Knowledge

Huawei Cloud OBS

View as Markdown

Use the Huawei Cloud OBS connector to index approved files from Object Storage Service. Create one connector per knowledge directory and restrict the IAM policy to the bucket and object prefix that AIvis should read.

What You Need

ItemRequirement
BucketA private OBS bucket reachable from AIvis workers.
PrefixA non-empty object prefix, such as knowledge/ or team/product/.
RegionHuawei Cloud region ID, such as cn-north-4 or ap-southeast-1.
CredentialAccess Key ID and Secret Access Key for an IAM user with list and read access.
EndpointUsually leave empty. AIvis derives https://obs.{region}.myhuaweicloud.com; use a custom endpoint for private, dedicated, or approved network paths.

OBS endpoints are regional. Bucket domain names use BucketName.Endpoint, for example bucketname.obs.ap-southeast-1.myhuaweicloud.com. AIvis needs the regional endpoint and bucket name separately, not the full bucket domain.

Prepare Huawei Cloud

  1. Sign in to Huawei Cloud and open IAM.
  2. Create an IAM user dedicated to AIvis, such as aivis-obs-reader.
  3. Create an AK/SK for programmatic access and store the secret securely.
  4. Open the OBS bucket and confirm its region ID.
  5. Upload approved files under a dedicated prefix, for example knowledge/.
  6. Attach a custom OBS policy with only list and read permissions for that scope.

Minimum IAM Policy

For classic IAM policy syntax, use obs:bucket:ListBucket and obs:object:GetObject. New identity-policy environments may use lower-case action names such as obs:bucket:listBucket and obs:object:getObject; match the syntax required by your Huawei Cloud IAM edition.

1{
2  "Version": "1.1",
3  "Statement": [
4    {
5      "Effect": "Allow",
6      "Action": [
7        "obs:object:GetObject",
8        "obs:bucket:ListBucket"
9      ],
10      "Resource": [
11        "obs:*:*:object:aivis-docs/knowledge/*",
12        "obs:*:*:bucket:aivis-docs"
13      ]
14    }
15  ]
16}

Do not grant upload, delete, bucket policy management, or broad obs:*:* permissions. If your bucket uses KMS or another encryption dependency, validate decrypt permissions with the same IAM user before production indexing.

Credential Fields

Create a Huawei Cloud OBS credential in AIvis:

AIvis FieldValue
Key ID / Access Key IDIAM user’s Access Key ID.
Secret key / Secret Access KeySecret Access Key paired with the key ID.
Session TokenLeave empty for a permanent AK/SK. Fill it only for temporary credentials.

Connector Fields

AIvis FieldExampleNotes
Connector nameHuawei OBS knowledgeUse a name that identifies the bucket and business scope.
Bucket Nameaivis-docsBucket name only.
Prefixknowledge/Must be non-empty. AIvis removes leading /.
Regioncn-north-4Lowercase region ID.
Custom Endpoint URLLeave empty or https://obs.cn-north-4.myhuaweicloud.comOptional. Must include https:// and no credentials, query, or fragment.
ACL limitation confirmationCheckedOBS ACLs are not synchronized into AIvis search permissions.
Document accessPrefer Private and assign users or groups.Split prefixes/connectors by audience.

The connector uses S3-compatible signed requests with virtual-hosted addressing. If using intranet, Direct Connect, dual-stack, or a custom endpoint, test reachability from the AIvis worker network before creating a broad connector.

Verify

  1. Confirm the credential validates.
  2. Create a connector for a small prefix, such as knowledge/test/.
  3. Run one index attempt and confirm only objects under the configured prefix appear.
  4. Search for a known sentence from an uploaded document.
  5. Confirm unselected prefixes and sensitive files are absent.
  6. Test as an unauthorized AIvis user and confirm private connector content is not searchable.

Troubleshooting

SymptomLikely cause and action
Credential is invalidAK/SK mismatch, disabled key, or wrong IAM user. Rotate the key and retry.
Bucket cannot be reachedRegion or endpoint does not match the bucket. Check OBS endpoint format for the bucket region.
Objects cannot be listedIAM policy is missing obs:bucket:ListBucket / obs:bucket:listBucket on the bucket.
Objects are listed but cannot be readIAM policy is missing obs:object:GetObject / obs:object:getObject for bucket/prefix/*.
Only part of a directory appearsOBS listing is prefix-based and paginated; check the configured prefix and whether files are under a different key prefix.
Users can search files they should not accessOBS ACLs are not synchronized to AIvis. Use private document access or separate connectors by audience.