Huawei Cloud OBS
Huawei Cloud OBS (Object Storage Service) uses an S3-compatible API with buckets at `<bucket>.obs.<region>.myhuaweicloud.com`. Public exposure stems from ACL grants to the `Everyone` principal.
Huawei Cloud OBS exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
OBS has both a bucket policy and a bucket ACL, and a public grant on either is sufficient. Many operators harden the policy but forget the legacy ACL.
Real-world impact
Public ACL or policy enables anonymous LIST and GET. OBS's big-data tier makes it a common target for ML-dataset exfiltration.
Remediation
- Audit both the ACL and the bucket policy; remove `Everyone` from each.
- Enable OBS access logs and review unauthenticated request counts weekly.
URL patterns
Huawei Cloud OBS buckets typically resolve under hostnames like:
example.obs.ap-southeast-1.myhuaweicloud.comexample.obs.cn-north-4.myhuaweicloud.com
Check a specific Huawei Cloud OBS URL
Paste any Huawei Cloud OBS URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Huawei Cloud OBS bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request