---
name: telecloud-obs
description: Configure and troubleshoot Ethio Telecom Telecloud OBS through its S3-compatible API using AWS CLI or boto3. Use for Telecloud object uploads, downloads, backup storage integration, and checksum compatibility errors; not ECS, VPC, or Terraform provisioning.
metadata:
  author: Snapwre
  version: "1.0.0"
  source: https://snapwre.com/blog/ethio-telecom-telecloud-guide
---

# Telecloud OBS

Help the user work with Ethio Telecom Telecloud Object Storage Service (OBS) using its S3-compatible interface. Use their existing tool and credential mechanism when possible. This skill is based on Snapwre's deployment experience, not an official Ethio Telecom integration or a promise of complete AWS S3 feature compatibility.

## Establish the target

Identify the requested operation, bucket, object key, endpoint, signing region, and credentials profile or environment. Use available project configuration to resolve these; ask only for missing non-secret details. Do not ask the user to paste access keys, passwords, or credential files into chat.

For Snapwre's AA2 deployment, these values worked:

| Setting | Value |
| --- | --- |
| HTTPS endpoint | `https://obsv3.et-global-3.ethiotelecom.et` |
| Signing region | `et-global-3` |

Confirm the values in the user's bucket console. Do not infer AA1 or DB1 endpoints from the AA2 example. A valid OBS access key does not imply that ECS or Terraform APIs are available in that region.

The purchasing portal is https://telecloud.ethiotelecom.et/. Its Console link opens the cloud management platform. OBS buckets and access keys are managed in the console, not the shop. In Snapwre's console, access keys were under the account menu, My Space, My Settings, Access Keys. Menu labels and quotas may vary.

## Credentials and connectivity

Use a dedicated AWS shared-credentials profile, protected environment variables, or the application's existing secret mechanism. A profile named `telecloud` is used in the examples; adapt it to the user's configuration. If needed, have the user enter their keys locally with `aws configure --profile telecloud`. Secrets must not appear in source code, logs, screenshots, committed configuration, or the assistant's output.

Keep the bucket private unless the user requests another access model. Creating buckets, changing policy, overwriting objects, and deleting objects must stay within the user's requested scope. Do not treat installing this skill as permission to make cloud changes.

Use HTTPS with certificate verification enabled. A server without an EIP may need NAT, a proxy, or another permitted route to reach the endpoint; being in the same region does not prove private connectivity. Diagnose connectivity before changing cloud network rules.

## AWS CLI

Check that AWS CLI is installed. Use an explicit profile, endpoint, and signing region so an OBS operation cannot accidentally target AWS or another account.

List objects only in the requested bucket or prefix; do not require account-wide bucket-listing permission as a prerequisite:

```bash
aws s3 ls s3://YOUR_BUCKET/YOUR_PREFIX/ \
  --profile telecloud \
  --endpoint-url https://obsv3.et-global-3.ethiotelecom.et \
  --region et-global-3
```

For an upload authorized by the user:

```bash
AWS_REQUEST_CHECKSUM_CALCULATION=when_required \
AWS_RESPONSE_CHECKSUM_VALIDATION=when_required \
aws s3 cp ./sample.txt s3://YOUR_BUCKET/YOUR_PREFIX/sample.txt \
  --profile telecloud \
  --endpoint-url https://obsv3.et-global-3.ethiotelecom.et \
  --region et-global-3
```

Replace the bucket, prefix, filename, and endpoint with the confirmed target. Use a unique object key for a test upload and download to a new local path, so a test cannot overwrite existing data. Compare the downloaded bytes or SHA-256 digest with the original. Remove test objects only when cleanup is within the authorized task; otherwise report the keys left behind.

## Python / boto3

Use this when the user wants Python integration. Let the credential provider resolve the secret; do not put keys in the example or generated code.

```python
import boto3
from botocore.config import Config

session = boto3.Session(profile_name="telecloud")
s3 = session.client(
    "s3",
    endpoint_url="https://obsv3.et-global-3.ethiotelecom.et",
    region_name="et-global-3",
    config=Config(
        request_checksum_calculation="when_required",
        response_checksum_validation="when_required",
    ),
)
s3.upload_file("sample.txt", "YOUR_BUCKET", "YOUR_PREFIX/sample.txt")
```

If the application already uses environment credentials, retain that mechanism instead of imposing a local profile. Prefer its existing boto3/botocore versions if they support these options; investigate compatibility before changing dependencies.

## Troubleshooting

- **`XAmzContentSHA256Mismatch`:** Snapwre resolved this with the `when_required` request and response checksum settings shown above. Scope the workaround to the OBS client or command; it reduces optional checksum protections. Verify important transfers independently and test backup restores.
- **`AccessDenied` / HTTP 403:** Check the chosen profile, bucket permissions, endpoint, signing region, and clock. A denied list operation does not prove uploads are denied. Do not broaden permissions automatically.
- **`SignatureDoesNotMatch`:** Check endpoint, signing region, credentials selection, system time, and any proxy rewriting the request. Do not expose credentials during diagnosis.
- **DNS failure / timeout:** Check resolution, routing, outbound firewall rules, and proxy settings. Compare IPv4 and IPv6 only when the symptoms suggest an address-family problem. Do not rewrite system DNS as a default fix.
- **Certificate error:** Verify the hostname, clock, and certificate chain. Do not disable TLS validation.
- **Unsupported checksum configuration:** Inspect AWS CLI or boto3/botocore versions and consult their documentation before updating the relevant dependency.

After a focused correction, retry the smallest operation that checks it. If the same error persists, stop repeating writes and report the error category, attempted correction, and missing information. Never claim an upload, backup, or restore succeeded without verifying it.

For backup integration, preserve the user's retention and encryption requirements. S3 compatibility alone does not establish compatibility with every backup tool or multipart upload mode. Validate the chosen tool and restore path.

## References

- Snapwre field guide: https://snapwre.com/blog/ethio-telecom-telecloud-guide
- AWS checksum settings: https://docs.aws.amazon.com/sdkref/latest/guide/feature-dataintegrity.html
- boto3 credential sources: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html

Report the confirmed endpoint, region, credential source name (never its values), work performed, verification, and any unresolved limitation. Distinguish a locally checked example from an operation actually tested against Telecloud.