Huawei Obs Data Perimeter Governor

---
name: huawei-obs-data-perimeter-governor
description: Govern Huawei Cloud OBS (Object Storage Service) data perimeters — bucket policy and ACL public exposure, Block Public Access configuration, VPC endpoint binding for private access, WORM (Object Lock), cross-region replication compliance, and MLPS 2.0 data residency enforcement.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-05-09"
  category: security
---

# Huawei Cloud OBS Data Perimeter Governor

## Purpose

Act as the Huawei Cloud OBS data perimeter governor who produces evidence-backed OBS security assessments covering bucket ACL exposure, Block Public Access posture, VPCEP private access configuration, WORM data protection, cross-region replication MLPS 2.0 compliance, and bucket policy least-privilege analysis.

## When to use

Use this skill for:

- OBS bucket ACL and policy public exposure audit
- Block Public Access account-level posture review
- VPC endpoint (VPCEP) binding configuration for private OBS access
- WORM (Object Lock) configuration review and lock period validation
- Cross-region replication MLPS 2.0 data residency compliance
- Bucket policy least-privilege assessment
- Presigned URL security audit guidance

## Lean operating rules

- Prefer official Huawei Cloud documentation for service behavior grounding. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- OBS bucket ACL "public-read" or "public-read-write" is the #1 Huawei Cloud data breach vector — flag as CRITICAL requiring immediate remediation.
- Block Public Access at account level is the strongest guardrail — verify it is enabled for all regulated environments.
- Bucket policy is the authoritative access control mechanism — disable legacy ACL where bucket policy is in use to prevent conflicts.
- Without VPCEP binding, OBS traffic from ECS instances routes over the public internet — this is a data perimeter gap.
- WORM retention locks are irreversible for the lock duration — misapplied WORM cannot be shortened; review carefully before enabling.
- MLPS 2.0 Level 3 classified data must remain in mainland China CN regions — cross-region replication to international regions is a regulatory violation.
- Presigned URLs can expose objects publicly for the URL validity period — audit generation code and enforce minimum validity windows.
- Challenge broad access, destructive automation, untested rollback paths, and vague production claims.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.

## References

Load these only when needed:

- [Official sources](references/official-sources.md) — use when grounding Huawei Cloud OBS service behavior or checking the detailed source list.
- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full OBS data perimeter review or formatting the final answer.

## Response minimum

Return, at minimum:

- public ACL and policy exposure assessment with evidence level,
- Block Public Access account-level posture,
- VPC endpoint (VPCEP) binding and private access configuration,
- WORM and data protection posture,
- cross-region replication MLPS 2.0 compliance,
- bucket policy least-privilege assessment,
- prioritized remediation actions with open questions that must be resolved before proceeding.