huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/plugins/huaweicloud-core/skills/huawei-iac/references/architectures.md

@@ -0,0 +1,83 @@
+# Architecture Templates by Scale
+
+Templates define the resource mix and dependency topology per user scale. Adapt specs to the target region (always verify with `ListFlavors` / `ListImages`), never copy them blindly.
+
+## Scale Classification
+
+**When the user has not stated their scale** (and signals like "生产环境"/"学习用" are absent), present this table as a choice - the user picks the tier, the template follows:
+
+| Scale          | Signals                                            | Product mix                                                           | Cost signal            |
+| -------------- | -------------------------------------------------- | --------------------------------------------------------------------- | ---------------------- |
+| Personal       | Side project, low traffic, cost-sensitive          | FunctionGraph (free tier) + OBS static hosting, or single minimal ECS | Tens of CNY/month      |
+| Small business | Team product, stable traffic, needs SLA-ish uptime | ECS + RDS (single instance) + EIP, frontend OBS+CDN or same ECS       | Hundreds of CNY/month  |
+| Enterprise     | Production, HA, compliance                         | CCE + GaussDB (primary/standby) + WAF + CDN + OBS logs                | Thousands of CNY/month |
+
+## Template: Personal - OBS+CDN frontend / FunctionGraph backend (lightest)
+
+```
+OBS public bucket -> CDN acceleration -> DNS CNAME -> user domain
+  (Vue/React build output)
+FunctionGraph (Node.js/Python)
+  (Express/FastAPI backend logic)
+```
+
+- FunctionGraph has a free tier; personal projects are often near-free
+- Persistent data needs a real database (DDS single node in free tier, or minimal RDS). FG filesystem is ephemeral - SQLite data is lost between invocations
+
+## Template: Personal - ECS+EIP frontend / FunctionGraph backend
+
+```
+VPC -> Subnet -> ECS(1C1G) -> EIP
+  (Nginx serves static files)
+FunctionGraph (backend API)
+```
+
+## Template: Small business - OBS+CDN frontend / ECS+RDS backend
+
+```
+OBS public bucket -> CDN -> DNS -> user domain
+
+VPC -> Subnet -> SG -> ECS(2C4G) -> EIP
+                      └─ RDS (MySQL single instance)
+```
+
+## Template: Small business - all on ECS
+
+```
+VPC -> Subnet -> SG -> ECS(2C4G) -> EIP
+                      ├─ Nginx (frontend static)
+                      ├─ Node.js (backend)
+                      └─ RDS (MySQL single instance)
+```
+
+Fewest resources; no CDN, no HTTPS by default. Good for quick validation or intranet scenarios.
+
+## Template: Enterprise
+
+```
+OBS public bucket -> CDN -> WAF -> DNS -> user domain
+
+VPC -> Subnet -> SG
+        ├─ CCE (3 nodes) -> ELB -> EIP
+        ├─ GaussDB (primary/standby)
+        └─ OBS (logs)
+```
+
+## Dependency Ordering Rules
+
+Creation must follow topological order; destroy is the exact reverse:
+
+1. Network foundation first: VPC → Subnet → Security Group (+ rules)
+2. Compute / database next: ECS, RDS, CCE, FunctionGraph
+3. Bindings and exposure last: EIP bind, CDN domain, DNS record set
+4. Shared foundations (VPC/Subnet) are referenced by many resources - deleting them first always fails with "resource in use"
+
+## Frontend Hosting Decision Matrix
+
+| Aspect               | OBS+CDN+DNS                             | ECS+EIP                               |
+| -------------------- | --------------------------------------- | ------------------------------------- |
+| Prerequisite         | Registered + ICP-filed domain           | None (IP access)                      |
+| Ops                  | Zero server ops                         | Full server management                |
+| Backend on same host | No (static only)                        | Yes (SSR / API / Nginx)               |
+| Traffic cost         | Pay per GB, cheap at scale              | Fixed bandwidth billing               |
+| Best for             | Static sites, SPAs, docs, landing pages | SSR frontends, all-in-one deployments |

package/plugins/huaweicloud-core/skills/huawei-iac/references/resource-catalog.md

@@ -0,0 +1,107 @@
+# Resource Purchase Catalog
+
+Every resource type the orchestration flow can purchase, bind, and destroy. This is the authoritative checklist when composing a deployment plan.
+
+> **Operation names below are entry points, not gospel.** Always confirm exact parameters with `hcloud <Service> <Operation> --help` before planning a command. When an operation name is uncertain, run `hcloud <Service> --help` first.
+
+## Networking (foundation - create first, destroy last)
+
+> **v3 API notes (verified by E2E)**: `CreateSecurityGroup` is account-scoped - NO `vpc_id` param. `CreateSecurityGroupRule` uses `multiport=80` (not `port_range_min/max`). `DeleteSubnet` requires `--vpc_id` in addition to `--subnet_id`. Deletion APIs return empty output on success (async 202/204) - confirm via list, not stdout.
+
+| Resource             | Create                                                                                                                                                                                                                                                                                           | Delete                                                             | Skill      | Depends on                                                                                                                                  |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| VPC                  | `hcloud VPC CreateVpc --vpc.name=<n> --vpc.cidr=<cidr>`                                                                                                                                                                                                                                          | `hcloud VPC DeleteVpc --vpc_id=<id>`                               | huawei-vpc | -                                                                                                                                           |
+| Subnet               | `hcloud VPC CreateSubnet --subnet.name=<n> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.vpc_id=<id> --subnet.dnsList.1=100.125.0.20 --subnet.dnsList.2=114.114.114.114` (⚠️ dnsList 必带——实测缺失后实例内 apt/git 域名解析全挂；UpdateSubnet 补写时必填 `--vpc_id` + `--subnet.name`) | `hcloud VPC DeleteSubnet --subnet_id=<id> --vpc_id=<id>`           | huawei-vpc | VPC                                                                                                                                         |
+| Security group       | `hcloud VPC CreateSecurityGroup --security_group.name=<n>` (v3: account-scoped, no vpc_id)                                                                                                                                                                                                       | `hcloud VPC DeleteSecurityGroup --security_group_id=<id>`          | huawei-vpc | -                                                                                                                                           |
+| Security group rules | `hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=ingress --security_group_rule.protocol=tcp --security_group_rule.multiport=80 --security_group_rule.remote_ip_prefix=<cidr>`                                                    | `hcloud VPC DeleteSecurityGroupRule --security_group_rule_id=<id>` | huawei-vpc | Security group. New SGs deny ALL inbound - rules are mandatory. Risk rules block `0.0.0.0/0` exposure - use the VPC CIDR for internal rules |
+| EIP                  | `hcloud EIP CreatePublicip`                                                                                                                                                                                                                                                                      | `hcloud EIP DeletePublicip`                                        | huawei-vpc | - (bills when idle)                                                                                                                         |
+| EIP bind             | `hcloud EIP AssociatePublicips --publicip.associate_instance_type=PORT`                                                                                                                                                                                                                          | `hcloud EIP DisassociatePublicips`                                 | huawei-vpc | EIP + target port                                                                                                                           |
+
+## Compute
+
+| Resource      | Create                                                                                                                                                                                                                                                                                                                                                                               | Delete                                                                                     | Skill      | Depends on                                                                 |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------ | ---------- | -------------------------------------------------------------------------- |
+| ECS instance  | `hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.vpcid=<id> --server.nics.1.subnet_id=<id> --server.security_groups.1.id=<id> --server.availability_zone=<az> --server.root_volume.volumetype=<type>` (hidden required: `vpcid` + `root_volume.volumetype`; check flavor family vs image arch, e.g. kc1 = ARM needs an ARM image) | `hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true` | huawei-ecs | VPC + Subnet + SG. Set both delete flags true on teardown or EIP/disk leak |
+| EVS data disk | `hcloud EVS CreateVolume`                                                                                                                                                                                                                                                                                                                                                            | `hcloud EVS DeleteVolume`                                                                  | huawei-ecs | - (attach with `hcloud EVS AttachVolume`)                                  |
+
+## Databases
+
+| Resource                    | Create                                                    | Delete                                                  | Skill          | Depends on   |
+| --------------------------- | --------------------------------------------------------- | ------------------------------------------------------- | -------------- | ------------ |
+| RDS (MySQL/PG/SQLServer)    | discover with `hcloud RDS --help` (CreateInstance family) | discover with `hcloud RDS --help`                       | huawei-rds     | VPC + Subnet |
+| GaussDB                     | discover with `hcloud GaussDB --help`                     | discover with `hcloud GaussDB --help`                   | huawei-gaussdb | VPC + Subnet |
+| DDS (MongoDB) / DCS (Redis) | discover with `hcloud DDS --help` / `hcloud DCS --help`   | discover with `hcloud DDS --help` / `hcloud DCS --help` | huawei-dds-dcs | VPC + Subnet |
+
+## Storage / Delivery
+
+| Resource                | Create                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Delete                                                              | Skill        | Depends on                                                                         |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------- |
+| OBS bucket              | `hcloud OBS mb obs://<bucket> -location=<region>` (NO `-f`; `-location` is mandatory even with a regional endpoint; same-name re-create is idempotent success)                                                                                                                                                                                                                                                                                                                                                                                       | `hcloud OBS rm obs://<bucket> -f` (empty objects first; idempotent) | huawei-obs   | -                                                                                  |
+| Upload objects          | `hcloud OBS cp <src> obs://<bucket>/ -f -acl=public-read`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | -                                                                   | huawei-obs   | Bucket. Per-object ACL mandatory - bucket ACL does not cascade                     |
+| Static website hosting  | NO CLI path - `chattri` only sets ACL/storage-class and obsutil has no website command. Use the console, or enable via CDN OBS-origin (`--domain.sources.1.enable_obs_web_hosting=1`)                                                                                                                                                                                                                                                                                                                                                                | -                                                                   | huawei-obs   | Bucket. Bucket name must equal the custom domain for CDN custom-domain access      |
+| CDN acceleration domain | `hcloud CDN CreateDomain --domain.business_type=web --domain.domain_name=<domain> --domain.sources.1.origin_type=obs_bucket --domain.sources.1.ip_or_domain=<bucket-website-endpoint> --domain.sources.1.active_standby=1 --cli-region=cn-north-1` (CDN is a GLOBAL service: region must be cn-north-1 or ap-southeast-1; first create attempt fails with `CDN.00010185` until the user passes domain ownership verification via DNS record or file upload; `--domain.sources.1.enable_obs_web_hosting=1` enables OBS website hosting on the origin) | disable then delete                                                 | - (no skill) | OBS source or ECS origin. Mainland acceleration requires ICP filing                |
+| DNS record set          | discover with `hcloud DNS --help` (CreateRecordSet family)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | discover with `hcloud DNS --help`                                   | - (no skill) | CDN CNAME + domain hosted in Huawei Cloud DNS (check `hcloud DNS ListPublicZones`) |
+
+## Serverless / API
+
+| Resource               | Create                                                                                                                                                                                                                                                                                                                                                              | Delete                                                                                                                                                                             | Skill                | Depends on                                                |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | --------------------------------------------------------- |
+| FunctionGraph function | `hcloud FunctionGraph CreateFunction --func_name=<n> --runtime=Node.js18.15 --handler=index.handler --memory_size=128 --timeout=3 --package=default --code_type=inline --func_code.file=<base64>` (runtime enum is exact: `Node.js18.15`, `Python3.9`, `Go1.x`, ...; `--package=inline` fails with `FSS.1006` - the pair is `--package=default --code_type=inline`) | `hcloud FunctionGraph DeleteFunction --function_urn=<urn-without-:latest>` (urn must omit version/alias to delete the whole function; param is `--function_urn`, NOT `--func_urn`) | huawei-functiongraph | -                                                         |
+| FunctionGraph trigger  | `hcloud FunctionGraph CreateFunctionTrigger --function_urn=<urn> --trigger_type_code=TIMER --trigger_status=ACTIVE --event_data.name=<n> --event_data.schedule_type=Rate --event_data.schedule=1m` (timer uses `schedule_type=Rate` + bare `1m`; `schedule=@every 1h` fails with `FSS.1109`)                                                                        | `hcloud FunctionGraph DeleteFunctionTrigger --function_urn=<urn> --trigger_type_code=TIMER --trigger_id=<id>`                                                                      | huawei-functiongraph | Function. Use DEDICATEDGATEWAY (not deprecated APIG type) |
+| APIG instance          | `hcloud APIG CreateInstanceV2 --spec_id=<id>`                                                                                                                                                                                                                                                                                                                       | discover with `hcloud APIG --help`                                                                                                                                                 | huawei-apig          | -                                                         |
+
+## Container
+
+| Resource                | Create                            | Delete                            | Skill      | Depends on                                       |
+| ----------------------- | --------------------------------- | --------------------------------- | ---------- | ------------------------------------------------ |
+| CCE cluster + node pool | discover with `hcloud CCE --help` | discover with `hcloud CCE --help` | huawei-cce | VPC + Subnet. Long creation time - warn the user |
+
+## Messaging / Backup / Observability / Security
+
+| Resource                      | Create                                                  | Delete                            | Skill            |
+| ----------------------------- | ------------------------------------------------------- | --------------------------------- | ---------------- |
+| SMN topic / subscription      | discover with `hcloud SMN --help`                       | discover with `hcloud SMN --help` | huawei-smn-dms   |
+| DMS queue (Kafka/RocketMQ)    | discover with `hcloud DMS --help`                       | discover with `hcloud DMS --help` | huawei-smn-dms   |
+| CBR vault / policy            | discover with `hcloud CBR --help`                       | discover with `hcloud CBR --help` | huawei-cbr       |
+| CES alarm rule                | discover with `hcloud CES --help`                       | discover with `hcloud CES --help` | huawei-cloud-eye |
+| CTS tracker                   | discover with `hcloud CTS --help`                       | discover with `hcloud CTS --help` | huawei-cts       |
+| DEW secret / KMS key          | discover with `hcloud DEW --help` / `hcloud KMS --help` | discover with `hcloud DEW --help` | huawei-dew       |
+| WAF policy                    | discover with `hcloud WAF --help`                       | discover with `hcloud WAF --help` | huawei-waf-aad   |
+| IAM users / groups / agencies | discover with `hcloud IAM --help`                       | discover with `hcloud IAM --help` | huawei-iam       |
+
+## Pricing and Balance
+
+### On-demand price inquiry (verified template)
+
+```
+hcloud BSS ListOnDemandResourceRatings --project_id=<pid> \
+  --product_infos.1.id=<label> \
+  --product_infos.1.cloud_service_type=hws.service.type.ec2 \
+  --product_infos.1.resource_type=hws.resource.type.vm \
+  --product_infos.1.region=<resource-region> \
+  --product_infos.1.resource_spec=kc1.small.1.linux \
+  --product_infos.1.subscription_num=1 \
+  --product_infos.1.usage_factor=Duration \
+  --product_infos.1.usage_measure_id=4 \
+  --product_infos.1.usage_value=730 \
+  --cli-region=cn-north-1 --cli-domain-id=<domain_id>
+```
+
+- `usage_measure_id=4` = hour; `usage_value=730` = one month. Response: `amount` (CNY) per product label
+- **ECS codes verified**: service `hws.service.type.ec2`, resource `hws.resource.type.vm`, spec = `<flavor>.linux` (or `.win`); monthly price for kc1.small.1 = 87.60 CNY (official, cn-north-4)
+- **EIP codes NOT usable (verified)**: `hws.service.type.vpc` + `19_bgp` fails with `CBC.6074` - use official website prices as static estimates and label them 估算
+- **Other services**: codes are per-service and MUST be looked up via BSS metadata APIs (`ListServiceTypes` / `ListResourceTypes` / `ListUsageTypes`) or docs - a wrong combination fails with `CBC.6074`. Never guess
+- **Balance query may be permission-blocked**: `CBC.0151` = IAM user lacks `billing:balance:view` → degrade to "user self-checks balance" and continue (do not block; `Ecs.7000` at order time is recoverable). domain_id 可从报错信息 `iam::<domain_id>:user:<name>` 提取
+
+- Account balance: `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`
+  - Global services (BSS/IAM/CDN) demand `--cli-domain-id` per call (or in the profile) under AK/SK auth
+  - If the domain_id is unknown: extract it from ANY resource response's `tenant_id` field (e.g. a VPC create response) or from the console (My Credentials page)
+  - Response shape: `account_balances[].amount` (cash account type=1, voucher account type=5), `debt_amount`, `currency`
+- Cost gate rule: no deployment without a per-resource cost estimate AND a balance check. Verified failure mode when skipped: ECS creation dies with `Ecs.7000 Insufficient account balance` at order submission
+
+## Auth Bootstrapping (prerequisite for every command above)
+
+- Symptom of a broken profile: every hcloud API returns `APIGW.0301 Incorrect IAM authentication information` while OBS/obsutil keeps working - caused by a stale `securityToken` in the profile
+- Fix: `hcloud configure delete --cli-profile=default`, then re-run `npx huaweicloud-devkit auth init` with permanent AK/SK only (no token). `configure set` refuses empty values, so the token cannot be cleared in place
+- project_id is auto-discovered once signing works - no need to configure it manually
+- VPC/OBS create responses expose `tenant_id` (= domain_id) - the reliable fallback source when BSS/IAM discovery is blocked

package/plugins/huaweicloud-core/skills/huawei-iac/references/state-file.md

@@ -0,0 +1,104 @@
+# Deployment State File Specification
+
+Session-scoped tracking for the orchestration flow. This is a manual, session-scoped analog of Terraform state - lightweight by design, not a long-term deployment ledger.
+
+## Location
+
+System temp directory (session dies with the file):
+
+```
+Linux/macOS:  /tmp/huaweicloud-iac-state.json
+Windows:      %TEMP%\huaweicloud-iac-state.json
+```
+
+## Lifecycle
+
+- Created at the start of Stage 6 (provisioning) with the first `deploying` deployment
+- Updated after EVERY successful resource creation (never batch-write at the end)
+- Marked `partial` immediately on any failure
+- Marked `destroyed` after a successful teardown
+- Expires with the session - never promise cross-session deploy management
+
+## Schema
+
+```json
+{
+  "version": "1.0",
+  "deployments": {
+    "d-002": {
+      "created_at": "2026-09-05T14:00:00Z",
+      "arch": "personal-serverless",
+      "region": "cn-east-3",
+      "frontend": "obs-cdn",
+      "domain": "www.example.com",
+      "resources": [
+        {
+          "id": "obs_bucket",
+          "type": "OBS_Bucket",
+          "resource_id": "www.example.com",
+          "params": { "acl": "public-read", "website": true }
+        },
+        {
+          "id": "cdn",
+          "type": "CDN_Domain",
+          "resource_id": "cdn-xxx",
+          "params": { "cname": "xxx.cdn.myhuaweicloud.com" },
+          "depends_on": ["obs_bucket"]
+        },
+        {
+          "id": "dns",
+          "type": "DNS_RecordSet",
+          "resource_id": "rs-xxx",
+          "params": { "type": "CNAME", "value": "xxx.cdn.myhuaweicloud.com" },
+          "depends_on": ["cdn"]
+        },
+        {
+          "id": "fg",
+          "type": "FunctionGraph",
+          "resource_id": "urn:fss:xxx",
+          "params": { "runtime": "Node.js" }
+        }
+      ],
+      "status": "deployed"
+    }
+  }
+}
+```
+
+Field rules:
+
+- `id`: stable resource role within the deployment (`vpc`, `subnet`, `sg`, `ecs`, `eip`, `rds`, `obs_bucket`, `cdn`, `dns`, `fg`, ...) - later resources reference these names in `depends_on`
+- `resource_id`: the real cloud ID extracted from the creation command output - never reconstructed from memory
+- `depends_on`: array of `id`s this resource was created after; determines reverse destroy order
+- `params`: only what teardown or diagnostics needs (name, flags like ACL) - no secrets
+
+## Status Machine
+
+```
+deploying ──all created + verified──▶ deployed
+    │
+    └──any failure──▶ partial (keep created-resource records; destroy to clean up)
+
+deployed/partial ──destroy──▶ destroyed (terminal; queries only)
+```
+
+| Status      | Meaning                             | Allowed operations               |
+| ----------- | ----------------------------------- | -------------------------------- |
+| `deploying` | Provisioning in progress            | Wait / observe                   |
+| `deployed`  | All resources created and verified  | Query, destroy                   |
+| `partial`   | Interrupted; orphan resources exist | **Destroy (clean up leftovers)** |
+| `destroyed` | Torn down                           | Query only                       |
+
+## Write Rules
+
+1. Write state after every single successful create - extract `resource_id` from the actual command output
+2. `resource_id` extraction is deterministic: parse the JSON the command returned; if the output shape is unexpected, stop and inspect instead of guessing
+3. A failed create is recorded only via the `partial` status - do not fabricate IDs for failed resources
+4. Destroy order = exact reverse of the recorded `resources` array order (creation order is already topological)
+5. "Resource not found" during destroy = already gone; keep going and still record it as processed
+6. **UTF-8 WITHOUT BOM**: PowerShell 5.1 `Set-Content -Encoding utf8` writes a BOM that makes strict JSON parsers fail (`Unexpected token ''`). Write state with Node `fs.writeFileSync` or another BOM-less writer; if parsing fails on a `\uFEFF` prefix, strip it and rewrite the file clean
+7. Empty command stdout is a valid success signal for VPC v3 deletes (async 202/204) - confirm teardown via list APIs, not stdout
+
+## Known Weakness
+
+State correctness rests entirely on the agent writing each `resource_id` right after creation. A wrong or missing ID causes leaks (missed deletes) or wrong deletes at teardown. Mitigations: write immediately after each step, parse output programmatically, show the full to-be-deleted list for final confirmation before destroying.

package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-iam
-description: "Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew)."
+description: 'Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew).'
 version: 1
 ---
 
@@ -16,13 +16,13 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
-| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
-| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
-| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
-| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
+| Trap                              | Why                                                             |
+| --------------------------------- | --------------------------------------------------------------- |
+| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO            |
+| NEVER create long-term AK/SK      | Use temporary STS tokens via agencies                           |
+| Wildcard policies dangerous       | Effect:Allow + Resource:* = full access. Always scope resources |
+| Agency trust is powerful          | Agencies let services assume roles. Always add conditions       |
+| Root account must have MFA        | Root AK/SK is all-powerful. Enable MFA immediately              |
 
 ## Policy Structure
 
@@ -42,33 +42,33 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
 
 ## Common Workflows
 
-| Task | Command | Steps |
-|------|---------|-------|
-| List users | hcloud IAM ListUsers | references/iam-ops.md |
-| Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
-| Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
-| Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
-| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
-| Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
+| Task                     | Command                                                                                                                     | Steps                         |
+| ------------------------ | --------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
+| List users               | hcloud IAM KeystoneListUsers --cli-region=<r>                                                                               | references/iam-ops.md         |
+| Create group             | hcloud IAM CreateGroupV5 --group_name=<name>                                                                                | references/iam-ops.md         |
+| Create custom policy     | hcloud IAM CreateCloudServiceCustomPolicy --role.display_name=<n> --role.type=<type> --role.policy.Statement.1.Effect=Allow | references/policy-examples.md |
+| Create agency            | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_domain_name=<domain>                       | references/agency.md          |
+| Get temporary credential | hcloud STS AssumeAgency --agency_urn=<urn> --agency_session_name=<n> --duration_seconds=3600                                | references/sts.md             |
+| Attach policy to group   | hcloud IAM AttachGroupPolicyV5 --group_id=<id> --policy_id=<id>                                                             | references/iam-ops.md         |
 
 ## Policy Examples (Least Privilege)
 
-| Role | Actions | Resource |
-|------|---------|----------|
-| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
-| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:*:*:bucket:my-bucket |
-| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
+| Role                | Actions                                                 | Resource                 |
+| ------------------- | ------------------------------------------------------- | ------------------------ |
+| ECS Reader          | ecs:List*, ecs:Get*, ecs:Describe*                      | *                        |
+| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List*              | obs:_:_:bucket:my-bucket |
+| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:*                    |
 
 > See `references/policy-examples.md` for complete policy JSON templates with conditions.
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
-| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
-| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
-| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
+| Error               | Root Cause -> Fix                                                      |
+| ------------------- | ---------------------------------------------------------------------- |
+| AccessDenied        | Missing IAM permission -> Check policy action and resource scope       |
+| AuthFailure         | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
+| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition        |
+| Quota exceeded      | IAM user/group/policy limit -> Request quota increase                  |
 
 ## Security Considerations
 
@@ -88,10 +88,10 @@ FunctionGraph needs an agency to access VPC resources (RDS, DCS, etc.):
 
 ```bash
 # 1. Create agency with FunctionGraph trust
-hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
+hcloud IAM CreateAgency --agency.name=<name> --agency.trust_domain_name=functiongraph
 
-# 2. Attach VPC Administrator role
-hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
+# 2. Grant role to agency
+hcloud IAM AssociateAgencyWithDomainPermission --agency_id=<id> --role_id=<role-id>
 
 # 3. Use in CreateFunction
 hcloud FunctionGraph CreateFunction ... --app_xrole=<agency-name>

package/plugins/huaweicloud-core/skills/huawei-iam/references/policy-examples.md

@@ -9,6 +9,7 @@ Huawei Cloud IAM uses a different action naming convention from AWS. Actions use
 ```
 
 Examples:
+
 - `ecs:servers:list` (NOT `ecs:ListInstances`)
 - `obs:bucket:GetBucket` (NOT `s3:GetBucket`)
 - `vpc:vpcs:list` (NOT `vpc:DescribeVpcs`)
@@ -18,77 +19,100 @@ Always verify exact action names via `https://support.huaweicloud.com/usermanual
 ## Read-Only Policies
 
 ### ECS Read-Only
+
 ```json
 {
   "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["ecs:servers:list", "ecs:servers:get", "ecs:*:list", "ecs:*:get"],
-    "Resource": ["*"]
-  }]
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["ecs:servers:list", "ecs:servers:get", "ecs:*:list", "ecs:*:get"],
+      "Resource": ["*"]
+    }
+  ]
 }
 ```
 
 ### OBS Read-Only (scoped bucket)
+
 ```json
 {
   "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["obs:bucket:Get*", "obs:bucket:List*", "obs:object:Get*"],
-    "Resource": ["obs:*:*:bucket:my-bucket", "obs:*:*:bucket:my-bucket/*"]
-  }]
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["obs:bucket:Get*", "obs:bucket:List*", "obs:object:Get*"],
+      "Resource": ["obs:*:*:bucket:my-bucket", "obs:*:*:bucket:my-bucket/*"]
+    }
+  ]
 }
 ```
 
 ### FunctionGraph Read-Only
+
 ```json
 {
   "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["functiongraph:function:getConfig", "functiongraph:function:list", "functiongraph:function:invoke", "functiongraph:trigger:list"],
-    "Resource": ["*"]
-  }]
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "functiongraph:function:getConfig",
+        "functiongraph:function:list",
+        "functiongraph:function:invoke",
+        "functiongraph:trigger:list"
+      ],
+      "Resource": ["*"]
+    }
+  ]
 }
 ```
 
 ## Full-Access (Scoped)
 
 ### RDS Operator
+
 ```json
 {
   "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["rds:*"],
-    "Resource": ["*"],
-    "Condition": {"StringEquals": {"g:ResourceTag/Environment": ["dev", "staging"]}}
-  }]
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["rds:*"],
+      "Resource": ["*"],
+      "Condition": { "StringEquals": { "g:ResourceTag/Environment": ["dev", "staging"] } }
+    }
+  ]
 }
 ```
 
 ### FunctionGraph Developer
+
 ```json
 {
   "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["functiongraph:function:*", "functiongraph:trigger:*", "functiongraph:runtime:list"],
-    "Resource": ["*"]
-  }]
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["functiongraph:function:*", "functiongraph:trigger:*", "functiongraph:runtime:list"],
+      "Resource": ["*"]
+    }
+  ]
 }
 ```
 
 ### APIG Operator
+
 ```json
 {
   "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["apig:instance:*", "apig:api:*", "apig:group:*", "apig:environment:*"],
-    "Resource": ["*"]
-  }]
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["apig:instance:*", "apig:api:*", "apig:group:*", "apig:environment:*"],
+      "Resource": ["*"]
+    }
+  ]
 }
 ```
 
@@ -104,15 +128,17 @@ Always verify exact action names via `https://support.huaweicloud.com/usermanual
 ```json
 {
   "Version": "1.1",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": ["ecs:*"],
-    "Resource": ["*"],
-    "Condition": {
-      "StringEquals": {"g:SourceAccount": "0123456789"},
-      "StringLike": {"g:SourceUrn": "urn:fss:*"}
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["ecs:*"],
+      "Resource": ["*"],
+      "Condition": {
+        "StringEquals": { "g:SourceAccount": "0123456789" },
+        "StringLike": { "g:SourceUrn": "urn:fss:*" }
+      }
     }
-  }]
+  ]
 }
 ```
 

package/plugins/huaweicloud-core/skills/huawei-iam/references/quick-ref.md

@@ -31,13 +31,13 @@ hcloud IAM GetAccountSummary                     # account summary
 
 ## IAM vs AWS Comparison
 
-| AWS | Huawei Cloud |
-|-----|-------------|
-| `iam:ListUsers` | `iam:users:list` (lowercase + colon) |
-| AWS Managed Policy | System Policy (系统策略) |
-| Customer Managed | Custom Policy (自定义策略) |
-| Resource-Based Policy | Project-Level Policy (项目级策略) |
-| IAM Role | Agency (委托) |
+| AWS                   | Huawei Cloud                         |
+| --------------------- | ------------------------------------ |
+| `iam:ListUsers`       | `iam:users:list` (lowercase + colon) |
+| AWS Managed Policy    | System Policy (系统策略)             |
+| Customer Managed      | Custom Policy (自定义策略)           |
+| Resource-Based Policy | Project-Level Policy (项目级策略)    |
+| IAM Role              | Agency (委托)                        |
 
 > Huawei Cloud IAM action naming: `<service>:<resource>:<action>`. Always verify at https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
 
@@ -49,8 +49,8 @@ hcloud IAM GetAccountSummary                     # account summary
   "Action": ["ecs:*"],
   "Resource": ["*"],
   "Condition": {
-    "StringEquals": {"g:SourceAccount": "<account-id>"},
-    "StringLike": {"g:SourceUrn": "urn:fss:*"}
+    "StringEquals": { "g:SourceAccount": "<account-id>" },
+    "StringLike": { "g:SourceUrn": "urn:fss:*" }
   }
 }
 ```