---
name: huawei-cloud-obs-upload
description: |
  Upload a local file or directory to a specified Huawei Cloud OBS (Object Storage Service) bucket with obsutil, and set up a scheduled/periodic upload task (crontab) that syncs a local directory to an OBS bucket. Also lists OBS buckets with storage capacity and object count.
  Use this skill when the user wants to: (1) upload a specific local file or directory to a named OBS bucket, (2) set up a scheduled/periodic upload task that automatically syncs a local directory to a named OBS bucket, (3) list their OBS buckets and check capacity and object count.
  Triggers include: user mentions "upload to OBS bucket", "上传文件到OBS", "上传目录到OBS", "定时上传到OBS", "目录同步到OBS桶", "OBS scheduled upload", "OBS周期上传", "OBS bucket capacity check", "OBS桶容量查询". Generic phrases such as "object storage", "upload file" or "upload directory" alone are NOT sufficient to trigger this skill.
tags: ["obs upload", "obs", "obsutil"]
---

# Huawei Cloud OBS Upload Skill

## Overview

Upload local files or directories to Huawei Cloud OBS buckets, list OBS buckets with capacity and object count, and schedule periodic uploads via crontab. **Upload operations use obsutil; bucket listing/stats use `hcloud obs ls` + CES metrics.**

**Tool separation principle:**
- **obsutil** — File/directory upload, scheduled upload sync (**upload core tool; hcloud CLI has no PutObject support**)
- **hcloud CLI** — Bucket listing via `hcloud obs ls` (obsutil mode), bucket capacity/object count stats via `hcloud CES ShowMetricData`
- **crontab / Task Scheduler** — OS-level scheduled task for periodic upload (no daemon process dependency)

**Security architecture:**
- AK/SK are never read, echoed, or printed in conversation
- obsutil credentials are configured by the user in their terminal (never asked in conversation)
- Delete operations are strictly forbidden (irreversible); out-of-scope operations are refused with guided alternatives
- For directory uploads, whether to preserve directory structure (`-flat`) is decided by the customer's explicit answer, never assumed
- **Every upload (Task 2) and every scheduled-upload setup (Task 3) requires the user's explicit confirmation before executing either the command or the crontab write**
- The agent only executes the steps described in this skill for the exact user-specified bucket and path; it never performs any other OBS/CLI action on the user's behalf

> **⚠️ Data transmission notice**
>
> - **Upload transfers local files/directories to remote cloud storage and persists them there.** Before uploading, clearly tell the user: "Uploading `<path>` will transmit the data to OBS bucket `<Bucket>` and store it in the cloud." If the user did not intend this, stop before executing.
> - **Scheduled uploads repeatedly push data** from a local directory to the cloud on a recurring schedule. Warn the user explicitly that the data will be transmitted and persisted remotely on each run.
> - Review the path to be uploaded before executing; if the path is broad (e.g., a home directory) or contains unexpected content, confirm the scope with the user before uploading.

## ⛔ Prohibited Operations (Security Constraints)

> **This skill strictly forbids the following operations, regardless of user requests. The forbidden actions are described semantically; no destructive command examples are provided.**

| Prohibited Operation | Reason |
|---------------------|--------|
| ❌ Delete a bucket | Irreversible; destroys the entire bucket and all objects |
| ❌ Delete an object | Irreversible; deleted objects cannot be recovered (unless versioning is enabled) |
| ❌ Batch delete objects | Irreversible; batch deletion has a wide impact |
| ❌ Empty a bucket | Irreversible; removes all objects in the bucket |
| ❌ Download an object | This skill is upload-only; download is a separate workflow |
| ❌ Create a bucket | Bucket creation has a dedicated skill with full prerequisites |
| ❌ Copy an object between buckets | Cross-bucket object copy is out of this skill's scope |
| ❌ Modify bucket lifecycle configuration | Storage cost management is a separate bucket-level config task |
| ❌ Restore an archived object | Archive restore is a separate workflow with retrieval modes and TTL |
| ❌ Generate presigned URLs | Temporary sharing requires SDK signing; not supported by CLI upload |
| ❌ Modify bucket ACL or bucket policy | Permission management is a separate security task |
| ❌ Ask user to provide AK/SK directly in conversation | Credentials must never appear in conversation |
| ❌ Extract AK/SK from hcloud config files | Credentials are encrypted and cannot be used directly |
| ❌ Skip obsutil credential check before OBS operations | Operations fail without configured credentials |
| ❌ Use `-flat` for directory uploads without asking the customer | `-flat` discards directory structure; must follow customer's explicit answer |
| ❌ Guess local path, bucket name, or target prefix | Required parameters must be provided by the user |

> **If a user requests a delete operation, you must refuse and inform:**
> "Per security constraints, this skill does not allow delete operations (delete bucket/object/batch delete/empty bucket). Please use the Huawei Cloud OBS console or obsutil manually."

> **If a user requests an out-of-scope operation, do not attempt to perform it. Inform the user with the recommended alternative from the table below:**

| Operation | Recommended alternative |
|-----------|-------------------------|
| Download object | Use `obsutil cp obs://<Bucket>/<Key> <LocalPath>` manually, or the OBS console |
| Create bucket | Use the dedicated skill [huawei-cloud-obs-bucket-create](https://skills.huaweicloud.com/detail/huawei-cloud-obs-bucket-create), or the OBS console |
| Copy object | Use `hcloud OBS CopyObject` manually, or the OBS console |
| Lifecycle configuration | Use the OBS console (Bucket > Lifecycle), or `hcloud OBS SetBucketLifecycle` |
| Restore archived object | Use `obsutil restore obs://<Bucket>/<Key>` manually, or the OBS console |
| Presigned URL | Use Huawei Cloud SDK (Java/Python/Go) to generate presigned URLs, or the OBS console |
| Bucket ACL/Policy | Use the OBS console (Bucket > Permissions), or `hcloud OBS SetBucketAcl`/`SetBucketPolicy` |

## Architecture

```
Huawei Cloud OBS Upload Management
├── Task 1: ListBucketsWithStats   (List buckets with capacity and object count)
│   ├── 1a. hcloud obs ls: list all buckets
│   ├── 1b. CES metrics / OBS API: query bucket capacity and object count
│   └── 1c. Report bucket stats table to user
├── Task 2: UploadFile             (Upload local file or directory to target bucket)
│   ├── 2a. Confirm local path + bucket name + target prefix with user
│   ├── 2b. For directory: ask customer whether to preserve directory structure (decide -flat)
│   ├── 2c. Warn data persists remotely + get explicit user confirmation
│   ├── 2d. obsutil cp: single file (-flat) or directory (-r, optional -flat by customer answer)
│   └── 2e. Verify upload result
└── Task 3: ScheduledUpload       (Schedule periodic upload of local directory to target bucket)
    ├── 3a. Confirm local dir + bucket + prefix + schedule period with user
    ├── 3b. Ask customer whether to preserve directory structure (decide -flat)
    ├── 3c. Warn about persistence + get explicit user confirmation
    ├── 3d. Generate obsutil upload script (with/without -flat per customer answer)
    ├── 3e. Set crontab / Task Scheduler scheduled task
    └── 3f. Verify scheduled task is set
```

## Prerequisites

> **Prerequisite check 1/3: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required**
> Run `hcloud version` to verify version >= 3.2.0. If not installed or version is too low,
> see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation guide.

```bash
hcloud version
```

> **Prerequisite check 2/3: obsutil >= 5.5.0 required (for upload features)**
> File/directory upload requires the Huawei Cloud obsutil CLI tool.
> Run `obsutil version` to verify version >= 5.5.0. If not installed,
> see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation guide.

```bash
obsutil version
```

> **Prerequisite check 3/3: obsutil credential configuration required**
>
> The hcloud obs module maps to obsutil under the hood, which requires separate AK/SK and Endpoint configuration.
> Before performing OBS operations, **you must check whether obsutil credentials are configured**:
>
> ```bash
> hcloud obs ls -limit=1
> ```
>
> **If the response is `Please set ak, sk and endpoint in the configuration file!` or `InvalidAccessKeyId`, obsutil credentials are not configured.**
>
> **Resolution: Direct the user to configure obsutil credentials in their own terminal (do not ask the user to provide AK/SK directly in the conversation), with the security warning below:**
>
> ```
> obsutil credentials are not configured. Please run the following command in your terminal to configure (AK/SK can be obtained from the Huawei Cloud console "My Credentials" page):
>
>   hcloud obs config -i=<YourAK> -k=<YourSK> -e=obs.<Region>.myhuaweicloud.com
>
> Example (Guangzhou region):
>   hcloud obs config -i=<YourAK> -k=<YourSK> -e=obs.cn-south-1.myhuaweicloud.com
>
> Common Endpoints:
>   cn-north-4  → obs.cn-north-4.myhuaweicloud.com
>   cn-east-3   → obs.cn-east-3.myhuaweicloud.com
>   cn-south-1  → obs.cn-south-1.myhuaweicloud.com
>   cn-southwest-2 → obs.cn-southwest-2.myhuaweicloud.com
>
> ⚠️ Security warning: putting AK/SK on the command line exposes them to shell history and OS process listings.
> Prefer interactive configuration (`hcloud configure`) or environment variables (HW_ACCESS_KEY / HW_SECRET_KEY).
> After configuration, clear your shell history if the plaintext command was used.
>
> Retry after configuration is complete.
> ```

> **⚠️ hcloud parameter format requirements**
>
> hcloud (KooCLI) cloud-service API commands (uppercase module, e.g. `hcloud CES ShowMetricData`) **must use the `--param=value` format** (connected with equals sign); space-separated format is not supported.
>
> ✅ Correct: `hcloud CES ShowMetricData --region=cn-south-1 --namespace=SYS.OBS`
>
> ❌ Incorrect: `hcloud CES ShowMetricData --region cn-south-1`
>
> **Note:** `hcloud obs` (lowercase, obsutil mode) directly maps to obsutil commands and uses obsutil parameter style (e.g. `hcloud obs ls`, `hcloud obs config -i=...`); the `--param=value` rule does not apply. There is no `hcloud OBS ListBuckets` command — use `hcloud obs ls` to list buckets.

---

## Authentication

> **Security rules (must be followed):**
> - **Prohibited** from reading, echoing, or printing AK/SK values
> - **Prohibited** from asking the user to input AK/SK directly in the conversation
> - **Prohibited** from using `hcloud configure set` to pass plaintext credential values
> - **Prohibited** from accepting AK/SK directly provided by the user in the conversation
> - **Only allowed** to read credentials from environment variables or configured CLI config files
>
> **⚠️ Credential exposure warning (share with the user when credential configuration is discussed):**
>
> - Passing AK/SK as command-line arguments (e.g., `obsutil config -ak=... -sk=...` or `hcloud configure set --access-key-id=...`) exposes the credentials to **shell history, OS process listings, audit logs, terminal recordings, and copied documentation**.
> - Prefer interactive configuration (`hcloud configure`) or environment variables (`HW_ACCESS_KEY` / `HW_SECRET_KEY`).
> - After configuring via a plaintext command, clear the shell history (`history -c` or remove the offending line from `~/.bash_history`).
> - obsutil's credential config file (e.g., `~/.obsutilconfig`) should have restricted permissions (e.g., `600`).
>
> **⚠️ Important: Handling user-provided credentials**
>
> If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
> 1. **Stop immediately** - Do not execute any commands
> 2. **Politely refuse** and return the following message:
>    ```
>    For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.
>
>    Please use one of the following secure methods to configure credentials:
>
>    Method 1: Interactive configuration (recommended)
>        hcloud configure
>        # Enter AK/SK as prompted; credentials will be securely stored in a local config file
>
>    Method 2: Environment variable configuration
>        export HW_ACCESS_KEY=<your-access-key-id>
>        export HW_SECRET_KEY=<your-access-key-secret>
>
>    After configuration is complete, please retry your request.
>    ```
> 3. **Do not continue** executing any Huawei Cloud operations until credentials are configured
>
> **Check CLI configuration**:
> ```bash
>    hcloud configure list
> ```
>    Check whether the output contains valid configuration (AK/SK, IAM, etc.).
>
> **If no valid credentials exist, stop here.**

---

## IAM Permission Policies

Ensure the IAM user has the required permissions. See [references/iam-policies.md](references/iam-policies.md) for the full permission table.

**Minimum required permissions:**
- `obs:bucket:list` — List buckets
- `obs:bucket:get` — Get bucket attributes (capacity, object count)
- `obs:object:get` — Read object information
- `obs:object:put` — Upload objects

**Permission boundaries:**

- **Scope constraint**: This skill may ONLY perform the following tool actions, and only on the user-specified buckets/paths after confirmation:
  - `hcloud obs ls` / `obsutil ls` — list buckets and objects for the user-specified scope
  - `hcloud CES ShowMetricData` / `hcloud OBS GetBucketStorageInfo` — read bucket capacity / object count
  - `obsutil cp` — upload the confirmed local file/directory to the confirmed bucket
  - `crontab` (Linux/macOS) or `schtasks` (Windows) — write/remove the confirmed scheduled upload task
- All other CLI/tool operations (delete, download, copy, bucket creation, config modification, etc.) are strictly out of scope and must be refused.
- **Must stop if**: credentials missing or invalid, user declines any confirmation, target bucket does not exist, or local path does not exist.
- **Prohibited actions**: any delete operation, any out-of-scope operation listed above, modifying the tool list here, or executing any command beyond the confirmed scope.

---

## Core Workflows

### Task 1: List Buckets with Capacity and Object Count

List buckets via obsutil, then query bucket capacity and object count using CES capacity metrics or OBS API.

> **⚠️ Tool separation: `hcloud obs ls` for listing, `hcloud CES ShowMetricData` for stats**
>
> - **`hcloud obs ls`**: list all buckets (obsutil mode; no `--region` parameter — region is set via `hcloud obs config -e=...`)
> - **`hcloud CES ShowMetricData` / OBS API**: query each bucket's capacity and object count

📄 Detailed steps → [references/task-list-buckets-with-stats.md](references/task-list-buckets-with-stats.md)

**Sub-tasks:**

1. **1a. List buckets** — `hcloud obs ls` (or `obsutil ls`)
2. **1b. Query bucket stats** — CES capacity metrics or OBS API for capacity and object count
3. **1c. Report stats** — Present bucket name, capacity, object count in a table

> **ℹ️ Task 1 is read-only (bucket listing and stats query). No confirmation gate is required for this task.**

### Task 2: Upload Local File or Directory to Target Bucket

Upload files or directories to a specified OBS bucket using obsutil, supporting single file and directory upload.

> **⚠️ Upload operations require obsutil, not hcloud**
>
> hcloud CLI does not support OBS object upload operations (no PutObject/UploadPart CLI commands). Uploading files/directories **must use obsutil**.

> **⚠️ For directory uploads, you MUST ask the customer first whether to preserve the source directory structure, then decide whether to use `-flat` based on their explicit answer. Never default.**

> **⚠️ Confirmation gate (mandatory before executing an upload):**
> 1. Tell the user the data will be transmitted to the remote OBS bucket and persisted there.
> 2. Confirm with the user: the exact local path, target bucket name, target prefix (if any), and that they approve the upload.
> 3. Only after the user explicitly approves, execute the upload command. If the user declines or the path/bucket is not confirmed, do not execute.

📄 Detailed steps → [references/task-upload-file.md](references/task-upload-file.md)

**Sub-tasks:**

1. **2a. Confirm parameters** — local path, target bucket name, target prefix (optional) with the user
2. **2b. Decide `-flat`** — single file: use `-flat` without asking; directory: ask customer whether to preserve directory structure
3. **2c. Get explicit user confirmation** — restate the target (path → bucket/prefix), warn that data persists remotely, and obtain approval
4. **2d. Execute upload** — `obsutil cp` single file or directory (with/without `-flat` per customer answer)
5. **2e. Verify result** — check upload exit code and confirm object exists in bucket

### Task 3: Schedule Periodic Upload of Local Directory to Target Bucket

Periodically upload a local directory to a specified OBS bucket incrementally via crontab scheduled task.

> **⚠️ Scheduled upload is based on OS-level scheduled task mechanisms (Linux/macOS: crontab, Windows: Task Scheduler), no daemon process dependency.**

> **⚠️ Before generating the scheduled upload script, you MUST ask the customer first whether to preserve the source directory structure, then decide whether to use `-flat` based on their explicit answer. Never default.**

> **⚠️ Persistence & confirmation gate (mandatory before writing a scheduled task):**
> - **A scheduled task persists on the host and repeatedly pushes the local directory to the cloud after the session ends.** Before proceeding, explicitly warn the user about this persistence.
> - Confirm with the user: the local directory, target bucket/prefix, the schedule period, and that they approve installing the recurring task.
> - Only after the user explicitly approves, generate the script and write the crontab entry (Linux/macOS) or Task Scheduler task (Windows). Do not silently append a crontab entry.
> - Provide the removal method so the user can delete the scheduled task later (see [references/task-scheduled-upload.md](references/task-scheduled-upload.md)).

📄 Detailed steps → [references/task-scheduled-upload.md](references/task-scheduled-upload.md)

**Sub-tasks:**

1. **3a. Confirm parameters** — local directory, bucket, prefix, schedule period with the user
2. **3b. Decide `-flat`** — ask customer whether to preserve directory structure
3. **3c. Warn about persistence + get explicit confirmation** — tell the user the task persists on the host and repeatedly uploads data to the cloud; obtain explicit approval for the recurring upload
4. **3d. Generate upload script** — `$HOME/obs-scheduled-upload-<BucketName>.sh` (with/without `-flat` per customer answer)
5. **3e. Set scheduled task** — crontab (Linux/macOS) or Task Scheduler (Windows)
6. **3f. Verify** — `crontab -l` or `schtasks /query` to confirm task is set

---

## Core Commands

### obsutil (upload core — hcloud has no PutObject)

```bash
# Upload a single file
obsutil cp <LocalFilePath> obs://<BucketName>/<ObjectKey> -flat

# Upload directory, preserve structure (customer chose "Yes")
obsutil cp <LocalDirPath> obs://<BucketName>/<Prefix> -r

# Upload directory, flatten files (customer chose "No")
obsutil cp <LocalDirPath> obs://<BucketName>/<Prefix> -r -flat

# Scheduled incremental upload, preserve structure
obsutil cp <LocalDirPath> obs://<BucketName>/<Prefix> -r -f -u

# Scheduled incremental upload, flatten files
obsutil cp <LocalDirPath> obs://<BucketName>/<Prefix> -r -flat -f -u

# List buckets
obsutil ls
```

### hcloud CLI (bucket listing + stats)

```bash
# List all buckets (obsutil mode; no --region parameter)
hcloud obs ls

# Check obsutil credential configuration
hcloud obs ls -limit=1

# Configure obsutil credentials (user runs in terminal)
# ⚠️ Plaintext AK/SK on the command line is exposed to shell history & process listings.
# Prefer interactive configuration (`hcloud configure`) or environment variables.
hcloud obs config -i=<AK> -k=<SK> -e=<Endpoint>

# Query bucket capacity/object count stats (cloud-service API mode, --param=value format)
hcloud CES ShowMetricData \
  --region=cn-south-1 \
  --namespace=SYS.OBS \
  --metric_name=capacity_total \
  --dim.0=bucket_name,my-bucket \
  --period=86400 \
  --filter=average \
  --from=1746057600000 \
  --to=1747612800000
```

> **⚠️ Key constraints on Core Commands:**
>
> - Upload: **MUST use obsutil cp** — hcloud CLI has no PutObject support
> - List buckets: **MUST use `hcloud obs ls`** — there is no `hcloud OBS ListBuckets` command
> - `-flat` for directory uploads: **MUST follow the customer's explicit answer**, never default
> - hcloud cloud-service API params (uppercase module, e.g. `hcloud CES ...`): **MUST use `--param=value` format**; `hcloud obs` (obsutil mode) uses obsutil parameter style
> - AK/SK: **MUST NOT appear in conversation**; user configures obsutil credentials in their terminal

---

## Parameter Confirmation

> **Before executing any task, the following parameters must be confirmed with the user. Guessing is prohibited.**

| Parameter | Required/Optional | Description | Default |
|-----------|-------------------|-------------|---------|
| Region | Required | Huawei Cloud region (e.g., `cn-south-1`, `cn-north-4`); must be explicitly selected by the user | - |
| Local file/directory path | Required (Task 2/3) | Local path to upload; must exist and be readable | - |
| Target bucket name | Required (Task 2/3) | Target OBS bucket name for upload | - |
| Target path prefix | Optional (Task 2/3) | Target path prefix within the bucket | Bucket root |
| Preserve directory structure | Required (directory upload) | Ask customer: "Yes" → no `-flat`; "No" → `-flat` | - (must ask) |
| Schedule period | Required (Task 3) | Execution period, e.g., hourly, daily at 8:00, every 30 minutes | - |
| Crontab expression | Optional (Task 3) | If user is familiar with cron expressions, they can provide one directly | - |

> **Note**: No AK/SK parameter is required in conversation. Credentials are configured by the user via `hcloud obs config` in their terminal.

> **⚠️ Before executing an upload or scheduled-upload, restate the confirmed parameters to the user and warn that the data will be transmitted to the remote OBS bucket and persisted there. Obtain the user's explicit confirmation before executing.**

---

## Verification Method

See [references/verification-method.md](references/verification-method.md) for details. For common issues and solutions, see [references/troubleshooting.md](references/troubleshooting.md).

**Quick validation:**
```bash
hcloud version && obsutil version && hcloud obs ls -limit=1
```

**Post-upload verification:** `obsutil ls obs://<BucketName>/<Prefix>` to confirm uploaded objects exist.

---

## References

| Document | Description |
|----------|-------------|
| [task-list-buckets-with-stats.md](references/task-list-buckets-with-stats.md) | Task 1: List buckets with capacity and object count |
| [task-upload-file.md](references/task-upload-file.md) | Task 2: Upload file or directory |
| [task-scheduled-upload.md](references/task-scheduled-upload.md) | Task 3: Scheduled upload |
| [related-apis.md](references/related-apis.md) | API and CLI command details |
| [iam-policies.md](references/iam-policies.md) | IAM permission policies |
| [obs-metrics.md](references/obs-metrics.md) | OBS CES monitoring metrics reference |
| [verification-method.md](references/verification-method.md) | Verification steps |
| [acceptance-criteria.md](references/acceptance-criteria.md) | Correct/error pattern comparison |
| [cli-installation-guide.md](references/cli-installation-guide.md) | CLI installation guide |
| [troubleshooting.md](references/troubleshooting.md) | Troubleshooting and practical experience |