Huawei Create

Huawei Create
Certified
Create or update a Huawei Cloud RFS stack

Creates the stack if it does not exist, otherwise deploys an update — the Huawei Cloud Resource Formation Service (RFS) equivalent of io.kestra.plugin.aws.cloudformation.Create.

RFS deploys Terraform/HCL templates (not CloudFormation-style JSON/YAML). Provide exactly one template source (templateBody inline, or templateUri pointing at an OBS-hosted template), and at most one variables source (vars, varsBody, or varsUri).

Both the create and the deploy operations are asynchronous on Huawei's side: this task submits the request, then — when wait is true (the default) — polls getStackMetadata until the deployment reaches a terminal state. On success (DEPLOYMENT_COMPLETE), the stack's declared outputs are fetched and returned; sensitive outputs come back from RFS as the literal string <sensitive>, never the real value.

This task intentionally does not override kill(): an RFS stack is long-lived infrastructure, so killing the Kestra execution only stops the client-side polling — the deployment keeps running on Huawei's side. Use the Delete task to explicitly tear a stack down.

yaml
type: io.kestra.plugin.huawei.rfs.Create

Examples

Create an OBS bucket via an inline Terraform template and wait for completion

yaml
id: rfs_create_stack
namespace: company.team

tasks:
  - id: create_bucket_stack
    type: io.kestra.plugin.huawei.rfs.Create
    accessKeyId: "{{ secret('HUAWEI_AK') }}"
    secretAccessKey: "{{ secret('HUAWEI_SK') }}"
    region: eu-west-101
    projectId: "{{ secret('HUAWEI_PROJECT_ID') }}"
    stackName: my-bucket-stack
    templateBody: |
      terraform {
        required_providers {
          huaweicloud = {
            source  = "huawei.com/provider/huaweicloud"
            version = ">= 1.70.1"
          }
        }
      }

      variable "bucket_name" {
        type = string
      }

      resource "huaweicloud_obs_bucket" "this" {
        bucket = var.bucket_name
        acl    = "private"
      }

      output "bucket_name" {
        value = huaweicloud_obs_bucket.this.bucket
      }
    vars:
      bucket_name: kestra-rfs-demo-bucket

Deploy from an OBS-hosted template without waiting for completion

yaml
id: rfs_create_stack_fire_and_forget
namespace: company.team

tasks:
  - id: deploy_stack
    type: io.kestra.plugin.huawei.rfs.Create
    accessKeyId: "{{ secret('HUAWEI_AK') }}"
    secretAccessKey: "{{ secret('HUAWEI_SK') }}"
    region: eu-west-101
    projectId: "{{ secret('HUAWEI_PROJECT_ID') }}"
    stackName: my-network-stack
    templateUri: "obs://my-templates-bucket/network/main.tf"
    varsUri: "obs://my-templates-bucket/network/prod.tfvars"
    wait: false

Properties

stackName *string

Stack name

RFS stack identifier used by create, deploy, and delete operations. Must be unique within the project.

accessKeyId string

Access Key (AK) used to authenticate with Huawei Cloud

Huawei Cloud access key used together with secretAccessKey to sign API requests. Required for AK/SK-based authentication; not required when providing a pre-obtained securityToken. Sensitive — always provide via {{ secret('NAME') }}.

domainId string

Huawei Cloud Account Domain ID

Identifies the Huawei Cloud account (domain). Required when authenticating against global services such as IAM, or when requesting a domain-scoped IAM token.

enableAutoRollback booleanstring

Defaulttrue

Enable automatic rollback on deployment failure

When true (the default), RFS automatically rolls back to the last known-good state if the deployment fails. Applied only when the stack is first created; ignored when this task deploys an update to an already-existing stack.

enableDeletionProtection booleanstring

Defaultfalse

Enable deletion protection

When true, the stack cannot be deleted until protection is disabled. Defaults to false. Applied only when the stack is first created; ignored when this task deploys an update to an already-existing stack.

endpointOverride string

RFS endpoint URL override

Overrides the default endpoint derived from region and endpointSuffix. Use this for private endpoints, non-standard deployments, or tests. When set, endpointSuffix is ignored.

Format: https://aos.<region>.myhuaweicloud.com (without trailing slash).

endpointSuffix string

Huawei Cloud domain suffix

Controls the top-level domain used when deriving the RFS endpoint from region. Defaults to myhuaweicloud.com. Set to myhuaweicloud.eu for the Huawei Cloud European sovereign cloud.

Ignored when endpointOverride is set.

interval string

DefaultPT5S

Polling interval while waiting for the stack operation to complete

ISO-8601 duration (e.g. PT5S). Defaults to 5 seconds.

maxDuration string

DefaultPT1H

Maximum time to wait for the stack operation to complete

ISO-8601 duration (e.g. PT1H). Only relevant when wait is true. Defaults to 1 hour.

pluginDefaultsRef string

Reference (ref) of the pluginDefaults to apply to this task.

projectId string

Huawei Cloud Project ID

Identifies the region-scoped project against which most regional services authenticate. Mutually exclusive with domainId for global services such as IAM.

region string

Huawei Cloud region

Region identifier such as eu-west-101, ap-southeast-1, or cn-north-4.

secretAccessKey string

Secret Key (SK) used to authenticate with Huawei Cloud

Huawei Cloud secret key paired with accessKeyId. Required for AK/SK-based authentication. Sensitive — always provide via {{ secret('NAME') }}.

securityToken string

Pre-obtained Huawei Cloud IAM token used as bearer credential for downstream API calls

When set, downstream Huawei tasks send this value in the X-Auth-Token header instead of signing requests with AK/SK. Sensitive.

stackDescription string

Stack description

Free-text description stored on the stack. Applied only when the stack is first created; ignored when this task deploys an update to an already-existing stack (RFS's deploy API carries no description field).

templateBody string

Inline Terraform/HCL template

The stack's Terraform configuration as a string. Exactly one of templateBody or templateUri must be set.

templateUri string

OBS URI of the Terraform/HCL template

An obs://bucket/key (or signed HTTPS) URI RFS downloads the template from. Exactly one of templateBody or templateUri must be set.

temporaryCredentials string

Inline IAM credential exchange

When set, the connection layer calls the Huawei IAM STS API once per task execution and uses the returned temporary AK/SK + security token instead of the static accessKeyId and secretAccessKey properties.

Configure once via pluginDefaults to apply transparently to every task in a namespace without per-task credential wiring:

pluginDefaults: 
  - type: io.kestra.plugin.huawei.obs
    values: 
      region: eu-west-101
      temporaryCredentials: 
        authMethod: PASSWORD
        username: my-iam-user
        password: "{{ secret('HUAWEI_IAM_PASSWORD') }}"
        domainName: my-account-domain
        durationSeconds: 3600

**Long-running tasks: ** the exchange runs once at execution start. For RealtimeTrigger or long-running Consume tasks that outlive durationSeconds, credentials will expire mid-run. Use long-lived AK/SK properties or refresh externally in that case.

Definitions

io.kestra.plugin.huawei.TemporaryCredentialsConfig

authMethodstring

DefaultPASSWORD

Possible Values

PASSWORDTOKEN

Authentication method

Controls which credentials are used to obtain the session token before exchanging for temporary STS credentials.

PASSWORD (default): provide username, password, and domainName.
TOKEN: provide an existing iamToken (X-Auth-Token).

domainNamestring

Account domain name (PASSWORD method only)

The Huawei Cloud account name (domain name) that owns the IAM user. Required when authMethod is PASSWORD. Visible in the Huawei Cloud console under My Credentials → Domain Name.

durationSecondsintegerstring

Default900

Lifetime of the temporary credentials in seconds

How long the returned temporary AK/SK/security-token should remain valid. Huawei Cloud accepts values between 900 (15 minutes) and 86400 (24 hours). Defaults to 900 seconds.

endpointSuffixstring

Defaultmyhuaweicloud.com

Huawei Cloud IAM endpoint suffix

Domain suffix used to build the IAM endpoint URL when no explicit endpoint override is set. Defaults to myhuaweicloud.com. Set to myhuaweicloud.eu for the European sovereign cloud (region eu-west-101 / EU-Dublin).

iamTokenstring

IAM token to exchange (TOKEN method only)

An existing Huawei Cloud X-Auth-Token to exchange for temporary STS credentials. Required when authMethod is TOKEN. Sensitive — always provide via {{ secret('NAME') }}.

passwordstring

IAM password (PASSWORD method only)

Password for the IAM user identified by username. Required when authMethod is PASSWORD. Sensitive — always provide via {{ secret('NAME') }}.

projectNamestring

Project name for project-scoped tokens (PASSWORD method only)

Overrides the project name used for scope=PROJECT token requests. Defaults to the task's region value when omitted, which is correct for most regions.

scopestring

DefaultPROJECT

Possible Values

PROJECTDOMAIN

Token scope (PASSWORD method only)

Scope of the session token obtained during password authentication.

PROJECT (default): token is scoped to the project matching projectName (or the task's region when projectName is omitted). Use for most downstream tasks.
DOMAIN: token is scoped to the domain.

usernamestring

IAM username (PASSWORD method only)

Huawei Cloud IAM username. Required when authMethod is PASSWORD.

vars object

Terraform variables

Key-value map of Terraform variable values, sent as RFS vars_structure entries (string values only). Supports at most 100 entries. At most one of vars, varsBody, or varsUri may be set.

varsBody string

Inline Terraform tfvars content

Raw .tfvars-formatted content. At most one of vars, varsBody, or varsUri may be set.

varsUri string

OBS URI of a Terraform tfvars file

An obs://bucket/key URI RFS downloads a .tfvars file from. At most one of vars, varsBody, or varsUri may be set.

wait booleanstring

Defaulttrue

Wait for completion

When true (the default), block until the stack deployment or deletion reaches a terminal state.

Outputs

deploymentId string

Deployment ID

Identifier of the create/deploy operation that was submitted.

outputs object

SubTypestring

Stack outputs

Outputs declared by the deployed Terraform template, keyed by output name. Empty when wait is false. RFS returns sensitive outputs as the literal string <sensitive> rather than the real value.