huaweicloud-devkit 0.1.17

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/deploy-workflow.md

@@ -0,0 +1,119 @@
+# End-to-End Deployment Workflow
+
+```
+1. Write code     → Create index.py with handler function
+2. Package        → zip -j function.zip index.py (no directory nesting!)
+3. Create function → hcloud FunctionGraph CreateFunction (inline for small demos, zip for production)
+4. Verify         → hcloud FunctionGraph InvokeFunction
+5. Create trigger  → hcloud FunctionGraph CreateFunctionTrigger (TIMER for testing, DEDICATEDGATEWAY for HTTP)
+```
+
+## Quick Demo (Inline — No File Packaging)
+
+Use inline for small demo functions (<10KB):
+
+```bash
+# 1. Prepare base64-encoded code
+python3 -c "
+import base64
+code = '''import json
+def handler(event, context):
+    return {'statusCode': 200, 'body': json.dumps({'message': 'Hello FunctionGraph!'}), 'headers': {'Content-Type': 'application/json'}}
+'''
+print(base64.b64encode(code.encode()).decode())
+"
+
+# 2. Create function with inline code (paste base64 output as --func_code.file)
+hcloud FunctionGraph CreateFunction --help
+hcloud FunctionGraph CreateFunction \
+  --func_name=my-backend \
+  --runtime=Python3.10 \
+  --handler=index.handler \
+  --memory_size=256 \
+  --package=default \
+  --timeout=30 \
+  --code_type=inline \
+  --func_code.file=<base64-from-step-1> \
+  --cli-region=<region> \
+  --project_id=<project-id>
+
+# 3. Verify
+hcloud FunctionGraph InvokeFunction \
+  --function_urn=<urn> \
+  --name=test-event \
+  --x_cff_request_version=v0
+```
+
+## Production Deployment (Zip)
+
+```bash
+# 1. Write code
+cat > index.py << 'EOF'
+import json
+
+def handler(event, context):
+    return {
+        "statusCode": 200,
+        "body": json.dumps({"message": "Hello from FunctionGraph!"}),
+        "headers": {"Content-Type": "application/json"}
+    }
+EOF
+
+# 2. Package — CRITICAL: use -j to flatten, no directory nesting
+zip -j function.zip index.py
+
+# 3. Create function (discover params with --help first!)
+hcloud FunctionGraph CreateFunction --help
+# Required: --func_name, --runtime, --handler, --memory_size, --package, --timeout
+# Code type: use --code_type=zip --code_filename=function.zip
+# IMPORTANT: cd to function.zip directory first! --code_filename is filename only.
+
+# 4. Verify (store URN from step 3 output)
+hcloud FunctionGraph InvokeFunction --help
+# Requires body param: --name=test-event (becomes event body passed to handler)
+hcloud FunctionGraph InvokeFunction \
+  --function_urn=<urn> \
+  --name=test-event \
+  --x_cff_request_version=v0
+
+# 5. Create trigger (see references/triggers.md)
+# For quick testing: TIMER trigger (no prerequisites)
+# For HTTP access: DEDICATEDGATEWAY (requires APIG instance — see pre-flight checklist below)
+
+# 5a. TIMER (simple — no APIG dependency)
+hcloud FunctionGraph CreateFunctionTrigger \
+  --function_urn=<urn> \
+  --trigger_type_code=TIMER \
+  --event_type_code=MessageCreated \
+  --trigger_status=ACTIVE \
+  --event_data.name=test-timer \
+  --event_data.schedule_type=Rate \
+  --event_data.schedule="5m"
+```
+
+## DEDICATEDGATEWAY Pre-Flight Checklist
+
+Before creating a DEDICATEDGATEWAY (HTTP) trigger, verify these prerequisites exist:
+
+```bash
+# 1. Check for APIG dedicated instance
+hcloud APIG ListInstancesV2 --cli-region=<r>
+
+# 2. If no instance exists, create one (see huawei-apig skill)
+#    Key: --spec_id=PROFESSIONAL --loadbalancer_provider=elb for public access
+#    Requires: VPC, subnet, security group, enterprise_project_id
+
+# 3. Once instance is Running with public IP, create API group
+hcloud APIG CreateApiGroupV2 --instance_id=<id> --name=<group-name>
+
+# 4. Create DEDICATEDGATEWAY trigger (see references/triggers.md)
+
+# 5. Publish the API (after trigger creation)
+hcloud APIG BatchPublishOrOfflineApiV2 \
+  --instance_id=<apig-instance-id> \
+  --action=online \
+  --env_id=<env-id> \
+  --api_ids=<api-id-from-trigger-response>
+```
+
+If no APIG instance is available, use TIMER trigger for function testing instead.

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md

@@ -0,0 +1,142 @@
+# Triggers
+
+**Always run `hcloud FunctionGraph CreateFunctionTrigger --help` first** for exact parameter names and requirements.
+
+## KooCLI event_data Format (CRITICAL)
+
+KooCLI uses **dotted key-value format**, NOT JSON strings:
+
+```bash
+# CORRECT
+--event_data.name=my-api --event_data.auth=IAM --event_data.path=/test
+
+# WRONG — will fail
+--event_data='{"name":"my-api","auth":"IAM","path":"/test"}'
+```
+
+## Trigger Types
+
+| Type | `--trigger_type_code` | Notes |
+|------|----------------------|-------|
+| APIG Dedicated | `DEDICATEDGATEWAY` | Use this, not `APIG` (deprecated). Requires APIG instance. |
+| Timer / Cron | `TIMER` | Simplest trigger for testing. No APIG dependency. |
+| OBS | `OBS` | Event when objects created/deleted in bucket |
+| SMN | `SMN` | Message notification trigger |
+
+## TIMER Trigger (Simple Testing)
+
+The TIMER trigger is the easiest path for verifying a function works — no APIG instance needed:
+
+```bash
+hcloud FunctionGraph CreateFunctionTrigger \
+  --function_urn=<urn> \
+  --trigger_type_code=TIMER \
+  --event_type_code=MessageCreated \
+  --trigger_status=ACTIVE \
+  --event_data.name=<trigger-name> \
+  --event_data.schedule_type=Rate \
+  --event_data.schedule="1m"
+```
+
+## DEDICATEDGATEWAY Trigger (HTTP Access)
+
+`trigger_type_code=APIG` is **deprecated**. Use `DEDICATEDGATEWAY` for KooCLI 7.x.
+
+### Required Parameters (Hidden Optional)
+
+These are labeled optional by `--help` but are **required** for DEDICATEDGATEWAY:
+
+| Param | Note |
+|-------|------|
+| `--event_data.protocol` | `HTTPS` or `HTTP` or `BOTH` |
+| `--event_data.sl_domain` | Subdomain from APIG instance (e.g. `xxxx.apic.<region>.huaweicloudapis.com`) |
+| `--event_data.env_name` | API environment name (`RELEASE`) |
+| `--event_data.env_id` | API environment ID |
+| `--event_data.instance_id` | APIG dedicated instance ID |
+| `--event_data.group_id` | API group ID |
+| `--event_data.name` | API name — **hyphens (`-`) are DISALLOWED**. Use underscores (`_`) instead. |
+
+### Error Mapping
+
+| Error | Root Cause → Fix |
+|-------|-----------------|
+| FSS.1417 | Missing `instance_id`, `group_id`, `protocol`, `env_name`, or `env_id`. These are labeled optional but REQUIRED. |
+| API name regex fail | Rename API — remove hyphens (`-`), use `[a-zA-Z0-9_]+` only. |
+
+### Example
+
+```bash
+hcloud FunctionGraph CreateFunctionTrigger \
+  --function_urn=<urn> \
+  --trigger_type_code=DEDICATEDGATEWAY \
+  --event_type_code=APICreated \
+  --trigger_status=ACTIVE \
+  --event_data.name=<api-name-no-hyphens> \
+  --event_data.auth=IAM \
+  --event_data.path=/my-backend \
+  --event_data.match_mode=SWA \
+  --event_data.type=1 \
+  --event_data.protocol=HTTPS \
+  --event_data.req_method=ANY \
+  --event_data.func_info.timeout=5000 \
+  --event_data.instance_id=<apig-instance-id> \
+  --event_data.group_id=<api-group-id> \
+  --event_data.sl_domain=<sl-domain> \
+  --event_data.env_name=RELEASE \
+  --event_data.env_id=<env-id>
+```
+
+After trigger creation, you must **publish** the API before it's accessible:
+
+```bash
+hcloud APIG BatchPublishOrOfflineApiV2 \
+  --instance_id=<apig-instance-id> \
+  --action=online \
+  --env_id=<env-id> \
+  --api_ids=<api-id-from-trigger-response>
+```
+
+### Alternative: --cli-jsonInput (Recommended for Complex Configs)
+
+For trigger configs with many nested fields, use `--cli-jsonInput` to avoid shell escaping issues:
+
+```bash
+cat > trigger.json << 'EOF'
+{
+  "trigger_type_code": "DEDICATEDGATEWAY",
+  "trigger_status": "ACTIVE",
+  "event_type_code": "APICreated",
+  "event_data": {
+    "name": "my-api",
+    "auth": "IAM",
+    "path": "/my-backend",
+    "match_mode": "SWA",
+    "type": 1,
+    "protocol": "HTTPS",
+    "req_method": "ANY",
+    "func_info": { "timeout": 5000 },
+    "instance_id": "<apig-instance-id>",
+    "group_id": "<api-group-id>",
+    "sl_domain": "<sl-domain>",
+    "env_name": "RELEASE",
+    "env_id": "<env-id>"
+  }
+}
+EOF
+hcloud FunctionGraph CreateFunctionTrigger \
+  --function_urn=<urn> \
+  --cli-region=<region> \
+  --project_id=<project_id> \
+  --cli-jsonInput=trigger.json
+```
+
+## List / Delete Triggers
+
+```bash
+hcloud FunctionGraph ListFunctionTriggers --function_urn=<urn>
+hcloud FunctionGraph DeleteFunctionTrigger --function_urn=<urn> --trigger_type_code=<type> --trigger_id=<id>
+```
+
+> Deleting a trigger does NOT cascade-delete the associated APIG API. After `DeleteFunctionTrigger`, also run `hcloud APIG ListApisV2 --instance_id=<id>` and delete orphaned APIs to avoid resource residue.
+
+> **APIG event format**: When using DEDICATEDGATEWAY, the event body is Base64 encoded and uses a non-standard structure. See `apig-event-format.md` for handler templates.

package/plugins/huaweicloud-core/skills/huawei-gaussdb/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: huawei-gaussdb
+description: "Use when creating or managing GaussDB distributed database on Huawei Cloud. Covers GaussDB(for MySQL), GaussDB(for openGauss), sharding, HTAP. Triggers: GaussDB, distributed database, sharding, openGauss, HTAP. NOT for: single RDS (use huawei-rds)."
+version: 1
+---
+
+# Huawei Cloud GaussDB
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud GaussDB <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for GaussDB. Covers instance lifecycle, databases, backups, configurations, and shard/readonly node management.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Shard key permanent | Once set, shard key cannot be changed |
+| Minimum nodes | Distributed GaussDB requires at least 3 nodes for production |
+| Engine version pinned | MySQL-compatible vs openGauss are separate products |
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Show instance | `ShowInstance --cli-region=<r> --project_id=<p>` |
+| List flavors | `ListFlavors --cli-region=<r> --project_id=<p>` |
+| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
+| Create backup | `CreateGaussMySqlBackup --cli-region=<r> --project_id=<p>` |
+| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
+| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
+| Manage database | `AddDatabasePermission --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Instance creation fails | Check VPC/subnet availability and flavor capacity |
+| Connection refused | SG missing database port |
+
+## Security
+
+- MUST use security groups for database access
+- MUST enable SSL for connections
+
+## Cross-Skill References
+
+- **VPC/Subnet/Security Group**: See `huawei-vpc`
+- **Backup/CBR**: See `huawei-cbr`

package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: huawei-getting-started
+description: "Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.)."
+version: 1
+---
+
+# Huawei Cloud Getting Started
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## KooCLI Installation
+
+| OS | Command |
+|----|---------|
+| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
+| Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+| macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+
+## First-Time Setup
+1. **Install KooCLI** using command above
+2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` and respond `y` to the prompt. For non-interactive terminals, use `echo "y" | hcloud version`
+3. **Configure credentials**: `hcloud configure init` (interactive, prompts for AK/SK/region safely)
+4. **Verify**: `hcloud configure list` to confirm profile, then `hcloud ECS ListServersDetails --cli-region=cn-north-4`
+5. For detailed auth guidance, see `huaweicloud-cli-and-auth` skill
+
+> **Security**: Never pass AK/SK as command-line arguments (`--ak=...`). Always use `hcloud configure init` (interactive) or `hcloud configure set` with cached profile to avoid secrets in shell history.
+
+### Non-Interactive Setup (Agent/CI Environments)
+
+When the interactive TUI is unavailable (Agent tools, CI/CD), use `hcloud configure set` — this must be run outside agent chat by the user:
+
+```bash
+# User executes in their terminal (NOT in agent chat):
+hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>
+
+# Agent verifies:
+hcloud configure list
+```
+
+## Critical Warnings
+| Trap | Why |
+|------|-----|
+| AK/SK must be kept secret | Never commit to git or share |
+| Default region applies to all commands | Override with --cli-region= per command |
+| Some services region-specific | Not all services available in all regions |
+| Privacy policy blocks first run | KooCLI requires one-time `y` confirmation. Non-interactive terminals need `echo "y" \| hcloud <cmd>` |
+
+## What Can I Do? (Quick Index)
+| Goal | Skill |
+|------|-------|
+| Create a VM | huawei-ecs |
+| Store files | huawei-obs |
+| Set up a database | huawei-rds / huawei-gaussdb |
+| Create a network | huawei-vpc |
+| Manage access | huawei-iam |
+| Deploy an app | huawei-deployment |
+| Run containers | huawei-cce |
+| Build an API | huawei-apig |
+| Run serverless | huawei-functiongraph |
+| Monitor resources | huawei-cloud-eye |
+
+## Pro Tips
+- Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
+- Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
+- Pipe sensitive output through IAM with `--cli-output-format=json`

package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: huawei-iam
+description: "Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew)."
+version: 1
+---
+
+# Huawei Cloud IAM
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers user/group/role lifecycle, policy design, temporary credentials, and security best practices.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
+| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
+| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
+| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
+| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
+
+## Policy Structure
+
+`json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ecs:*"],
+    "Resource": ["*"],
+    "Condition": {
+      "StringEquals": {"g:SourceVpc": "vpc-xxx"}
+    }
+  }]
+}
+`
+
+## Common Workflows
+
+| Task | Command | Steps |
+|------|---------|-------|
+| List users | hcloud IAM ListUsers | references/iam-ops.md |
+| Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
+| Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
+| Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
+| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
+| Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
+
+## Policy Examples (Least Privilege)
+
+| Role | Actions | Resource |
+|------|---------|----------|
+| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
+| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:*:*:bucket:my-bucket |
+| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
+
+> See `references/policy-examples.md` for complete policy JSON templates with conditions.
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
+| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
+| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
+| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
+
+## Security Considerations
+
+- MUST NOT create IAM users. Use OneAccess or federated SSO
+- MUST NOT create long-term AK/SK. Use STS temporary tokens
+- MUST scope Resource ARNs. Never use wildcard *
+- MUST add conditions to trust policies (g:SourceAccount, g:SourceUrn)
+- SHOULD rotate credentials every 90 days
+
+## Agencies (Cross-Service Delegation)
+
+Agencies allow one service to act on behalf of another. Common use cases:
+
+### FunctionGraph Agency (VPC Access)
+
+FunctionGraph needs an agency to access VPC resources (RDS, DCS, etc.):
+
+```bash
+# 1. Create agency with FunctionGraph trust
+hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
+
+# 2. Attach VPC Administrator role
+hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
+
+# 3. Use in CreateFunction
+hcloud FunctionGraph CreateFunction ... --app_xrole=<agency-name>
+```
+
+Common roles for FunctionGraph: VPC Administrator, RDS Administrator, DCS Administrator.
+
+## MCP Tools
+
+- huaweicloud_list_operations service=IAM
+- huaweicloud_run_readonly_command for user/policy discovery
+
+## References
+
+- IAM Docs: https://support.huaweicloud.com/iam/
+- Policy examples: references/policy-examples.md
+- Agency setup: references/agency.md

package/plugins/huaweicloud-core/skills/huawei-iam/references/policy-examples.md

@@ -0,0 +1,122 @@
+# IAM Policy Examples
+
+## Huawei Cloud IAM Policy Format
+
+Huawei Cloud IAM uses a different action naming convention from AWS. Actions use lowercase service prefixes:
+
+```
+<service>:<resource>:<action>
+```
+
+Examples:
+- `ecs:servers:list` (NOT `ecs:ListInstances`)
+- `obs:bucket:GetBucket` (NOT `s3:GetBucket`)
+- `vpc:vpcs:list` (NOT `vpc:DescribeVpcs`)
+
+Always verify exact action names via `https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html` or KooCLI `--help`.
+
+## Read-Only Policies
+
+### ECS Read-Only
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ecs:servers:list", "ecs:servers:get", "ecs:*:list", "ecs:*:get"],
+    "Resource": ["*"]
+  }]
+}
+```
+
+### OBS Read-Only (scoped bucket)
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["obs:bucket:Get*", "obs:bucket:List*", "obs:object:Get*"],
+    "Resource": ["obs:*:*:bucket:my-bucket", "obs:*:*:bucket:my-bucket/*"]
+  }]
+}
+```
+
+### FunctionGraph Read-Only
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["functiongraph:function:getConfig", "functiongraph:function:list", "functiongraph:function:invoke", "functiongraph:trigger:list"],
+    "Resource": ["*"]
+  }]
+}
+```
+
+## Full-Access (Scoped)
+
+### RDS Operator
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["rds:*"],
+    "Resource": ["*"],
+    "Condition": {"StringEquals": {"g:ResourceTag/Environment": ["dev", "staging"]}}
+  }]
+}
+```
+
+### FunctionGraph Developer
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["functiongraph:function:*", "functiongraph:trigger:*", "functiongraph:runtime:list"],
+    "Resource": ["*"]
+  }]
+}
+```
+
+### APIG Operator
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["apig:instance:*", "apig:api:*", "apig:group:*", "apig:environment:*"],
+    "Resource": ["*"]
+  }]
+}
+```
+
+## Best Practices
+
+1. **Least privilege**: Start with empty policy, add only needed actions
+2. **No `*` wildcard on Resource**: Scope to specific resources or use tag conditions
+3. **Use Condition keys**: `g:RequestedRegion`, `g:ResourceTag`, `g:CurrentTime` for context-aware policies
+4. **Separate policies per role**: Don't combine read and write in one policy
+
+## Confused Deputy Protection
+
+```json
+{
+  "Version": "1.1",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ecs:*"],
+    "Resource": ["*"],
+    "Condition": {
+      "StringEquals": {"g:SourceAccount": "0123456789"},
+      "StringLike": {"g:SourceUrn": "urn:fss:*"}
+    }
+  }]
+}
+```
+
+## References
+
+- IAM Action Reference: https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
+- Policy Syntax: https://support.huaweicloud.com/usermanual-iam/iam_01_0602.html

package/plugins/huaweicloud-core/skills/huawei-iam/references/quick-ref.md

@@ -0,0 +1,56 @@
+# IAM Quick Reference
+
+## Common Operations
+
+```bash
+hcloud IAM KeystoneListProjects                  # list projects
+hcloud IAM KeystoneListUsers                     # list users
+hcloud IAM KeystoneListGroups                    # list groups
+hcloud IAM ListCustomPolicies                    # list custom policies
+hcloud IAM ListAgencies                          # list agencies
+hcloud IAM KeystoneListAuthDomains               # list domains
+hcloud IAM KeystoneShowUser                      # show user detail
+```
+
+## Credential Management
+
+```bash
+hcloud IAM KeystoneListAccessKeys --user_id=<id> # list AK/SK for user
+hcloud IAM CreateLoginToken                      # create login token
+hcloud IAM GetAccountSummary                     # account summary
+```
+
+## Security Best Practices
+
+1. **NEVER create IAM users** — use IAM Identity Center or temporary STS tokens
+2. **NEVER create long-term AK/SK** — use temporary credentials
+3. **Least privilege by default** — start empty, add only needed actions
+4. **Scope resources** — no `*` wildcards on Resource
+5. **Use condition keys** — `g:RequestedRegion`, `g:ResourceTag`, `g:CurrentTime`
+6. **Rotate AK/SK every 90 days** — or use agency delegation
+
+## IAM vs AWS Comparison
+
+| AWS | Huawei Cloud |
+|-----|-------------|
+| `iam:ListUsers` | `iam:users:list` (lowercase + colon) |
+| AWS Managed Policy | System Policy (系统策略) |
+| Customer Managed | Custom Policy (自定义策略) |
+| Resource-Based Policy | Project-Level Policy (项目级策略) |
+| IAM Role | Agency (委托) |
+
+> Huawei Cloud IAM action naming: `<service>:<resource>:<action>`. Always verify at https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
+
+## Confused Deputy Protection
+
+```json
+{
+  "Effect": "Allow",
+  "Action": ["ecs:*"],
+  "Resource": ["*"],
+  "Condition": {
+    "StringEquals": {"g:SourceAccount": "<account-id>"},
+    "StringLike": {"g:SourceUrn": "urn:fss:*"}
+  }
+}
+```