huaweicloud-devkit 1.0.2-next.6 → 1.0.2-next.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (91) hide show
  1. package/.agents/plugins/marketplace.json +18 -18
  2. package/LICENSE +201 -201
  3. package/README.md +16 -1
  4. package/README.zh-CN.md +16 -1
  5. package/bin/setup.cjs +5 -3
  6. package/integrations/opencode/opencode.json +1 -4
  7. package/package.json +15 -3
  8. package/plugins/huaweicloud-core/.claude-plugin/plugin.json +3 -16
  9. package/plugins/huaweicloud-core/.codex-plugin/plugin.json +3 -16
  10. package/plugins/huaweicloud-core/.cursor-plugin/plugin.json +3 -16
  11. package/plugins/huaweicloud-core/.mcp.json +1 -3
  12. package/plugins/huaweicloud-core/.workbuddy-plugin/plugin.json +3 -16
  13. package/plugins/huaweicloud-core/hooks/huaweicloud-safety.py +136 -136
  14. package/plugins/huaweicloud-core/safety/policy.json +75 -100
  15. package/plugins/huaweicloud-core/safety/rules/cloud-risk-rules.json +41 -13
  16. package/plugins/huaweicloud-core/skills/huawei-apig/SKILL.md +34 -34
  17. package/plugins/huaweicloud-core/skills/huawei-billing/SKILL.md +18 -18
  18. package/plugins/huaweicloud-core/skills/huawei-cbr/SKILL.md +19 -19
  19. package/plugins/huaweicloud-core/skills/huawei-cce/SKILL.md +32 -32
  20. package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md +30 -30
  21. package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/SKILL.md +12 -11
  22. package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/scripts/search-skills.mjs +64 -17
  23. package/plugins/huaweicloud-core/skills/huawei-cts/SKILL.md +20 -20
  24. package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md +31 -31
  25. package/plugins/huaweicloud-core/skills/huawei-deployment/SKILL.md +20 -20
  26. package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md +39 -30
  27. package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md +8 -1
  28. package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md +6 -0
  29. package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md +39 -36
  30. package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md +15 -4
  31. package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md +11 -9
  32. package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md +13 -13
  33. package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md +40 -39
  34. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md +12 -10
  35. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md +21 -20
  36. package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md +19 -19
  37. package/plugins/huaweicloud-core/skills/huawei-gaussdb/SKILL.md +20 -20
  38. package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md +27 -23
  39. package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md +27 -27
  40. package/plugins/huaweicloud-core/skills/huawei-iam/references/policy-examples.md +65 -39
  41. package/plugins/huaweicloud-core/skills/huawei-iam/references/quick-ref.md +9 -9
  42. package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md +25 -25
  43. package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md +44 -44
  44. package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-create.md +19 -19
  45. package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-lifecycle.md +12 -7
  46. package/plugins/huaweicloud-core/skills/huawei-obs/references/common-pitfalls.md +13 -12
  47. package/plugins/huaweicloud-core/skills/huawei-obs/references/single-file-share.md +4 -4
  48. package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md +63 -58
  49. package/plugins/huaweicloud-core/skills/huawei-sandbox/SKILL.md +39 -39
  50. package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md +26 -26
  51. package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md +39 -39
  52. package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md +13 -12
  53. package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md +20 -19
  54. package/plugins/huaweicloud-core/skills/huawei-vpc/references/subnet.md +15 -15
  55. package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md +18 -18
  56. package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/SKILL.md +13 -13
  57. package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml +3 -3
  58. package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md +6 -1
  59. package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml +3 -3
  60. package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md +11 -1
  61. package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/agents/openai.yaml +3 -3
  62. package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md +53 -53
  63. package/plugins/huaweicloud-core/skills/huaweicloud-core/agents/openai.yaml +3 -3
  64. package/plugins/huaweicloud-core/skills/huaweicloud-core/references/report-issue.md +6 -6
  65. package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md +3 -1
  66. package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md +0 -1
  67. package/plugins/huaweicloud-core/skills/huaweicloud-safety/agents/openai.yaml +3 -3
  68. package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md +33 -33
  69. package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/agents/openai.yaml +3 -3
  70. package/plugins/huaweicloud-core/src/auth/agent-registration.mjs +39 -4
  71. package/plugins/huaweicloud-core/src/auth/credentials.mjs +12 -4
  72. package/plugins/huaweicloud-core/src/auth/service.mjs +1 -1
  73. package/plugins/huaweicloud-core/src/data/icons-manifest.v1.json +3517 -0
  74. package/plugins/huaweicloud-core/src/hcloud-cli.mjs +16 -7
  75. package/plugins/huaweicloud-core/src/icon-library.mjs +171 -0
  76. package/plugins/huaweicloud-core/src/mcp-server.mjs +0 -1
  77. package/plugins/huaweicloud-core/src/proxy/proxy-agent.mjs +10 -102
  78. package/plugins/huaweicloud-core/src/proxy/proxy-config.mjs +4 -1
  79. package/plugins/huaweicloud-core/src/risk-rule-engine.mjs +4 -1
  80. package/plugins/huaweicloud-core/src/safety-policy.mjs +122 -68
  81. package/plugins/huaweicloud-core/src/sandbox/hdkitservice-api.mjs +2 -7
  82. package/plugins/huaweicloud-core/src/sandbox/hwlink-api.mjs +10 -22
  83. package/plugins/huaweicloud-core/src/sandbox/session-manager.mjs +32 -11
  84. package/plugins/huaweicloud-core/src/search-market.mjs +46 -12
  85. package/plugins/huaweicloud-core/src/setup-cli.mjs +743 -168
  86. package/plugins/huaweicloud-core/src/tools.mjs +427 -114
  87. package/plugins/huaweicloud-core/src/ws-exec/hwlink-exec-client.js +54 -34
  88. package/plugins/huaweicloud-core/src/ws-exec/hwlink-fair-queue.js +1 -5
  89. package/plugins/huaweicloud-core/src/ws-exec/hwlink-multiplexer.js +3 -15
  90. package/plugins/huaweicloud-core/src/ws-exec/hwlink-packet.js +3 -16
  91. package/plugins/huaweicloud-core/src/ws-exec/hwlink-terminal-channel.js +37 -31
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: huawei-gaussdb
3
- description: "Use when creating or managing GaussDB distributed database on Huawei Cloud. Covers GaussDB(for MySQL), GaussDB(for openGauss), sharding, HTAP. Triggers: GaussDB, distributed database, sharding, openGauss, HTAP. NOT for: single RDS (use huawei-rds)."
3
+ description: 'Use when creating or managing GaussDB distributed database on Huawei Cloud. Covers GaussDB(for MySQL), GaussDB(for openGauss), sharding, HTAP. Triggers: GaussDB, distributed database, sharding, openGauss, HTAP. NOT for: single RDS (use huawei-rds).'
4
4
  version: 1
5
5
  ---
6
6
 
@@ -16,34 +16,34 @@ Domain expertise for GaussDB. Covers instance lifecycle, databases, backups, con
16
16
 
17
17
  ## Critical Warnings
18
18
 
19
- | Trap | Why |
20
- |------|-----|
21
- | Shard key permanent | Once set, shard key cannot be changed |
22
- | Minimum nodes | Distributed GaussDB requires at least 3 nodes for production |
23
- | Engine version pinned | MySQL-compatible vs openGauss are separate products |
19
+ | Trap | Why |
20
+ | --------------------- | ------------------------------------------------------------ |
21
+ | Shard key permanent | Once set, shard key cannot be changed |
22
+ | Minimum nodes | Distributed GaussDB requires at least 3 nodes for production |
23
+ | Engine version pinned | MySQL-compatible vs openGauss are separate products |
24
24
 
25
25
  ## Common Workflows
26
26
 
27
- | Task | Operation |
28
- |------|-----------|
29
- | List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
30
- | Show instance | `ShowInstance --cli-region=<r> --project_id=<p>` |
31
- | List flavors | `ListFlavors --cli-region=<r> --project_id=<p>` |
32
- | Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
33
- | Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
34
- | Create backup | `CreateGaussMySqlBackup --cli-region=<r> --project_id=<p>` |
35
- | Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
36
- | Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
37
- | Manage database | `AddDatabasePermission --cli-region=<r> --project_id=<p>` |
27
+ | Task | Operation |
28
+ | ----------------- | ---------------------------------------------------------- |
29
+ | List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
30
+ | Show instance | `ShowInstance --cli-region=<r> --project_id=<p>` |
31
+ | List flavors | `ListFlavors --cli-region=<r> --project_id=<p>` |
32
+ | Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
33
+ | Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
34
+ | Create backup | `CreateGaussMySqlBackup --cli-region=<r> --project_id=<p>` |
35
+ | Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
36
+ | Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
37
+ | Manage database | `AddDatabasePermission --cli-region=<r> --project_id=<p>` |
38
38
 
39
39
  Discover exact parameters with `--help` before executing any command.
40
40
 
41
41
  ## Troubleshooting
42
42
 
43
- | Error | Fix |
44
- |-------|-----|
43
+ | Error | Fix |
44
+ | ----------------------- | ------------------------------------------------- |
45
45
  | Instance creation fails | Check VPC/subnet availability and flavor capacity |
46
- | Connection refused | SG missing database port |
46
+ | Connection refused | SG missing database port |
47
47
 
48
48
  ## Security
49
49
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: huawei-getting-started
3
- description: "Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.)."
3
+ description: 'Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.).'
4
4
  version: 1
5
5
  ---
6
6
 
@@ -10,13 +10,14 @@ version: 1
10
10
 
11
11
  ## KooCLI Installation
12
12
 
13
- | OS | Command |
14
- |----|---------|
15
- | Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
16
- | Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
17
- | macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
13
+ | OS | Command |
14
+ | -------------------- | --------------------------------------------------------------------------------------------------------------------- |
15
+ | Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
16
+ | Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
17
+ | macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
18
18
 
19
19
  ## First-Time Setup
20
+
20
21
  1. **Install KooCLI** using command above
21
22
  2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` to read the agreement, then respond `y` to accept. Do not pipe `echo "y" |` — you must review the terms first.
22
23
  3. **Configure credentials (unified)**: `npx huaweicloud-devkit auth init` — prefer this over `hcloud configure init`, which only covers KooCLI.
@@ -38,28 +39,31 @@ hcloud configure list
38
39
  ```
39
40
 
40
41
  ## Critical Warnings
41
- | Trap | Why |
42
- |------|-----|
43
- | AK/SK must be kept secret | Never commit to git or share |
44
- | Default region applies to all commands | Override with --cli-region= per command |
45
- | Some services region-specific | Not all services available in all regions |
46
- | Privacy policy blocks first run | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
42
+
43
+ | Trap | Why |
44
+ | -------------------------------------- | --------------------------------------------------------------------------------------------- |
45
+ | AK/SK must be kept secret | Never commit to git or share |
46
+ | Default region applies to all commands | Override with --cli-region= per command |
47
+ | Some services region-specific | Not all services available in all regions |
48
+ | Privacy policy blocks first run | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
47
49
 
48
50
  ## What Can I Do? (Quick Index)
49
- | Goal | Skill |
50
- |------|-------|
51
- | Create a VM | huawei-ecs |
52
- | Store files | huawei-obs |
51
+
52
+ | Goal | Skill |
53
+ | ----------------- | --------------------------- |
54
+ | Create a VM | huawei-ecs |
55
+ | Store files | huawei-obs |
53
56
  | Set up a database | huawei-rds / huawei-gaussdb |
54
- | Create a network | huawei-vpc |
55
- | Manage access | huawei-iam |
56
- | Deploy an app | huawei-deployment |
57
- | Run containers | huawei-cce |
58
- | Build an API | huawei-apig |
59
- | Run serverless | huawei-functiongraph |
60
- | Monitor resources | huawei-cloud-eye |
57
+ | Create a network | huawei-vpc |
58
+ | Manage access | huawei-iam |
59
+ | Deploy an app | huawei-deployment |
60
+ | Run containers | huawei-cce |
61
+ | Build an API | huawei-apig |
62
+ | Run serverless | huawei-functiongraph |
63
+ | Monitor resources | huawei-cloud-eye |
61
64
 
62
65
  ## Pro Tips
66
+
63
67
  - Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
64
68
  - Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
65
69
  - Pipe sensitive output through IAM with `--cli-output-format=json`
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: huawei-iam
3
- description: "Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew)."
3
+ description: 'Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew).'
4
4
  version: 1
5
5
  ---
6
6
 
@@ -16,13 +16,13 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
16
16
 
17
17
  ## Critical Warnings
18
18
 
19
- | Trap | Why |
20
- |------|-----|
21
- | NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
22
- | NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
23
- | Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
24
- | Agency trust is powerful | Agencies let services assume roles. Always add conditions |
25
- | Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
19
+ | Trap | Why |
20
+ | --------------------------------- | --------------------------------------------------------------- |
21
+ | NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
22
+ | NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
23
+ | Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
24
+ | Agency trust is powerful | Agencies let services assume roles. Always add conditions |
25
+ | Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
26
26
 
27
27
  ## Policy Structure
28
28
 
@@ -42,33 +42,33 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
42
42
 
43
43
  ## Common Workflows
44
44
 
45
- | Task | Command | Steps |
46
- |------|---------|-------|
47
- | List users | hcloud IAM ListUsers | references/iam-ops.md |
48
- | Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
49
- | Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
50
- | Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
51
- | Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
52
- | Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
45
+ | Task | Command | Steps |
46
+ | ------------------------ | ---------------------------------------------------------------------------------------------- | ----------------------------- |
47
+ | List users | hcloud IAM ListUsers | references/iam-ops.md |
48
+ | Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
49
+ | Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
50
+ | Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
51
+ | Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
52
+ | Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
53
53
 
54
54
  ## Policy Examples (Least Privilege)
55
55
 
56
- | Role | Actions | Resource |
57
- |------|---------|----------|
58
- | ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
59
- | OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:*:*:bucket:my-bucket |
60
- | RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
56
+ | Role | Actions | Resource |
57
+ | ------------------- | ------------------------------------------------------- | ------------------------ |
58
+ | ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
59
+ | OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:_:_:bucket:my-bucket |
60
+ | RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
61
61
 
62
62
  > See `references/policy-examples.md` for complete policy JSON templates with conditions.
63
63
 
64
64
  ## Troubleshooting
65
65
 
66
- | Error | Root Cause -> Fix |
67
- |-------|------------------|
68
- | AccessDenied | Missing IAM permission -> Check policy action and resource scope |
69
- | AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
70
- | Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
71
- | Quota exceeded | IAM user/group/policy limit -> Request quota increase |
66
+ | Error | Root Cause -> Fix |
67
+ | ------------------- | ---------------------------------------------------------------------- |
68
+ | AccessDenied | Missing IAM permission -> Check policy action and resource scope |
69
+ | AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
70
+ | Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
71
+ | Quota exceeded | IAM user/group/policy limit -> Request quota increase |
72
72
 
73
73
  ## Security Considerations
74
74
 
@@ -9,6 +9,7 @@ Huawei Cloud IAM uses a different action naming convention from AWS. Actions use
9
9
  ```
10
10
 
11
11
  Examples:
12
+
12
13
  - `ecs:servers:list` (NOT `ecs:ListInstances`)
13
14
  - `obs:bucket:GetBucket` (NOT `s3:GetBucket`)
14
15
  - `vpc:vpcs:list` (NOT `vpc:DescribeVpcs`)
@@ -18,77 +19,100 @@ Always verify exact action names via `https://support.huaweicloud.com/usermanual
18
19
  ## Read-Only Policies
19
20
 
20
21
  ### ECS Read-Only
22
+
21
23
  ```json
22
24
  {
23
25
  "Version": "1.1",
24
- "Statement": [{
25
- "Effect": "Allow",
26
- "Action": ["ecs:servers:list", "ecs:servers:get", "ecs:*:list", "ecs:*:get"],
27
- "Resource": ["*"]
28
- }]
26
+ "Statement": [
27
+ {
28
+ "Effect": "Allow",
29
+ "Action": ["ecs:servers:list", "ecs:servers:get", "ecs:*:list", "ecs:*:get"],
30
+ "Resource": ["*"]
31
+ }
32
+ ]
29
33
  }
30
34
  ```
31
35
 
32
36
  ### OBS Read-Only (scoped bucket)
37
+
33
38
  ```json
34
39
  {
35
40
  "Version": "1.1",
36
- "Statement": [{
37
- "Effect": "Allow",
38
- "Action": ["obs:bucket:Get*", "obs:bucket:List*", "obs:object:Get*"],
39
- "Resource": ["obs:*:*:bucket:my-bucket", "obs:*:*:bucket:my-bucket/*"]
40
- }]
41
+ "Statement": [
42
+ {
43
+ "Effect": "Allow",
44
+ "Action": ["obs:bucket:Get*", "obs:bucket:List*", "obs:object:Get*"],
45
+ "Resource": ["obs:*:*:bucket:my-bucket", "obs:*:*:bucket:my-bucket/*"]
46
+ }
47
+ ]
41
48
  }
42
49
  ```
43
50
 
44
51
  ### FunctionGraph Read-Only
52
+
45
53
  ```json
46
54
  {
47
55
  "Version": "1.1",
48
- "Statement": [{
49
- "Effect": "Allow",
50
- "Action": ["functiongraph:function:getConfig", "functiongraph:function:list", "functiongraph:function:invoke", "functiongraph:trigger:list"],
51
- "Resource": ["*"]
52
- }]
56
+ "Statement": [
57
+ {
58
+ "Effect": "Allow",
59
+ "Action": [
60
+ "functiongraph:function:getConfig",
61
+ "functiongraph:function:list",
62
+ "functiongraph:function:invoke",
63
+ "functiongraph:trigger:list"
64
+ ],
65
+ "Resource": ["*"]
66
+ }
67
+ ]
53
68
  }
54
69
  ```
55
70
 
56
71
  ## Full-Access (Scoped)
57
72
 
58
73
  ### RDS Operator
74
+
59
75
  ```json
60
76
  {
61
77
  "Version": "1.1",
62
- "Statement": [{
63
- "Effect": "Allow",
64
- "Action": ["rds:*"],
65
- "Resource": ["*"],
66
- "Condition": {"StringEquals": {"g:ResourceTag/Environment": ["dev", "staging"]}}
67
- }]
78
+ "Statement": [
79
+ {
80
+ "Effect": "Allow",
81
+ "Action": ["rds:*"],
82
+ "Resource": ["*"],
83
+ "Condition": { "StringEquals": { "g:ResourceTag/Environment": ["dev", "staging"] } }
84
+ }
85
+ ]
68
86
  }
69
87
  ```
70
88
 
71
89
  ### FunctionGraph Developer
90
+
72
91
  ```json
73
92
  {
74
93
  "Version": "1.1",
75
- "Statement": [{
76
- "Effect": "Allow",
77
- "Action": ["functiongraph:function:*", "functiongraph:trigger:*", "functiongraph:runtime:list"],
78
- "Resource": ["*"]
79
- }]
94
+ "Statement": [
95
+ {
96
+ "Effect": "Allow",
97
+ "Action": ["functiongraph:function:*", "functiongraph:trigger:*", "functiongraph:runtime:list"],
98
+ "Resource": ["*"]
99
+ }
100
+ ]
80
101
  }
81
102
  ```
82
103
 
83
104
  ### APIG Operator
105
+
84
106
  ```json
85
107
  {
86
108
  "Version": "1.1",
87
- "Statement": [{
88
- "Effect": "Allow",
89
- "Action": ["apig:instance:*", "apig:api:*", "apig:group:*", "apig:environment:*"],
90
- "Resource": ["*"]
91
- }]
109
+ "Statement": [
110
+ {
111
+ "Effect": "Allow",
112
+ "Action": ["apig:instance:*", "apig:api:*", "apig:group:*", "apig:environment:*"],
113
+ "Resource": ["*"]
114
+ }
115
+ ]
92
116
  }
93
117
  ```
94
118
 
@@ -104,15 +128,17 @@ Always verify exact action names via `https://support.huaweicloud.com/usermanual
104
128
  ```json
105
129
  {
106
130
  "Version": "1.1",
107
- "Statement": [{
108
- "Effect": "Allow",
109
- "Action": ["ecs:*"],
110
- "Resource": ["*"],
111
- "Condition": {
112
- "StringEquals": {"g:SourceAccount": "0123456789"},
113
- "StringLike": {"g:SourceUrn": "urn:fss:*"}
131
+ "Statement": [
132
+ {
133
+ "Effect": "Allow",
134
+ "Action": ["ecs:*"],
135
+ "Resource": ["*"],
136
+ "Condition": {
137
+ "StringEquals": { "g:SourceAccount": "0123456789" },
138
+ "StringLike": { "g:SourceUrn": "urn:fss:*" }
139
+ }
114
140
  }
115
- }]
141
+ ]
116
142
  }
117
143
  ```
118
144
 
@@ -31,13 +31,13 @@ hcloud IAM GetAccountSummary # account summary
31
31
 
32
32
  ## IAM vs AWS Comparison
33
33
 
34
- | AWS | Huawei Cloud |
35
- |-----|-------------|
36
- | `iam:ListUsers` | `iam:users:list` (lowercase + colon) |
37
- | AWS Managed Policy | System Policy (系统策略) |
38
- | Customer Managed | Custom Policy (自定义策略) |
39
- | Resource-Based Policy | Project-Level Policy (项目级策略) |
40
- | IAM Role | Agency (委托) |
34
+ | AWS | Huawei Cloud |
35
+ | --------------------- | ------------------------------------ |
36
+ | `iam:ListUsers` | `iam:users:list` (lowercase + colon) |
37
+ | AWS Managed Policy | System Policy (系统策略) |
38
+ | Customer Managed | Custom Policy (自定义策略) |
39
+ | Resource-Based Policy | Project-Level Policy (项目级策略) |
40
+ | IAM Role | Agency (委托) |
41
41
 
42
42
  > Huawei Cloud IAM action naming: `<service>:<resource>:<action>`. Always verify at https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
43
43
 
@@ -49,8 +49,8 @@ hcloud IAM GetAccountSummary # account summary
49
49
  "Action": ["ecs:*"],
50
50
  "Resource": ["*"],
51
51
  "Condition": {
52
- "StringEquals": {"g:SourceAccount": "<account-id>"},
53
- "StringLike": {"g:SourceUrn": "urn:fss:*"}
52
+ "StringEquals": { "g:SourceAccount": "<account-id>" },
53
+ "StringLike": { "g:SourceUrn": "urn:fss:*" }
54
54
  }
55
55
  }
56
56
  ```
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: huawei-modelarts
3
- description: "Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms."
3
+ description: 'Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms.'
4
4
  version: 1
5
5
  ---
6
6
 
@@ -16,13 +16,13 @@ Domain expertise for ModelArts. Covers training jobs, model deployment, notebook
16
16
 
17
17
  ## Critical Warnings
18
18
 
19
- | Trap | Why |
20
- |------|-----|
21
- | OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
22
- | Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
23
- | Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
24
- | Model deployment needs quota | Online services may require service quota approval in new accounts |
25
- | Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
19
+ | Trap | Why |
20
+ | ------------------------------- | ----------------------------------------------------------------------------------- |
21
+ | OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
22
+ | Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
23
+ | Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
24
+ | Model deployment needs quota | Online services may require service quota approval in new accounts |
25
+ | Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
26
26
 
27
27
  ## Prerequisites
28
28
 
@@ -32,31 +32,31 @@ Domain expertise for ModelArts. Covers training jobs, model deployment, notebook
32
32
 
33
33
  ## Common Workflows
34
34
 
35
- | Task | Operation |
36
- |------|-----------|
37
- | List models | `ListModels --cli-region=<r> --project_id=<p>` |
38
- | List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
39
- | List services | `ListServices --cli-region=<r> --project_id=<p>` |
40
- | List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
41
- | Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
42
- | Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
35
+ | Task | Operation |
36
+ | ------------------ | -------------------------------------------------- |
37
+ | List models | `ListModels --cli-region=<r> --project_id=<p>` |
38
+ | List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
39
+ | List services | `ListServices --cli-region=<r> --project_id=<p>` |
40
+ | List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
41
+ | Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
42
+ | Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
43
43
 
44
44
  Discover operation parameters with `--help` before executing any write operation.
45
45
 
46
46
  ## Service Types
47
47
 
48
- | Type | Purpose |
49
- |------|---------|
50
- | Training Job | Train models on GPU/CPU resources |
51
- | Model | Register trained models for deployment |
52
- | Service (Online) | Deploy models as REST API endpoints |
53
- | Notebook | JupyterLab environments for development |
48
+ | Type | Purpose |
49
+ | ---------------- | --------------------------------------- |
50
+ | Training Job | Train models on GPU/CPU resources |
51
+ | Model | Register trained models for deployment |
52
+ | Service (Online) | Deploy models as REST API endpoints |
53
+ | Notebook | JupyterLab environments for development |
54
54
 
55
55
  ## Troubleshooting
56
56
 
57
- | Error | Fix |
58
- |-------|-----|
59
- | OBS path not found | Verify OBS bucket exists and path is correct |
57
+ | Error | Fix |
58
+ | ------------------ | ---------------------------------------------------------------- |
59
+ | OBS path not found | Verify OBS bucket exists and path is correct |
60
60
  | Training job fails | Check training data format, resource quotas, and logs in console |
61
61
 
62
62
  ## Cross-Skill References