> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Huawei Cloud

> Connect an OIDC identity provider and account-scoped trust agency.

Open **Connectors → Connect → Huawei Cloud** as an Administrator. Use the issuer,
audience and subject shown by that team's wizard; self-hosted deployments need
their own configured OIDC issuer. Do not substitute values from another team.

## Identity provider and agency

1. In Huawei IAM, create an **OIDC identity provider** using the wizard's values.
2. Create a **trust agency** of type Identity Provider / OIDC and select that
   provider. Use the audience shown in Nuphos.
3. Grant only the permissions needed for the work. The agency must support the
   account-scoped credential Nuphos requests (**All resources** scope); a
   project-only agency cannot supply it. Read-only permissions are enough for
   browsing.
4. Set the team-pinned identity conditions shown by the wizard, including subject
   and issuer. Keep them when narrowing the agency's permissions.

## Save and verify

Enter a label, the **Account ID** (32 hex characters from My Credentials), the
**identity provider name**, and **trust agency name**. The provider name is not
Huawei's separate hexadecimal provider ID. No long-lived access key is required
for this federation flow.

After connecting, verify a bounded account/region read before broader work. CCE
clusters and ECS instances have resource pages; the authorized agent API access
can cover other resources within the agency's policy. In-cluster RBAC remains
a separate requirement.

If federation fails, check backend OIDC configuration, audience, team subject,
agency name and account scope. Remove the connection in Nuphos and revoke the
unneeded cloud trust/agency when ending access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.