Huawei GetTemporaryCredentials

Huawei GetTemporaryCredentials

Certified

Obtain short-lived Huawei Cloud credentials (temporary AK/SK + security token)

Produces temporary credentials valid for up to 24 hours that can be passed directly to downstream tasks (OBS, DMS, …) in place of long-lived AK/SK credentials.

Two authentication methods are supported:

  • PASSWORD (default): authenticates with a Huawei Cloud IAM username and password to obtain a session token, then exchanges it for temporary STS credentials. No pre-existing token is required — this is the recommended entry point for durable-credential workflows.

  • TOKEN: exchanges an already-obtained X-Auth-Token directly for temporary STS credentials. Use this when you manage the IAM token lifecycle externally.

The returned accessKeyId, secretAccessKey, and securityToken expire at expirationTime; refresh before that deadline.

**Escape-hatch task: ** for zero-wiring workflows, prefer the temporaryCredentials block on the connection layer (configurable via pluginDefaults) so credentials are obtained inline without manual output references. Use this task only when you need the raw credential values in subsequent steps or external systems.

yaml
type: io.kestra.plugin.huawei.iam.GetTemporaryCredentials

Obtain temporary credentials from an IAM username and password, then upload a file to OBS.

yaml
id: iam_password_temp_creds
namespace: company.team

tasks:
  - id: get_temp_creds
    type: io.kestra.plugin.huawei.iam.GetTemporaryCredentials
    region: eu-west-101
    authMethod: PASSWORD
    username: my-iam-user
    password: "{{ secret('HUAWEI_IAM_PASSWORD') }}"
    domainName: my-account-domain
    durationSeconds: 3600

  - id: upload
    type: io.kestra.plugin.huawei.obs.Upload
    accessKeyId: "{{ outputs.get_temp_creds.accessKeyId }}"
    secretAccessKey: "{{ outputs.get_temp_creds.secretAccessKey }}"
    securityToken: "{{ outputs.get_temp_creds.securityToken }}"
    region: eu-west-101
    bucket: my-bucket
    from: "{{ inputs.file }}"
    key: uploads/data.csv

Exchange an existing IAM token for temporary credentials.

yaml
id: iam_token_temp_creds
namespace: company.team

tasks:
  - id: get_temp_creds
    type: io.kestra.plugin.huawei.iam.GetTemporaryCredentials
    region: eu-west-101
    authMethod: TOKEN
    token: "{{ secret('HUAWEI_IAM_TOKEN') }}"
    durationSeconds: 3600

  - id: upload
    type: io.kestra.plugin.huawei.obs.Upload
    accessKeyId: "{{ outputs.get_temp_creds.accessKeyId }}"
    secretAccessKey: "{{ outputs.get_temp_creds.secretAccessKey }}"
    securityToken: "{{ outputs.get_temp_creds.securityToken }}"
    region: eu-west-101
    bucket: my-bucket
    from: "{{ inputs.file }}"
    key: uploads/data.csv
Properties

Huawei Cloud region

Region identifier such as eu-west-101, ap-southeast-1, or cn-north-4. Used to resolve the IAM endpoint URL.

DefaultPASSWORD
Possible Values
PASSWORDTOKEN

Authentication method

Controls which credentials are used to obtain the session token before exchanging for temporary STS credentials.

  • PASSWORD: provide username, password, and domainName. Recommended for automated workflows — no pre-existing token management needed.
  • TOKEN: provide an existing token (X-Auth-Token). Use when you manage the IAM token lifecycle outside this task.

Account domain name (PASSWORD method only)

The Huawei Cloud account name (domain name) that owns the IAM user. Required when authMethod is PASSWORD. This is the top-level account identifier, not the project or region name — visible in the Huawei Cloud console under My Credentials → Domain Name.

Default900

Lifetime of the temporary credentials in seconds

How long the returned temporary AK/SK/security-token should remain valid. Huawei Cloud accepts values between 900 (15 minutes) and 86400 (24 hours). Defaults to 900 seconds if omitted.

Defaultmyhuaweicloud.com

IAM endpoint domain suffix

Domain suffix used to build the IAM endpoint URL. Defaults to myhuaweicloud.com. Set to myhuaweicloud.eu for the European sovereign cloud (region eu-west-101 / EU-Dublin).

IAM password (PASSWORD method only)

Password for the IAM user identified by username. Required when authMethod is PASSWORD. Sensitive — always provide via {{ secret('NAME') }}.

Reference (ref) of the pluginDefaults to apply to this task.

Project name for project-scoped tokens (PASSWORD method only)

Overrides the project name used for scope=PROJECT token requests. Defaults to the region value when omitted, which is correct for most regions.

DefaultPROJECT
Possible Values
PROJECTDOMAIN

Token scope (PASSWORD method only)

Determines the scope of the session token obtained during password authentication.

  • PROJECT (default): token is scoped to the project matching projectName (or region when projectName is omitted). Use for most downstream tasks (OBS, DMS).
  • DOMAIN: token is scoped to the domain. Use for domain-wide IAM management.

IAM token to exchange (TOKEN method only)

An existing Huawei Cloud X-Auth-Token to exchange for temporary STS credentials. Required when authMethod is TOKEN. Sensitive — always provide via {{ secret('NAME') }}.

IAM username (PASSWORD method only)

Huawei Cloud IAM username. Required when authMethod is PASSWORD.

Temporary Access Key ID

Short-lived Huawei Cloud access key. Pass as accessKeyId to downstream tasks.

Formatdate-time

Credential expiration time

UTC instant at which the temporary credentials expire.

Temporary Secret Access Key

Short-lived Huawei Cloud secret key paired with accessKeyId. Sensitive — treat as a secret and do not log.

Security Token (session token)

Short-lived security token required alongside the temporary AK/SK. Pass as securityToken to downstream tasks. Sensitive — treat as a secret and do not log.

More Plugins in this Category

Liquibase
Liquibase

Tasks that run Liquibase change management commands.

Data

2 tasks

OPA (Open Policy Agent)
OPA (Open Policy Agent)
Enterprise

Tasks to manage Open Policy Agent policies and decisions, including upload, evaluation, and partial evaluation.

Infrastructure

5 tasks

3 blueprints