines = Get-Content $cfg
  $ak = $false; $sk = $false; $st = $false
  foreach ($line in $lines) {
    if ($line -match '^\s*#') { continue }
    if ($line -match '^\s*(ak|access_key_id)\s*=\s*(\S.*)$') { $ak = $true }
    if ($line -match '^\s*(sk|secret_access_key)\s*=\s*(\S.*)$') { $sk = $true }
    if ($line -match '^\s*(securitytoken|security_token|token)\s*=\s*(\S.*)$') { $st = $true }
  }
  "obsutilconfig_exists=true"
  "ak_configured=$ak"
  "sk_configured=$sk"
  "securitytoken_configured=$st"
}

Do not use:

```
cat ~/.obsutilconfig
```
```
grep -E "ak|sk|token" ~/.obsutilconfig
```

当需要obsutil安装或

.obsutilconfig

设置指导时，加载

references/cli-installation-guide.md

。

Python SDK辅助脚本（

scripts/set_obs_website_sdk.py

）默认从以下位置读取凭证：

CLI参数（

--access-key

、

--secret-key

、

--security-token

）

环境变量（

HW_ACCESS_KEY

、

HW_SECRET_KEY

、

HW_SECURITY_TOKEN

）

```
.obsutilconfig
```
文件

如果所有来源的

ak

sk

均为空，脚本必须停止并要求用户在

.obsutilconfig

中填写缺失的密钥（或提供CLI/环境凭证）。

凭证检查规则：

仅报告密钥（
```
ak
```
、
```
sk
```
、
```
securitytoken
```
）是否存在。
检查过程中切勿打印凭证值。
切勿将
```
.obsutilconfig
```
的完整行打印到控制台。
控制台输出视为模型上下文，任何泄露的值都属于安全事件。

安全检查示例（仅显示状态，无敏感值）：

Linux/macOS：

bash

CFG="${HOME}/.obsutilconfig"
if [ ! -f "$CFG" ]; then
  echo "obsutilconfig_exists=false"
  echo "ak_configured=false"
  echo "sk_configured=false"
  echo "securitytoken_configured=false"
else
  awk -F= '
    BEGIN { ak=0; sk=0; st=0 }
    /^[[:space:]]*#/ { next }
    /^[[:space:]]*(ak|access_key_id)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) ak=1 }
    /^[[:space:]]*(sk|secret_access_key)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) sk=1 }
    /^[[:space:]]*(securitytoken|security_token|token)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) st=1 }
    END {
      print "obsutilconfig_exists=true"
      print "ak_configured=" (ak ? "true" : "false")
      print "sk_configured=" (sk ? "true" : "false")
      print "securitytoken_configured=" (st ? "true" : "false")
    }
  ' "$CFG"
fi

Windows（PowerShell）：

powershell

$cfg = Join-Path $HOME ".obsutilconfig"
if (-not (Test-Path $cfg)) {
  "obsutilconfig_exists=false"
  "ak_configured=false"
  "sk_configured=false"
  "securitytoken_configured=false"
} else {
  $lines = Get-Content $cfg
  $ak = $false; $sk = $false; $st = $false
  foreach ($line in $lines) {
    if ($line -match '^\s*#') { continue }
    if ($line -match '^\s*(ak|access_key_id)\s*=\s*(\S.*)$') { $ak = $true }
    if ($line -match '^\s*(sk|secret_access_key)\s*=\s*(\S.*)$') { $sk = $true }
    if ($line -match '^\s*(securitytoken|security_token|token)\s*=\s*(\S.*)$') { $st = $true }
  }
  "obsutilconfig_exists=true"
  "ak_configured=$ak"
  "sk_configured=$sk"
  "securitytoken_configured=$st"
}

禁止使用：

```
cat ~/.obsutilconfig
```
```
grep -E "ak|sk|token" ~/.obsutilconfig
```

Script Usage Intent

脚本使用意图

Use the bundled scripts by default for the tasks they were built for:

```
scripts/set_obs_website_sdk.py
```
applies or updates the bucket website configuration and registers the required custom domain. Use it whenever the task is to enable, repair, or change OBS static website hosting settings.
```
scripts/verify_obs_website.py
```
validates the published website endpoint. Use it after any website configuration change, and also when the user asks whether the site is reachable or when troubleshooting 403/404 behavior.
Do not replace these scripts with ad hoc one-off code unless the script itself is broken and must be patched.
Use the scripts to keep credential handling, SDK object construction, and verification behavior consistent across runs.

默认使用捆绑脚本完成其设计的任务：

```
scripts/set_obs_website_sdk.py
```
应用或更新存储桶网站配置，并注册所需的自定义域名。当任务是启用、修复或更改OBS静态网站托管设置时使用。
```
scripts/verify_obs_website.py
```
验证已发布的网站端点。在任何网站配置更改后使用，也可用于用户询问网站是否可访问或排查403/404问题时。
除非脚本本身损坏必须修补，否则请勿用临时编写的一次性代码替换这些脚本。
使用脚本确保凭证处理、SDK对象构建和验证行为在每次运行中保持一致。

Workflow

工作流程

Verify Python runtime and OBS SDK are available (
```
pip install esdk-obs-python
```
if missing).
Verify the custom domain prerequisite (see Security Compliance section):
- Confirm
```
custom_domain
```
  is provided by the user.
- If the user does not have a domain, guide them to register one at Huawei Cloud Domain Registration and complete ICP filing (网站备案) for mainland China regions. Stop here and wait for the user to complete this step.
- Check whether the user manages DNS in Huawei Cloud DNS or with an external provider.
- If Huawei Cloud DNS changes are part of this run, verify
```
hcloud
```
  is installed and authenticated.
- If DNS is managed outside Huawei Cloud or outside this run, collect that constraint explicitly before proceeding.
Verify the bucket exists in the requested region (use Bucket Existence and Region Check Method below).
Check that the caller has permission to update bucket website settings.
Check that anonymous read is allowed for the website files (use the method in Anonymous Read Check Method below).
Do not upload or modify website content objects (
```
index.html
```
, assets, etc.). Assume content already exists in the bucket.
Configure static website hosting by running
```
scripts/set_obs_website_sdk.py
```
with
```
--custom-domain <domain>
```
(use
```
index.html
```
if
```
index_document
```
is not provided).
- The script exists to keep SDK object construction and credential lookup consistent.
- Use it instead of writing a one-off SDK call in the response.
Register the required custom domain on the bucket via the OBS SDK path used by the script:
- ```
client.setBucketCustomDomain(bucket_name, custom_domain)
```
  — required even if DNS CNAME already exists.
- If DNS record changes are requested in this run, create a DNS CNAME record to the OBS website hostname and wait for propagation. (read
```
references/hcloud-dns-obs-website.md
```
  )
- If DNS is managed outside Huawei Cloud or outside this run, provide the required CNAME target and explicitly instruct the user to create or update the CNAME record with their external DNS provider after OBS custom-domain registration is complete.
- For externally managed DNS, include the practical handoff details the user needs: record type
```
CNAME
```
  , host/name, target/value, and a verification command such as
```
dig
```
  .
Verify the published site by running
```
scripts/verify_obs_website.py --bucket-name <bucket_name> --region <region> [--domain <custom_domain>] [--index-document <name>]
```
.
- If the user provided a custom domain, final verification MUST use that custom domain via
```
--domain <custom_domain>
```
  .
- Only use the default OBS hostname for interim checks or when no custom domain was provided.
Confirm the root path returns the homepage (HTTP 200).
Confirm a missing path returns the configured error behavior (HTTP 404 or configured error page).
Verify DNS resolution (
```
dig
```
/
```
nslookup
```
) and HTTP access through the user-provided custom domain. Do not treat the setup as complete based only on the default OBS hostname when a custom domain is part of the request.

验证Python运行时和OBS SDK是否可用（如果缺失则执行
```
pip install esdk-obs-python
```
）。
验证自定义域名前提条件（参见安全合规部分）：
- 确认用户已提供
```
custom_domain
```
  。
- 如果用户没有域名，引导他们在华为云域名注册注册域名，并针对中国大陆区域完成ICP备案（网站备案）。在此处停止并等待用户完成此步骤。
- 检查用户是通过华为云DNS还是外部提供商管理DNS。
- 如果本次操作包含华为云DNS更改，验证
```
hcloud
```
  已安装并完成认证。
- 如果DNS由华为云外部管理或不在本次操作范围内，在继续前明确收集该约束信息。
验证存储桶是否存在于请求的区域（使用下文的存储桶存在性和区域检查方法）。
检查调用者是否有权限更新存储桶网站设置。
检查网站文件是否允许匿名读取（使用下文的匿名读取检查方法）。
请勿上传或修改网站内容对象（
```
index.html
```
、资源文件等）。假设内容已存在于存储桶中。
通过运行
```
scripts/set_obs_website_sdk.py --custom-domain <domain>
```
配置静态网站托管（如果未提供
```
index_document
```
则使用
```
index.html
```
）。
- 该脚本用于确保SDK对象构建和凭证查找的一致性。
- 使用该脚本而非在响应中编写一次性SDK调用。
通过脚本使用的OBS SDK路径在存储桶上注册所需的自定义域名：
- ```
client.setBucketCustomDomain(bucket_name, custom_domain)
```
  ——即使DNS CNAME已存在也必须执行此步骤。
- 如果本次操作要求更改DNS记录，创建指向OBS网站主机名的DNS CNAME记录并等待解析生效。（阅读
```
references/hcloud-dns-obs-website.md
```
  ）
- 如果DNS由华为云外部管理或不在本次操作范围内，提供所需的CNAME目标，并明确指示用户在OBS自定义域名注册完成后，通过其外部DNS提供商创建或更新CNAME记录。
- 对于外部管理的DNS，包含用户完成设置所需的实用交接细节：记录类型
```
CNAME
```
  、主机/名称、目标/值，以及验证命令如
```
dig
```
  。
通过运行
```
scripts/verify_obs_website.py --bucket-name <bucket_name> --region <region> [--domain <custom_domain>] [--index-document <name>]
```
验证已发布的网站。
- 如果用户提供了自定义域名，最终验证必须通过
```
--domain <custom_domain>
```
  使用该自定义域名。
- 仅在临时检查或未提供自定义域名时使用默认OBS主机名。
确认根路径返回主页（HTTP 200）。
确认访问不存在的路径时返回配置的错误行为（HTTP 404或配置的错误页）。
验证用户提供的自定义域名的DNS解析（
```
dig
```
/
```
nslookup
```
）和HTTP访问。当请求包含自定义域名时，不能仅基于默认OBS主机名就判定设置完成。

Bucket Existence and Region Check Method

存储桶存在性和区域检查方法

Run a read-only SDK check with

verify_obs_website.py

before website configuration.

bash

python scripts/verify_obs_website.py \
  --bucket-name "<bucket_name>" \
  --region "<region>" \
  --index-document "<index_document>"

obs endpoint

is auto-built as

https://obs.<region>.myhuaweicloud.com

Pass/Fail rules:

```
PASS
```
:
```
headBucket
```
is
```
2xx
```
and region matches (or region cannot be returned but bucket is reachable with
```
2xx
```
).
```
FAIL
```
:
```
headBucket
```
non-
```
2xx
```
,
```
getBucketLocation
```
non-
```
2xx
```
, or explicit region mismatch.

在网站配置前，使用

verify_obs_website.py

执行只读SDK检查。

bash

python scripts/verify_obs_website.py \
  --bucket-name "<bucket_name>" \
  --region "<region>" \
  --index-document "<index_document>"

obs endpoint

会自动构建为

https://obs.<region>.myhuaweicloud.com

。

通过/失败规则：

通过：
```
headBucket
```
返回
```
2xx
```
且区域匹配（或无法返回区域但存储桶可访问并返回
```
2xx
```
）。
失败：
```
headBucket
```
返回非
```
2xx
```
、
```
getBucketLocation
```
返回非
```
2xx
```
，或区域明确不匹配。

Anonymous Read Check Method

匿名读取检查方法

Use anonymous HTTP requests against the OBS website endpoint (no AK/SK) as the source of truth.

The verifier auto-builds the default website URL:

http://<bucket_name>.obs.<region>.myhuaweicloud.com

Run bundled verifier (preferred):

bash

python scripts/verify_obs_website.py \
  --bucket-name "<bucket_name>" \
  --region "<region>" \
  --domain "<custom_domain>" \
  --index-document "<index_document>"

If no custom domain was provided by the user, verify the default OBS website endpoint instead:

bash

python scripts/verify_obs_website.py \
  --bucket-name "<bucket_name>" \
  --region "<region>" \
  --index-document "<index_document>"

If you need a quick single-file check, run:

bash

site_url="http://<custom_domain>"
curl -s -o /dev/null -w "%{http_code}\n" "$site_url/<index_document>"

Pass/Fail rules:

```
200
```
on
```
root_path
```
and
```
index_document
```
: anonymous read is working.
```
403
```
: treat as two possible issues that must both be reported to the user: anonymous/public read is not enabled (ACL/policy issue), or the AK/SK used for SDK verification/configuration lacks required IAM permissions.
```
404
```
: object path/name issue (for example,
```
index.html
```
missing or key path mismatch), not an anonymous-permission success.

When

appears, treat setup as failed and tell the user both common possibilities:

bucket/object is not public-read for website access
AK/SK lacks required IAM permissions for OBS operations

Provide remediation via

references/iam-policies.md

使用针对OBS网站端点的匿名HTTP请求（无需AK/SK）作为判断依据。

验证器自动构建默认网站URL：

http://<bucket_name>.obs.<region>.myhuaweicloud.com

使用捆绑的验证器（推荐）：

bash

python scripts/verify_obs_website.py \
  --bucket-name "<bucket_name>" \
  --region "<region>" \
  --domain "<custom_domain>" \
  --index-document "<index_document>"

如果用户未提供自定义域名，则验证默认OBS网站端点：

bash

python scripts/verify_obs_website.py \
  --bucket-name "<bucket_name>" \
  --region "<region>" \
  --index-document "<index_document>"

如果需要快速检查单个文件，运行：

bash

site_url="http://<custom_domain>"
curl -s -o /dev/null -w "%{http_code}\n" "$site_url/<index_document>"

通过/失败规则：

```
root_path
```
和
```
index_document
```
返回
```
200
```
：匿名读取正常工作。
返回
```
403
```
：视为两种可能的问题，必须同时告知用户：未启用匿名/公共读取权限（ACL/策略问题），或用于SDK验证/配置的AK/SK缺少必要的IAM权限。
返回
```
404
```
：对象路径/名称问题（例如
```
index.html
```
缺失或密钥路径不匹配），并非匿名权限验证通过。

当出现

时，判定设置失败，并告知用户两种常见可能性：

存储桶/对象未针对网站访问设置公共读取权限
AK/SK缺少OBS操作所需的IAM权限

通过

references/iam-policies.md

提供修复方案。

Response Shape

响应格式

Always return:

Input summary
Actions performed
Verification results
Remediation steps if anything failed

When DNS is externally managed, also include a short DNS handoff section that tells the user exactly which CNAME record to configure with their provider.

始终返回以下内容：

输入摘要
执行的操作
验证结果
失败时的修复步骤

当DNS由外部管理时，还需包含一个简短的DNS交接部分，明确告知用户需在其提供商处配置的CNAME记录。

Safety Rules

安全规则

Never print secrets, AK/SK, or tokens.
Do not claim success until the website endpoint is verified.
If the user provided a custom domain, final success must be based on verification through that custom domain, not only the default OBS hostname.
If permissions are missing, stop and report the missing capability.
If DNS provider ownership is unspecified, ask whether the zone is managed in Huawei Cloud DNS or externally before assuming
```
hcloud
```
steps.
If Huawei Cloud DNS changes are required for completion but the zone is unknown, ask for the zone instead of guessing.
Do not use the regular bucket endpoint as the final website result.
If the bucket name contains dots, warn that HTTPS access can be problematic.
```
obsutil
```
is allowed only for managing
```
~/.obsutilconfig
```
; do not use it to configure website hosting.
Do not perform any object upload actions in this skill.
Especially during verification, use read-only checks only; never upload test files.
For externally managed DNS, do not stop at “DNS is external”; provide the user-facing CNAME handoff details needed to finish the setup.

切勿打印密钥、AK/SK或令牌。
除非网站端点已验证通过，否则不要宣称配置成功。
如果用户提供了自定义域名，最终成功必须基于该自定义域名的验证结果，而非仅基于默认OBS主机名。
如果缺少权限，停止操作并报告缺失的权限。
如果DNS提供商归属未明确，在假设使用
```
hcloud
```
步骤前，询问区域是由华为云DNS管理还是外部管理。
如果完成配置需要华为云DNS更改但区域未知，询问区域信息而非猜测。
不要将常规存储桶端点作为最终网站结果。
如果存储桶名称包含点号，警告用户HTTPS访问可能存在问题。
```
obsutil
```
仅允许用于管理
```
~/.obsutilconfig
```
；请勿用它配置网站托管。
本技能中请勿执行任何对象上传操作。
尤其是在验证过程中，仅使用只读检查；切勿上传测试文件。
对于外部管理的DNS，不要仅告知“DNS由外部管理”；提供用户完成设置所需的CNAME交接细节。

Permission Failure Handling (MUST)

权限失败处理（必须执行）

When any command fails due to IAM permission errors:

Read
```
references/iam-policies.md
```
.
Show the required permission list and policy JSON to the user.
Guide the user to create a custom IAM policy and grant it in Huawei Cloud IAM console.
Pause execution and wait for user confirmation that permissions were granted.

当任何命令因IAM权限错误失败时：

读取
```
references/iam-policies.md
```
。
向用户显示所需权限列表和策略JSON。
引导用户在华为云IAM控制台创建自定义IAM策略并授予权限。
暂停执行并等待用户确认权限已授予。

References

参考文档

Load

references/obs-python-sdk-website.md

for SDK method usage for website hosting and custom domain registration (

setBucketCustomDomain

). Load

references/iam-policies.md

for required IAM actions and policy JSON. Load

references/hcloud-dns-obs-website.md

for step-by-step DNS CNAME configuration for custom domains via Huawei Cloud DNS (

hcloud

CLI), including zone lookup, record creation, and verification.

Known Pitfall: The
setBucketWebsite
API in esdk-obs-python >= 3.x uses
WebsiteConfiguration
model objects, not keyword arguments like
indexDocumentSuffix
. Always import
WebsiteConfiguration
,
IndexDocument
, and
ErrorDocument
and construct them properly.

加载

references/obs-python-sdk-website.md

获取网站托管和自定义域名注册（

setBucketCustomDomain

）的SDK方法使用说明。加载

references/iam-policies.md

获取所需IAM操作和策略JSON。加载

references/hcloud-dns-obs-website.md

获取通过华为云DNS（

hcloud

CLI）为自定义域名配置DNS CNAME的分步指南，包括区域查找、记录创建和验证。

已知陷阱： esdk-obs-python >= 3.x中的
setBucketWebsite
API使用
WebsiteConfiguration
模型对象，不使用
indexDocumentSuffix
这类关键字参数。务必导入
WebsiteConfiguration
、
IndexDocument
和
ErrorDocument
并正确构建它们。

Scripts

脚本说明

Use scripts only for repeatable checks and verification. Keep command output human-readable and focused on success/failure.

```
scripts/set_obs_website_sdk.py <bucket_name> <endpoint> --custom-domain <domain> [--index-document <name>] [--error-document <name>]
```
applies static website hosting settings through the OBS SDK, registers the required custom domain, and reads credentials from CLI args, env vars, or
```
~/.obsutilconfig
```
.
```
scripts/verify_obs_website.py --bucket-name <name> --region <region> [--domain <custom_domain>] [--index-document <name>] [--json]
```
verifies endpoint DNS/HTTP behavior and also performs a read-only bucket existence + region check (
```
headBucket
```
+
```
getBucketLocation
```
). If
```
--domain
```
is provided, that custom domain is the final verification target; otherwise it auto-builds the default website URL as
```
http://<bucket>.obs.<region>.myhuaweicloud.com
```
. The OBS API endpoint remains
```
https://obs.<region>.myhuaweicloud.com
```
. It prints structured sections (
```
Input summary
```
,
```
Actions performed
```
,
```
Verification results
```
,
```
Remediation steps
```
) so agent responses can directly reuse them.

仅将脚本用于可重复的检查和验证。保持命令输出易于阅读并聚焦于成功/失败状态。

scripts/set_obs_website_sdk.py <bucket_name> <endpoint> --custom-domain <domain> [--index-document <name>] [--error-document <name>]

通过OBS SDK应用静态网站托管设置，注册所需的自定义域名，并从CLI参数、环境变量或

~/.obsutilconfig

读取凭证。

scripts/verify_obs_website.py --bucket-name <name> --region <region> [--domain <custom_domain>] [--index-document <name>] [--json]

验证端点的DNS/HTTP行为，同时执行只读的存储桶存在性+区域检查（

headBucket

getBucketLocation

）。如果提供了

--domain

，则该自定义域名为最终验证目标；否则自动构建默认网站URL为

http://<bucket>.obs.<region>.myhuaweicloud.com

。OBS API端点仍为

https://obs.<region>.myhuaweicloud.com

。它会打印结构化部分（

Input summary

、

Actions performed

、

Verification results

、

Remediation steps

），以便Agent响应可直接复用这些内容。

Validation Rules

验证规则

Load

references/verification-method.md

for validation rules.

加载

references/verification-method.md

获取验证规则。