Huawei Scan

GeminiDB instance connection address

The DynamoDB-compatible API endpoint of the GeminiDB for NoSQL instance, e.g. http://192.168.0.10: 8000. Find it under Connections on the instance's console page. Unlike other Huawei Cloud services, this address is per-instance and cannot be derived from region.

The data-plane port is 8000 and is fixed: it cannot be chosen at creation or changed afterwards (a high-availability port 80 is also documented). Do not use 8635 — that is the Cassandra/CQL port of the underlying kernel and does not speak the DynamoDB protocol.

region is used only for SigV4 request signing and does not affect routing — GeminiDB routes solely by this endpoint property; leave region at its default unless signing requires a specific value.

Table name

Target GeminiDB (DynamoDB-compatible) table for the operation.

GeminiDB database account username

The DynamoDB-compatible data plane authenticates against the instance's own database account, not Huawei IAM — set this to the fixed database username rwuser. Sensitive — always provide via {{ secret('NAME') }}.

Huawei Cloud Account Domain ID

Identifies the Huawei Cloud account (domain). Required when authenticating against global services such as IAM, or when requesting a domain-scoped IAM token.

Expression attribute values

Map of : placeholder values referenced by filterExpression. Numeric values are stored as DynamoDB string (S) attributes, not numbers (N) — quote or compare them as strings.

Fetch strategy

STORE (default) writes matching rows to internal storage; FETCH loads all rows into memory; FETCH_ONE returns only the first row; NONE runs the scan without fetching results.

Filter expression

Server-side filter applied to scanned items; requires expressionAttributeValues.

Maximum number of items to evaluate

Caps the number of items read in the single response page (1-1000). Defaults to 100. Does not paginate across LastEvaluatedKey — see the task description.

Reference (ref) of the pluginDefaults to apply to this task.

Huawei Cloud Project ID

Identifies the region-scoped project against which most regional services authenticate. Mutually exclusive with domainId for global services such as IAM.

Huawei Cloud region

Region identifier such as eu-west-101, ap-southeast-1, or cn-north-4.

GeminiDB database account password

The instance admin password set when the GeminiDB instance was purchased — it cannot be retrieved later, only reset. Paired with accessKeyId: rwuser. Sensitive — always provide via {{ secret('NAME') }}.

Not supported by GeminiDB

GeminiDB's DynamoDB-compatible data plane never consults Huawei IAM, so a security token (or an inline temporaryCredentials exchange) has nothing to authenticate against. Setting either causes the task to fail fast with an actionable error instead of the opaque AccessDeniedException: auth failed a real GeminiDB instance would otherwise return. Use accessKeyId/secretAccessKey instead.

Inline IAM credential exchange

When set, the connection layer calls the Huawei IAM STS API once per task execution and uses the returned temporary AK/SK + security token instead of the static accessKeyId and secretAccessKey properties.

Configure once via pluginDefaults to apply transparently to every task in a namespace without per-task credential wiring:

pluginDefaults: 
  - type: io.kestra.plugin.huawei.obs
    values: 
      region: eu-west-101
      temporaryCredentials: 
        authMethod: PASSWORD
        username: my-iam-user
        password: "{{ secret('HUAWEI_IAM_PASSWORD') }}"
        domainName: my-account-domain
        durationSeconds: 3600

**Long-running tasks: ** the exchange runs once at execution start. For RealtimeTrigger or long-running Consume tasks that outlive durationSeconds, credentials will expire mid-run. Use long-lived AK/SK properties or refresh externally in that case.