> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://developers.alephant.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.alephant.io/_mcp/server. # Huawei Cloud OBS > Configure the Huawei Cloud OBS connector with a least-privilege AK/SK and a narrow bucket prefix. Use the Huawei Cloud OBS connector to index approved files from Object Storage Service. Create one connector per knowledge directory and restrict the IAM policy to the bucket and object prefix that AIvis should read. ## What You Need | Item | Requirement | | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Bucket | A private OBS bucket reachable from AIvis workers. | | Prefix | A non-empty object prefix, such as `knowledge/` or `team/product/`. | | Region | Huawei Cloud region ID, such as `cn-north-4` or `ap-southeast-1`. | | Credential | Access Key ID and Secret Access Key for an IAM user with list and read access. | | Endpoint | Usually leave empty. AIvis derives `https://obs.{region}.myhuaweicloud.com`; use a custom endpoint for private, dedicated, or approved network paths. | OBS endpoints are regional. Bucket domain names use `BucketName.Endpoint`, for example `bucketname.obs.ap-southeast-1.myhuaweicloud.com`. AIvis needs the regional endpoint and bucket name separately, not the full bucket domain. ## Prepare Huawei Cloud 1. Sign in to Huawei Cloud and open **IAM**. 2. Create an IAM user dedicated to AIvis, such as `aivis-obs-reader`. 3. Create an AK/SK for programmatic access and store the secret securely. 4. Open the OBS bucket and confirm its region ID. 5. Upload approved files under a dedicated prefix, for example `knowledge/`. 6. Attach a custom OBS policy with only list and read permissions for that scope. ## Minimum IAM Policy For classic IAM policy syntax, use `obs:bucket:ListBucket` and `obs:object:GetObject`. New identity-policy environments may use lower-case action names such as `obs:bucket:listBucket` and `obs:object:getObject`; match the syntax required by your Huawei Cloud IAM edition. ```json { "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "obs:object:GetObject", "obs:bucket:ListBucket" ], "Resource": [ "obs:*:*:object:aivis-docs/knowledge/*", "obs:*:*:bucket:aivis-docs" ] } ] } ``` Do not grant upload, delete, bucket policy management, or broad `obs:*:*` permissions. If your bucket uses KMS or another encryption dependency, validate decrypt permissions with the same IAM user before production indexing. ## Credential Fields Create a Huawei Cloud OBS credential in AIvis: | AIvis Field | Value | | ------------------------------ | -------------------------------------------------------------------------- | | Key ID / Access Key ID | IAM user's Access Key ID. | | Secret key / Secret Access Key | Secret Access Key paired with the key ID. | | Session Token | Leave empty for a permanent AK/SK. Fill it only for temporary credentials. | ## Connector Fields | AIvis Field | Example | Notes | | --------------------------- | --------------------------------------------------------- | ------------------------------------------------------------------------- | | Connector name | `Huawei OBS knowledge` | Use a name that identifies the bucket and business scope. | | Bucket Name | `aivis-docs` | Bucket name only. | | Prefix | `knowledge/` | Must be non-empty. AIvis removes leading `/`. | | Region | `cn-north-4` | Lowercase region ID. | | Custom Endpoint URL | Leave empty or `https://obs.cn-north-4.myhuaweicloud.com` | Optional. Must include `https://` and no credentials, query, or fragment. | | ACL limitation confirmation | Checked | OBS ACLs are not synchronized into AIvis search permissions. | | Document access | Prefer **Private** and assign users or groups. | Split prefixes/connectors by audience. | The connector uses S3-compatible signed requests with virtual-hosted addressing. If using intranet, Direct Connect, dual-stack, or a custom endpoint, test reachability from the AIvis worker network before creating a broad connector. ## Verify 1. Confirm the credential validates. 2. Create a connector for a small prefix, such as `knowledge/test/`. 3. Run one index attempt and confirm only objects under the configured prefix appear. 4. Search for a known sentence from an uploaded document. 5. Confirm unselected prefixes and sensitive files are absent. 6. Test as an unauthorized AIvis user and confirm private connector content is not searchable. ## Troubleshooting | Symptom | Likely cause and action | | --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | Credential is invalid | AK/SK mismatch, disabled key, or wrong IAM user. Rotate the key and retry. | | Bucket cannot be reached | Region or endpoint does not match the bucket. Check OBS endpoint format for the bucket region. | | Objects cannot be listed | IAM policy is missing `obs:bucket:ListBucket` / `obs:bucket:listBucket` on the bucket. | | Objects are listed but cannot be read | IAM policy is missing `obs:object:GetObject` / `obs:object:getObject` for `bucket/prefix/*`. | | Only part of a directory appears | OBS listing is prefix-based and paginated; check the configured prefix and whether files are under a different key prefix. | | Users can search files they should not access | OBS ACLs are not synchronized to AIvis. Use private document access or separate connectors by audience. | ## Related Official Documentation * [Huawei Cloud OBS IAM permissions](https://support.huaweicloud.com/intl/en-us/perms-cfg-obs/obs_40_0003.html) * [Huawei Cloud OBS endpoints and domain names](https://support.huaweicloud.com/intl/en-us/productdesc-obs/obs_03_0152.html) * [Huawei Cloud OBS ListObjects](https://support.huaweicloud.com/intl/en-us/api-obs/obs_04_0022.html) * [Huawei Cloud OBS source permissions FAQ](https://support.huaweicloud.com/intl/en-us/oms_faq/topic_0000001084426802.html)