Huawei Download

Huawei Download
Certified
Download an object from Huawei OBS to Kestra internal storage

Downloads an object from the specified OBS bucket and key and stores it in Kestra internal storage. The task outputs the internal storage URI so downstream tasks can consume the file.

yaml
type: io.kestra.plugin.huawei.obs.Download

Examples

yaml
id: obs_download
namespace: company.team

tasks:
  - id: download
    type: io.kestra.plugin.huawei.obs.Download
    accessKeyId: "{{ secret('HUAWEI_AK') }}"
    secretAccessKey: "{{ secret('HUAWEI_SK') }}"
    region: "eu-west-101"
    bucket: "my-bucket"
    key: "data/report.csv"

Properties

bucket *string

OBS bucket name

Name of the OBS bucket to operate on. The bucket must already exist.

key *string

OBS object key to download

The full key (path) of the object within the bucket, e.g. data/2024/report.csv.

accessKeyId string

Access Key (AK) used to authenticate with Huawei Cloud

Huawei Cloud access key used together with secretAccessKey to sign API requests. Required for AK/SK-based authentication; not required when providing a pre-obtained securityToken. Sensitive — always provide via {{ secret('NAME') }}.

authType string

Possible Values

OBSV2V4

Request signing algorithm

Controls how OBS client signs each request:

OBS — native Huawei OBS signing (default; use for real OBS endpoints).
V2 — S3 v2 HMAC signing; required for MinIO and other S3-compatible endpoints.
V4 — S3 v4 signing; not compatible with MinIO via the OBS SDK due to a date-format mismatch. Do not use V4 with S3-compatible endpoints.

domainId string

Huawei Cloud Account Domain ID

Identifies the Huawei Cloud account (domain). Required when authenticating against global services such as IAM, or when requesting a domain-scoped IAM token.

endpointOverride string

Override for the OBS endpoint URL

Full URL of the OBS endpoint to connect to instead of the region-derived default (https://obs.<region>.myhuaweicloud.com). Required when using S3-compatible endpoints such as MinIO (e.g. http://localhost: 9000). Trailing slashes are stripped automatically.

endpointSuffix string

Defaultmyhuaweicloud.com

Domain suffix for the region-derived OBS endpoint

Suffix appended to build https://obs.<region>.<endpointSuffix> when no endpointOverride is set. Defaults to myhuaweicloud.com. Set to myhuaweicloud.eu for the European sovereign region (e.g. eu-west-101). Ignored when endpointOverride is set.

pathStyleAccess booleanstring

Use path-style access for object keys

When true, the bucket name is placed in the URL path (http://host/bucket/key) instead of the virtual-hosted style (http://bucket.host/key). Required for MinIO and most S3-compatible endpoints. Default is false (virtual-hosted style, as used by real OBS).

pluginDefaultsRef string

Reference (ref) of the pluginDefaults to apply to this task.

projectId string

Huawei Cloud Project ID

Identifies the region-scoped project against which most regional services authenticate. Mutually exclusive with domainId for global services such as IAM.

region string

Huawei Cloud region

Region identifier such as eu-west-101, ap-southeast-1, or cn-north-4.

secretAccessKey string

Secret Key (SK) used to authenticate with Huawei Cloud

Huawei Cloud secret key paired with accessKeyId. Required for AK/SK-based authentication. Sensitive — always provide via {{ secret('NAME') }}.

securityToken string

Pre-obtained Huawei Cloud IAM token used as bearer credential for downstream API calls

When set, downstream Huawei tasks send this value in the X-Auth-Token header instead of signing requests with AK/SK. Sensitive.

temporaryCredentials string

Inline IAM credential exchange

When set, the connection layer calls the Huawei IAM STS API once per task execution and uses the returned temporary AK/SK + security token instead of the static accessKeyId and secretAccessKey properties.

Configure once via pluginDefaults to apply transparently to every task in a namespace without per-task credential wiring:

pluginDefaults: 
  - type: io.kestra.plugin.huawei.obs
    values: 
      region: eu-west-101
      temporaryCredentials: 
        authMethod: PASSWORD
        username: my-iam-user
        password: "{{ secret('HUAWEI_IAM_PASSWORD') }}"
        domainName: my-account-domain
        durationSeconds: 3600

**Long-running tasks: ** the exchange runs once at execution start. For RealtimeTrigger or long-running Consume tasks that outlive durationSeconds, credentials will expire mid-run. Use long-lived AK/SK properties or refresh externally in that case.

Definitions

io.kestra.plugin.huawei.TemporaryCredentialsConfig

authMethodstring

DefaultPASSWORD

Possible Values

PASSWORDTOKEN

Authentication method

Controls which credentials are used to obtain the session token before exchanging for temporary STS credentials.

PASSWORD (default): provide username, password, and domainName.
TOKEN: provide an existing iamToken (X-Auth-Token).

domainNamestring

Account domain name (PASSWORD method only)

The Huawei Cloud account name (domain name) that owns the IAM user. Required when authMethod is PASSWORD. Visible in the Huawei Cloud console under My Credentials → Domain Name.

durationSecondsintegerstring

Default900

Lifetime of the temporary credentials in seconds

How long the returned temporary AK/SK/security-token should remain valid. Huawei Cloud accepts values between 900 (15 minutes) and 86400 (24 hours). Defaults to 900 seconds.

endpointSuffixstring

Defaultmyhuaweicloud.com

Huawei Cloud IAM endpoint suffix

Domain suffix used to build the IAM endpoint URL when no explicit endpoint override is set. Defaults to myhuaweicloud.com. Set to myhuaweicloud.eu for the European sovereign cloud (region eu-west-101 / EU-Dublin).

iamTokenstring

IAM token to exchange (TOKEN method only)

An existing Huawei Cloud X-Auth-Token to exchange for temporary STS credentials. Required when authMethod is TOKEN. Sensitive — always provide via {{ secret('NAME') }}.

passwordstring

IAM password (PASSWORD method only)

Password for the IAM user identified by username. Required when authMethod is PASSWORD. Sensitive — always provide via {{ secret('NAME') }}.

projectNamestring

Project name for project-scoped tokens (PASSWORD method only)

Overrides the project name used for scope=PROJECT token requests. Defaults to the task's region value when omitted, which is correct for most regions.

scopestring

DefaultPROJECT

Possible Values

PROJECTDOMAIN

Token scope (PASSWORD method only)

Scope of the session token obtained during password authentication.

PROJECT (default): token is scoped to the project matching projectName (or the task's region when projectName is omitted). Use for most downstream tasks.
DOMAIN: token is scoped to the domain.

usernamestring

IAM username (PASSWORD method only)

Huawei Cloud IAM username. Required when authMethod is PASSWORD.

versionId string

Version ID of the object to download

When set, retrieves the specific version of the object. Only applicable when bucket versioning is enabled. Omit to download the latest version.

Outputs

contentLength integer

Size of the object in bytes

contentType string

MIME content type of the object, as stored in OBS metadata

metadata object

SubTypestring

User-defined metadata attached to the object

Bare key/value pairs with OBS metadata prefixes stripped.

uri string

Formaturi

Kestra internal storage URI of the downloaded object

Metrics

file.size counter

Liquibase

Tasks that run Liquibase change management commands.

Data

OPA (Open Policy Agent)

Enterprise

Tasks to manage Open Policy Agent policies and decisions, including upload, evaluation, and partial evaluation.

Infrastructure

Huawei DownloadCertifiedDownload an object from Huawei OBS to Kestra internal storage

Huawei Download

More Plugins in this Category

Liquibase

OPA (Open Policy Agent)

Huawei Download
Certified
Download an object from Huawei OBS to Kestra internal storage