# Huawei Dew

> Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets.

- Skill: `huaweicloud/huawei-dew` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add huaweicloud/huawei-dew`
- Raw SKILL.md: https://api.skillmd.com/api/skills/huaweicloud/huawei-dew/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: huaweicloud (https://skillmd.com/u/huaweicloud)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/huaweicloud/huawei-dew

---


# Huawei Cloud DEW (Data Encryption Workshop)

**STOP - Do not answer from general knowledge.** Follow the procedure below.

Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.

## Overview

Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS for secret lifecycle management, KMS for encryption key management, credential rotation, and secure application integration patterns.

## Critical Warnings

| Trap                                         | Why                                                                |
| -------------------------------------------- | ------------------------------------------------------------------ |
| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection  |
| NEVER echo credentials in conversation       | AK/SK, passwords, tokens must never appear in chat                 |
| KMS key deletion is irreversible             | 7-30 day pending deletion window. Once gone, data is unrecoverable |
| Secret rotation requires automation          | Manual rotation risks stale credentials                            |
| Cross-account KMS needs grants               | KMS keys are regional. Cross-region data needs grant setup         |

## CSMS Operations

### Read-only (safe — metadata only)

| Operation          | Description                                            |
| ------------------ | ------------------------------------------------------ |
| ListSecrets        | List all secrets (names only, no values)               |
| ShowSecret         | Get secret metadata (rotation config, KMS key, status) |
| ListSecretVersions | List version IDs and stages (no values)                |

### Secret Value (blocked by policy — use runtime injection)

| Operation          | Safe Alternative                              |
| ------------------ | --------------------------------------------- |
| DownloadSecretBlob | Use {{resolve:csms:secret-id}} in IaC or SDK  |
| ShowSecretVersion  | Use runtime injection, never in agent context |

## KMS Operations

| Task       | Command                                                | Notes                      |
| ---------- | ------------------------------------------------------ | -------------------------- |
| List keys  | hcloud KMS ListKeys                                    | Read-only                  |
| Create key | hcloud KMS CreateKey --key_alias=<name>                | Requires write approval    |
| Encrypt    | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
| Decrypt    | hcloud KMS DecryptData (**BLOCKED**)                   | Use runtime injection      |

## Runtime Injection Pattern

`ash

# Terraform / IaC

resource "huaweicloud_csms_secret" "db_password" {
secret_string = var.db_password # NEVER hardcode
}

# SDK

secret_value = client.get_secret(secret_id="my-secret")

# Use immediately, never print or store in context

# hcloud (for approved automation only)

hcloud CSMS DownloadSecretBlob --secret_name=<name>

# WARNING: Output goes to stdout. Pipe directly, never capture in agent.

`

## Troubleshooting

| Error                | Root Cause -> Fix                                                           |
| -------------------- | --------------------------------------------------------------------------- |
| Secret not found     | Wrong region or project -> Verify secret ARN includes region/project        |
| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:ShowSecret + kms:Decrypt                |
| KMS key disabled     | Key scheduled for deletion or manually disabled -> Enable or create new key |
| Rotation stuck       | Lambda/Python function error -> Check rotation function logs                |

## Security Considerations

- MUST use runtime injection. NEVER fetch secrets into agent context
- MUST rotate credentials every 90 days
- MUST enable automatic rotation for CSMS secrets
- MUST audit KMS key usage via CTS
- SHOULD use customer-managed keys (CMK) for sensitive data
- MUST NOT use default KMS keys for production workloads

## MCP Tools

- huaweicloud_list_operations service=DEW or CSMS or KMS
- huaweicloud_run_readonly_command for ListSecrets/ListKeys (metadata only)
- huaweicloud_safety policy blocks all secret value reads

## References

- DEW Docs: https://support.huaweicloud.com/dew/
- CSMS usage: references/csms-usage.md
- KMS usage: references/kms-usage.md