huaweicloud-devkit 1.0.2-next.6 → 1.0.2-next.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.agents/plugins/marketplace.json +18 -18
- package/LICENSE +201 -201
- package/README.md +16 -1
- package/README.zh-CN.md +16 -1
- package/bin/setup.cjs +5 -3
- package/integrations/opencode/opencode.json +1 -4
- package/package.json +15 -3
- package/plugins/huaweicloud-core/.claude-plugin/plugin.json +3 -16
- package/plugins/huaweicloud-core/.codex-plugin/plugin.json +3 -16
- package/plugins/huaweicloud-core/.cursor-plugin/plugin.json +3 -16
- package/plugins/huaweicloud-core/.mcp.json +1 -3
- package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json +3 -16
- package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py +136 -136
- package/plugins/huaweicloud-core/safety/policy.json +75 -100
- package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json +41 -13
- package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md +34 -34
- package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md +18 -18
- package/plugins/huaweicloud-core/skills/huawei-cbr/SKILL.md +19 -19
- package/plugins/huaweicloud-core/skills/huawei-cce/SKILL.md +32 -32
- package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md +30 -30
- package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/SKILL.md +12 -11
- package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/scripts/search-skills.mjs +64 -17
- package/plugins/huaweicloud-core/skills/huawei-cts/SKILL.md +20 -20
- package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md +31 -31
- package/plugins/huaweicloud-core/skills/huawei-deployment/SKILL.md +20 -20
- package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md +39 -30
- package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md +8 -1
- package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md +6 -0
- package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md +39 -36
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md +15 -4
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md +11 -9
- package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md +13 -13
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md +40 -39
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md +12 -10
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md +21 -20
- package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md +19 -19
- package/plugins/huaweicloud-core/skills/huawei-gaussdb/SKILL.md +20 -20
- package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md +27 -23
- package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md +27 -27
- package/plugins/huaweicloud-core/skills/huawei-iam/references/policy-examples.md +65 -39
- package/plugins/huaweicloud-core/skills/huawei-iam/references/quick-ref.md +9 -9
- package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md +25 -25
- package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md +44 -44
- package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-create.md +19 -19
- package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-lifecycle.md +12 -7
- package/plugins/huaweicloud-core/skills/huawei-obs/references/common-pitfalls.md +13 -12
- package/plugins/huaweicloud-core/skills/huawei-obs/references/single-file-share.md +4 -4
- package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md +63 -58
- package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md +39 -39
- package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md +26 -26
- package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md +39 -39
- package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md +13 -12
- package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md +20 -19
- package/plugins/huaweicloud-core/skills/huawei-vpc/references/subnet.md +15 -15
- package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md +18 -18
- package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/SKILL.md +13 -13
- package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml +3 -3
- package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md +6 -1
- package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml +3 -3
- package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md +11 -1
- package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/agents/openai.yaml +3 -3
- package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md +53 -53
- package/plugins/huaweicloud-core/skills/huaweicloud-core/agents/openai.yaml +3 -3
- package/plugins/huaweicloud-core/skills/huaweicloud-core/references/report-issue.md +6 -6
- package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md +3 -1
- package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md +0 -1
- package/plugins/huaweicloud-core/skills/huaweicloud-safety/agents/openai.yaml +3 -3
- package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md +33 -33
- package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/agents/openai.yaml +3 -3
- package/plugins/huaweicloud-core/src/auth/agent-registration.mjs +39 -4
- package/plugins/huaweicloud-core/src/auth/credentials.mjs +12 -4
- package/plugins/huaweicloud-core/src/auth/service.mjs +1 -1
- package/plugins/huaweicloud-core/src/data/icons-manifest.v1.json +3517 -0
- package/plugins/huaweicloud-core/src/hcloud-cli.mjs +16 -7
- package/plugins/huaweicloud-core/src/icon-library.mjs +171 -0
- package/plugins/huaweicloud-core/src/mcp-server.mjs +0 -1
- package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs +10 -102
- package/plugins/huaweicloud-core/src/proxy/proxy-config.mjs +4 -1
- package/plugins/huaweicloud-core/src/risk-rule-engine.mjs +4 -1
- package/plugins/huaweicloud-core/src/safety-policy.mjs +122 -68
- package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs +2 -7
- package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs +10 -22
- package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs +32 -11
- package/plugins/huaweicloud-core/src/search-market.mjs +46 -12
- package/plugins/huaweicloud-core/src/setup-cli.mjs +743 -168
- package/plugins/huaweicloud-core/src/tools.mjs +427 -114
- package/plugins/huaweicloud-core/src/ws-exec/hwlink-exec-client.js +54 -34
- package/plugins/huaweicloud-core/src/ws-exec/hwlink-fair-queue.js +1 -5
- package/plugins/huaweicloud-core/src/ws-exec/hwlink-multiplexer.js +3 -15
- package/plugins/huaweicloud-core/src/ws-exec/hwlink-packet.js +3 -16
- package/plugins/huaweicloud-core/src/ws-exec/hwlink-terminal-channel.js +37 -31
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: huawei-gaussdb
|
|
3
|
-
description:
|
|
3
|
+
description: 'Use when creating or managing GaussDB distributed database on Huawei Cloud. Covers GaussDB(for MySQL), GaussDB(for openGauss), sharding, HTAP. Triggers: GaussDB, distributed database, sharding, openGauss, HTAP. NOT for: single RDS (use huawei-rds).'
|
|
4
4
|
version: 1
|
|
5
5
|
---
|
|
6
6
|
|
|
@@ -16,34 +16,34 @@ Domain expertise for GaussDB. Covers instance lifecycle, databases, backups, con
|
|
|
16
16
|
|
|
17
17
|
## Critical Warnings
|
|
18
18
|
|
|
19
|
-
| Trap
|
|
20
|
-
|
|
21
|
-
| Shard key permanent
|
|
22
|
-
| Minimum nodes
|
|
23
|
-
| Engine version pinned | MySQL-compatible vs openGauss are separate products
|
|
19
|
+
| Trap | Why |
|
|
20
|
+
| --------------------- | ------------------------------------------------------------ |
|
|
21
|
+
| Shard key permanent | Once set, shard key cannot be changed |
|
|
22
|
+
| Minimum nodes | Distributed GaussDB requires at least 3 nodes for production |
|
|
23
|
+
| Engine version pinned | MySQL-compatible vs openGauss are separate products |
|
|
24
24
|
|
|
25
25
|
## Common Workflows
|
|
26
26
|
|
|
27
|
-
| Task
|
|
28
|
-
|
|
29
|
-
| List instances
|
|
30
|
-
| Show instance
|
|
31
|
-
| List flavors
|
|
32
|
-
| Create instance
|
|
33
|
-
| Delete instance
|
|
34
|
-
| Create backup
|
|
35
|
-
| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>`
|
|
36
|
-
| Add shard
|
|
37
|
-
| Manage database
|
|
27
|
+
| Task | Operation |
|
|
28
|
+
| ----------------- | ---------------------------------------------------------- |
|
|
29
|
+
| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
|
|
30
|
+
| Show instance | `ShowInstance --cli-region=<r> --project_id=<p>` |
|
|
31
|
+
| List flavors | `ListFlavors --cli-region=<r> --project_id=<p>` |
|
|
32
|
+
| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
|
|
33
|
+
| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
|
|
34
|
+
| Create backup | `CreateGaussMySqlBackup --cli-region=<r> --project_id=<p>` |
|
|
35
|
+
| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
|
|
36
|
+
| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
|
|
37
|
+
| Manage database | `AddDatabasePermission --cli-region=<r> --project_id=<p>` |
|
|
38
38
|
|
|
39
39
|
Discover exact parameters with `--help` before executing any command.
|
|
40
40
|
|
|
41
41
|
## Troubleshooting
|
|
42
42
|
|
|
43
|
-
| Error
|
|
44
|
-
|
|
43
|
+
| Error | Fix |
|
|
44
|
+
| ----------------------- | ------------------------------------------------- |
|
|
45
45
|
| Instance creation fails | Check VPC/subnet availability and flavor capacity |
|
|
46
|
-
| Connection refused
|
|
46
|
+
| Connection refused | SG missing database port |
|
|
47
47
|
|
|
48
48
|
## Security
|
|
49
49
|
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: huawei-getting-started
|
|
3
|
-
description:
|
|
3
|
+
description: 'Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.).'
|
|
4
4
|
version: 1
|
|
5
5
|
---
|
|
6
6
|
|
|
@@ -10,13 +10,14 @@ version: 1
|
|
|
10
10
|
|
|
11
11
|
## KooCLI Installation
|
|
12
12
|
|
|
13
|
-
| OS
|
|
14
|
-
|
|
15
|
-
| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download
|
|
16
|
-
| Linux
|
|
17
|
-
| macOS
|
|
13
|
+
| OS | Command |
|
|
14
|
+
| -------------------- | --------------------------------------------------------------------------------------------------------------------- |
|
|
15
|
+
| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
|
|
16
|
+
| Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
|
|
17
|
+
| macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
|
|
18
18
|
|
|
19
19
|
## First-Time Setup
|
|
20
|
+
|
|
20
21
|
1. **Install KooCLI** using command above
|
|
21
22
|
2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` to read the agreement, then respond `y` to accept. Do not pipe `echo "y" |` — you must review the terms first.
|
|
22
23
|
3. **Configure credentials (unified)**: `npx huaweicloud-devkit auth init` — prefer this over `hcloud configure init`, which only covers KooCLI.
|
|
@@ -38,28 +39,31 @@ hcloud configure list
|
|
|
38
39
|
```
|
|
39
40
|
|
|
40
41
|
## Critical Warnings
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
|
44
|
-
|
|
|
45
|
-
|
|
|
46
|
-
|
|
|
42
|
+
|
|
43
|
+
| Trap | Why |
|
|
44
|
+
| -------------------------------------- | --------------------------------------------------------------------------------------------- |
|
|
45
|
+
| AK/SK must be kept secret | Never commit to git or share |
|
|
46
|
+
| Default region applies to all commands | Override with --cli-region= per command |
|
|
47
|
+
| Some services region-specific | Not all services available in all regions |
|
|
48
|
+
| Privacy policy blocks first run | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
|
|
47
49
|
|
|
48
50
|
## What Can I Do? (Quick Index)
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
|
52
|
-
|
|
|
51
|
+
|
|
52
|
+
| Goal | Skill |
|
|
53
|
+
| ----------------- | --------------------------- |
|
|
54
|
+
| Create a VM | huawei-ecs |
|
|
55
|
+
| Store files | huawei-obs |
|
|
53
56
|
| Set up a database | huawei-rds / huawei-gaussdb |
|
|
54
|
-
| Create a network
|
|
55
|
-
| Manage access
|
|
56
|
-
| Deploy an app
|
|
57
|
-
| Run containers
|
|
58
|
-
| Build an API
|
|
59
|
-
| Run serverless
|
|
60
|
-
| Monitor resources | huawei-cloud-eye
|
|
57
|
+
| Create a network | huawei-vpc |
|
|
58
|
+
| Manage access | huawei-iam |
|
|
59
|
+
| Deploy an app | huawei-deployment |
|
|
60
|
+
| Run containers | huawei-cce |
|
|
61
|
+
| Build an API | huawei-apig |
|
|
62
|
+
| Run serverless | huawei-functiongraph |
|
|
63
|
+
| Monitor resources | huawei-cloud-eye |
|
|
61
64
|
|
|
62
65
|
## Pro Tips
|
|
66
|
+
|
|
63
67
|
- Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
|
|
64
68
|
- Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
|
|
65
69
|
- Pipe sensitive output through IAM with `--cli-output-format=json`
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: huawei-iam
|
|
3
|
-
description:
|
|
3
|
+
description: 'Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew).'
|
|
4
4
|
version: 1
|
|
5
5
|
---
|
|
6
6
|
|
|
@@ -16,13 +16,13 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
|
|
|
16
16
|
|
|
17
17
|
## Critical Warnings
|
|
18
18
|
|
|
19
|
-
| Trap
|
|
20
|
-
|
|
21
|
-
| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO
|
|
22
|
-
| NEVER create long-term AK/SK
|
|
23
|
-
| Wildcard policies dangerous
|
|
24
|
-
| Agency trust is powerful
|
|
25
|
-
| Root account must have MFA
|
|
19
|
+
| Trap | Why |
|
|
20
|
+
| --------------------------------- | --------------------------------------------------------------- |
|
|
21
|
+
| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
|
|
22
|
+
| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
|
|
23
|
+
| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
|
|
24
|
+
| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
|
|
25
|
+
| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
|
|
26
26
|
|
|
27
27
|
## Policy Structure
|
|
28
28
|
|
|
@@ -42,33 +42,33 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
|
|
|
42
42
|
|
|
43
43
|
## Common Workflows
|
|
44
44
|
|
|
45
|
-
| Task
|
|
46
|
-
|
|
47
|
-
| List users
|
|
48
|
-
| Create group
|
|
49
|
-
| Create custom policy
|
|
50
|
-
| Create agency
|
|
51
|
-
| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600
|
|
52
|
-
| Attach policy
|
|
45
|
+
| Task | Command | Steps |
|
|
46
|
+
| ------------------------ | ---------------------------------------------------------------------------------------------- | ----------------------------- |
|
|
47
|
+
| List users | hcloud IAM ListUsers | references/iam-ops.md |
|
|
48
|
+
| Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
|
|
49
|
+
| Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
|
|
50
|
+
| Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
|
|
51
|
+
| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
|
|
52
|
+
| Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
|
|
53
53
|
|
|
54
54
|
## Policy Examples (Least Privilege)
|
|
55
55
|
|
|
56
|
-
| Role
|
|
57
|
-
|
|
58
|
-
| ECS Reader
|
|
59
|
-
| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List*
|
|
60
|
-
| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:*
|
|
56
|
+
| Role | Actions | Resource |
|
|
57
|
+
| ------------------- | ------------------------------------------------------- | ------------------------ |
|
|
58
|
+
| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
|
|
59
|
+
| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:_:_:bucket:my-bucket |
|
|
60
|
+
| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
|
|
61
61
|
|
|
62
62
|
> See `references/policy-examples.md` for complete policy JSON templates with conditions.
|
|
63
63
|
|
|
64
64
|
## Troubleshooting
|
|
65
65
|
|
|
66
|
-
| Error
|
|
67
|
-
|
|
68
|
-
| AccessDenied
|
|
69
|
-
| AuthFailure
|
|
70
|
-
| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition
|
|
71
|
-
| Quota exceeded
|
|
66
|
+
| Error | Root Cause -> Fix |
|
|
67
|
+
| ------------------- | ---------------------------------------------------------------------- |
|
|
68
|
+
| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
|
|
69
|
+
| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
|
|
70
|
+
| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
|
|
71
|
+
| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
|
|
72
72
|
|
|
73
73
|
## Security Considerations
|
|
74
74
|
|
|
@@ -9,6 +9,7 @@ Huawei Cloud IAM uses a different action naming convention from AWS. Actions use
|
|
|
9
9
|
```
|
|
10
10
|
|
|
11
11
|
Examples:
|
|
12
|
+
|
|
12
13
|
- `ecs:servers:list` (NOT `ecs:ListInstances`)
|
|
13
14
|
- `obs:bucket:GetBucket` (NOT `s3:GetBucket`)
|
|
14
15
|
- `vpc:vpcs:list` (NOT `vpc:DescribeVpcs`)
|
|
@@ -18,77 +19,100 @@ Always verify exact action names via `https://support.huaweicloud.com/usermanual
|
|
|
18
19
|
## Read-Only Policies
|
|
19
20
|
|
|
20
21
|
### ECS Read-Only
|
|
22
|
+
|
|
21
23
|
```json
|
|
22
24
|
{
|
|
23
25
|
"Version": "1.1",
|
|
24
|
-
"Statement": [
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
26
|
+
"Statement": [
|
|
27
|
+
{
|
|
28
|
+
"Effect": "Allow",
|
|
29
|
+
"Action": ["ecs:servers:list", "ecs:servers:get", "ecs:*:list", "ecs:*:get"],
|
|
30
|
+
"Resource": ["*"]
|
|
31
|
+
}
|
|
32
|
+
]
|
|
29
33
|
}
|
|
30
34
|
```
|
|
31
35
|
|
|
32
36
|
### OBS Read-Only (scoped bucket)
|
|
37
|
+
|
|
33
38
|
```json
|
|
34
39
|
{
|
|
35
40
|
"Version": "1.1",
|
|
36
|
-
"Statement": [
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
+
"Statement": [
|
|
42
|
+
{
|
|
43
|
+
"Effect": "Allow",
|
|
44
|
+
"Action": ["obs:bucket:Get*", "obs:bucket:List*", "obs:object:Get*"],
|
|
45
|
+
"Resource": ["obs:*:*:bucket:my-bucket", "obs:*:*:bucket:my-bucket/*"]
|
|
46
|
+
}
|
|
47
|
+
]
|
|
41
48
|
}
|
|
42
49
|
```
|
|
43
50
|
|
|
44
51
|
### FunctionGraph Read-Only
|
|
52
|
+
|
|
45
53
|
```json
|
|
46
54
|
{
|
|
47
55
|
"Version": "1.1",
|
|
48
|
-
"Statement": [
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
56
|
+
"Statement": [
|
|
57
|
+
{
|
|
58
|
+
"Effect": "Allow",
|
|
59
|
+
"Action": [
|
|
60
|
+
"functiongraph:function:getConfig",
|
|
61
|
+
"functiongraph:function:list",
|
|
62
|
+
"functiongraph:function:invoke",
|
|
63
|
+
"functiongraph:trigger:list"
|
|
64
|
+
],
|
|
65
|
+
"Resource": ["*"]
|
|
66
|
+
}
|
|
67
|
+
]
|
|
53
68
|
}
|
|
54
69
|
```
|
|
55
70
|
|
|
56
71
|
## Full-Access (Scoped)
|
|
57
72
|
|
|
58
73
|
### RDS Operator
|
|
74
|
+
|
|
59
75
|
```json
|
|
60
76
|
{
|
|
61
77
|
"Version": "1.1",
|
|
62
|
-
"Statement": [
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
78
|
+
"Statement": [
|
|
79
|
+
{
|
|
80
|
+
"Effect": "Allow",
|
|
81
|
+
"Action": ["rds:*"],
|
|
82
|
+
"Resource": ["*"],
|
|
83
|
+
"Condition": { "StringEquals": { "g:ResourceTag/Environment": ["dev", "staging"] } }
|
|
84
|
+
}
|
|
85
|
+
]
|
|
68
86
|
}
|
|
69
87
|
```
|
|
70
88
|
|
|
71
89
|
### FunctionGraph Developer
|
|
90
|
+
|
|
72
91
|
```json
|
|
73
92
|
{
|
|
74
93
|
"Version": "1.1",
|
|
75
|
-
"Statement": [
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
94
|
+
"Statement": [
|
|
95
|
+
{
|
|
96
|
+
"Effect": "Allow",
|
|
97
|
+
"Action": ["functiongraph:function:*", "functiongraph:trigger:*", "functiongraph:runtime:list"],
|
|
98
|
+
"Resource": ["*"]
|
|
99
|
+
}
|
|
100
|
+
]
|
|
80
101
|
}
|
|
81
102
|
```
|
|
82
103
|
|
|
83
104
|
### APIG Operator
|
|
105
|
+
|
|
84
106
|
```json
|
|
85
107
|
{
|
|
86
108
|
"Version": "1.1",
|
|
87
|
-
"Statement": [
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
109
|
+
"Statement": [
|
|
110
|
+
{
|
|
111
|
+
"Effect": "Allow",
|
|
112
|
+
"Action": ["apig:instance:*", "apig:api:*", "apig:group:*", "apig:environment:*"],
|
|
113
|
+
"Resource": ["*"]
|
|
114
|
+
}
|
|
115
|
+
]
|
|
92
116
|
}
|
|
93
117
|
```
|
|
94
118
|
|
|
@@ -104,15 +128,17 @@ Always verify exact action names via `https://support.huaweicloud.com/usermanual
|
|
|
104
128
|
```json
|
|
105
129
|
{
|
|
106
130
|
"Version": "1.1",
|
|
107
|
-
"Statement": [
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
"
|
|
113
|
-
|
|
131
|
+
"Statement": [
|
|
132
|
+
{
|
|
133
|
+
"Effect": "Allow",
|
|
134
|
+
"Action": ["ecs:*"],
|
|
135
|
+
"Resource": ["*"],
|
|
136
|
+
"Condition": {
|
|
137
|
+
"StringEquals": { "g:SourceAccount": "0123456789" },
|
|
138
|
+
"StringLike": { "g:SourceUrn": "urn:fss:*" }
|
|
139
|
+
}
|
|
114
140
|
}
|
|
115
|
-
|
|
141
|
+
]
|
|
116
142
|
}
|
|
117
143
|
```
|
|
118
144
|
|
|
@@ -31,13 +31,13 @@ hcloud IAM GetAccountSummary # account summary
|
|
|
31
31
|
|
|
32
32
|
## IAM vs AWS Comparison
|
|
33
33
|
|
|
34
|
-
| AWS
|
|
35
|
-
|
|
36
|
-
| `iam:ListUsers`
|
|
37
|
-
| AWS Managed Policy
|
|
38
|
-
| Customer Managed
|
|
39
|
-
| Resource-Based Policy | Project-Level Policy (项目级策略)
|
|
40
|
-
| IAM Role
|
|
34
|
+
| AWS | Huawei Cloud |
|
|
35
|
+
| --------------------- | ------------------------------------ |
|
|
36
|
+
| `iam:ListUsers` | `iam:users:list` (lowercase + colon) |
|
|
37
|
+
| AWS Managed Policy | System Policy (系统策略) |
|
|
38
|
+
| Customer Managed | Custom Policy (自定义策略) |
|
|
39
|
+
| Resource-Based Policy | Project-Level Policy (项目级策略) |
|
|
40
|
+
| IAM Role | Agency (委托) |
|
|
41
41
|
|
|
42
42
|
> Huawei Cloud IAM action naming: `<service>:<resource>:<action>`. Always verify at https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
|
|
43
43
|
|
|
@@ -49,8 +49,8 @@ hcloud IAM GetAccountSummary # account summary
|
|
|
49
49
|
"Action": ["ecs:*"],
|
|
50
50
|
"Resource": ["*"],
|
|
51
51
|
"Condition": {
|
|
52
|
-
"StringEquals": {"g:SourceAccount": "<account-id>"},
|
|
53
|
-
"StringLike": {"g:SourceUrn": "urn:fss:*"}
|
|
52
|
+
"StringEquals": { "g:SourceAccount": "<account-id>" },
|
|
53
|
+
"StringLike": { "g:SourceUrn": "urn:fss:*" }
|
|
54
54
|
}
|
|
55
55
|
}
|
|
56
56
|
```
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: huawei-modelarts
|
|
3
|
-
description:
|
|
3
|
+
description: 'Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms.'
|
|
4
4
|
version: 1
|
|
5
5
|
---
|
|
6
6
|
|
|
@@ -16,13 +16,13 @@ Domain expertise for ModelArts. Covers training jobs, model deployment, notebook
|
|
|
16
16
|
|
|
17
17
|
## Critical Warnings
|
|
18
18
|
|
|
19
|
-
| Trap
|
|
20
|
-
|
|
21
|
-
| OBS bucket required
|
|
22
|
-
| Training charges by duration
|
|
23
|
-
| Notebook auto-stop needed
|
|
24
|
-
| Model deployment needs quota
|
|
25
|
-
| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path
|
|
19
|
+
| Trap | Why |
|
|
20
|
+
| ------------------------------- | ----------------------------------------------------------------------------------- |
|
|
21
|
+
| OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
|
|
22
|
+
| Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
|
|
23
|
+
| Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
|
|
24
|
+
| Model deployment needs quota | Online services may require service quota approval in new accounts |
|
|
25
|
+
| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
|
|
26
26
|
|
|
27
27
|
## Prerequisites
|
|
28
28
|
|
|
@@ -32,31 +32,31 @@ Domain expertise for ModelArts. Covers training jobs, model deployment, notebook
|
|
|
32
32
|
|
|
33
33
|
## Common Workflows
|
|
34
34
|
|
|
35
|
-
| Task
|
|
36
|
-
|
|
37
|
-
| List models
|
|
38
|
-
| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>`
|
|
39
|
-
| List services
|
|
40
|
-
| List notebooks
|
|
41
|
-
| Create model
|
|
42
|
-
| Create notebook
|
|
35
|
+
| Task | Operation |
|
|
36
|
+
| ------------------ | -------------------------------------------------- |
|
|
37
|
+
| List models | `ListModels --cli-region=<r> --project_id=<p>` |
|
|
38
|
+
| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
|
|
39
|
+
| List services | `ListServices --cli-region=<r> --project_id=<p>` |
|
|
40
|
+
| List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
|
|
41
|
+
| Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
|
|
42
|
+
| Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
|
|
43
43
|
|
|
44
44
|
Discover operation parameters with `--help` before executing any write operation.
|
|
45
45
|
|
|
46
46
|
## Service Types
|
|
47
47
|
|
|
48
|
-
| Type
|
|
49
|
-
|
|
50
|
-
| Training Job
|
|
51
|
-
| Model
|
|
52
|
-
| Service (Online) | Deploy models as REST API endpoints
|
|
53
|
-
| Notebook
|
|
48
|
+
| Type | Purpose |
|
|
49
|
+
| ---------------- | --------------------------------------- |
|
|
50
|
+
| Training Job | Train models on GPU/CPU resources |
|
|
51
|
+
| Model | Register trained models for deployment |
|
|
52
|
+
| Service (Online) | Deploy models as REST API endpoints |
|
|
53
|
+
| Notebook | JupyterLab environments for development |
|
|
54
54
|
|
|
55
55
|
## Troubleshooting
|
|
56
56
|
|
|
57
|
-
| Error
|
|
58
|
-
|
|
59
|
-
| OBS path not found | Verify OBS bucket exists and path is correct
|
|
57
|
+
| Error | Fix |
|
|
58
|
+
| ------------------ | ---------------------------------------------------------------- |
|
|
59
|
+
| OBS path not found | Verify OBS bucket exists and path is correct |
|
|
60
60
|
| Training job fails | Check training data format, resource quotas, and logs in console |
|
|
61
61
|
|
|
62
62
|
## Cross-Skill References
|