huaweicloud Huawei Cloud IAM
STOP - Do not answer from general knowledge. Follow the procedure below.
Always run hcloud <Service> <Operation> --help before constructing commands to discover exact parameter names and requirements.
Overview
Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers user/group/role lifecycle, policy design, temporary credentials, and security best practices.
Critical Warnings
| Trap | Why |
|---|---|
| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
缺少必填参数 cli-domain-id = invalid creds |
KooCLI's account-id lookup failed (APIGW.0301). Re-run auth init. Domain-level params (--domain_id, --agency.domain_id) are separate — get the account-id via hcloud STS GetCallerIdentity --cli-region=<region> when needed |
Policy Structure
json { "Version": "1.1", "Statement": [{ "Effect": "Allow", "Action": ["ecs:*"], "Resource": ["*"], "Condition": { "StringEquals": {"g:SourceVpc": "vpc-xxx"} } }] }
Common Workflows
| Task | Command | Steps |
|---|---|---|
| List users | hcloud IAM KeystoneListUsers --cli-region= | references/quick-ref.md |
| Create group | hcloud IAM CreateGroupV5 --group_name= | references/quick-ref.md |
| Create custom policy | hcloud IAM CreateCloudServiceCustomPolicy --role.display_name= --role.type= --role.policy.Statement.1.Effect=Allow | references/policy-examples.md |
| Create agency | hcloud IAM CreateAgency --agency.name= --agency.domain_id= --agency.trust_domain_name= | references/quick-ref.md |
| Get temporary credential | hcloud STS AssumeAgency --agency_urn= --agency_session_name= --duration_seconds=3600 | references/quick-ref.md |
| Attach policy to group | hcloud IAM AttachGroupPolicyV5 --group_id= --policy_id= | references/quick-ref.md |
Policy Examples (Least Privilege)
| Role | Actions | Resource |
|---|---|---|
| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:::bucket:my-bucket |
| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
See
references/policy-examples.mdfor complete policy JSON templates with conditions.
Troubleshooting
| Error | Root Cause -> Fix |
|---|---|
| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
Security Considerations
- MUST NOT create IAM users. Use OneAccess or federated SSO
- MUST NOT create long-term AK/SK. Use STS temporary tokens
- MUST scope Resource ARNs. Never use wildcard *
- MUST add conditions to trust policies (g:SourceAccount, g:SourceUrn)
- SHOULD rotate credentials every 90 days
Agencies (Cross-Service Delegation)
Agencies allow one service to act on behalf of another. Common use cases:
FunctionGraph Agency (VPC Access)
FunctionGraph needs an agency to access VPC resources (RDS, DCS, etc.):
# 1. Create agency with FunctionGraph trust
hcloud IAM CreateAgency --agency.name=<name> --agency.trust_domain_name=functiongraph
# 2. Grant role to agency
hcloud IAM AssociateAgencyWithDomainPermission --agency_id=<id> --role_id=<role-id>
# 3. Use in CreateFunction
hcloud FunctionGraph CreateFunction ... --app_xrole=<agency-name>
Common roles for FunctionGraph: VPC Administrator, RDS Administrator, DCS Administrator.
MCP Tools
- huaweicloud_list_operations service=IAM
- huaweicloud_run_readonly_command for user/policy discovery
References
- IAM Docs: https://support.huaweicloud.com/iam/
- Policy examples: references/policy-examples.md
- Agency setup: references/quick-ref.md