Huawei Cloud DEW (Data Encryption Workshop)

STOP - Do not answer from general knowledge. Follow the procedure below.

Always run hcloud <Service> <Operation> --help before constructing commands to discover exact parameter names and requirements.

Overview

This skill provides AI Agent capabilities for Huawei Cloud DEW (Data Encryption Workshop / 数据加密服务), which bundles two services:

It enables four capability groups through 10 huawei_* actions:

Scope boundaries:

• ✅ List/describe secrets and versions (metadata only — no secret values)
• ✅ List KMS keys, analyze rotation status, audit KMS key usage via CTS
• ✅ Create KMS keys, enable automatic rotation, manually rotate secret versions, delete KMS keys (with confirmation)
• ❌ NEVER read or fetch secret values (DownloadSecretBlob, ShowSecretVersion value, DecryptData plaintext) into agent context
• ❌ NEVER echo credentials (AK/SK, passwords, tokens) in the conversation

Critical Warnings

Prerequisites

1. hcloud CLI (KooCLI 7.2.x or later) installed and authenticated.
   • Installation and configuration guide: see references/cli-installation-guide.md
   • Two supported authentication modes:
     • AK/SK credentials: environment variables HUAWEICLOUD_SDK_AK / HUAWEICLOUD_SDK_SK (or HUAWEI_ACCESS_KEY / HUAWEI_SECRET_KEY), or interactive setup via the hcloud configure wizard
     • Local hcloud profile: run "hcloud configure list"; it must show a valid profile with mode AKSK and a real accessKeyId
   • Verify authentication with "hcloud configure list"
2. Region: DEW is region-specific. Always pass --cli-region={region} (e.g. cn-north-4). --project_id is auto-filled from the profile when available.
3. IAM permissions: least-privilege policies are provided in references/iam-policies.md.
   • Query/diagnose: csms:ListSecrets, csms:ShowSecret, csms:ListSecretVersions, kms:ListKeys, kms:ListKeyDetail, cts:ListTraces
   • Manage: kms:CreateKey, csms:UpdateSecret, csms:CreateSecretVersion, kms:ScheduleKeyDeletion (+ kms:CancelKeyDeletion)
4. CTS tracker (for huawei_analyze_dew_key_usage): a system or management tracker must exist in the region. See references/verification-method.md.
5. Rotation function (for automatic rotation): an OBS/FuncGraph-based rotation function ARN is required by huawei_enable_csms_secret_rotation when enabling rotation on a secret that has none.

Quality reporting environment variables

Workflow

1. Identify target → region, project_id, secret_name / key_id filters
2. Classify intent →
     - Query/Diagnose (R3): list / describe / analyze — execute automatically
     - Manage (R2/R1): create / enable rotation / rotate / delete — ALWAYS show preview and ask for explicit confirmation first
3. Execute → build the hcloud command from the verified templates below
4. Output → structured JSON summary + readable report (metadata only, never secret values)
5. Report quality → skill_quality_sdk.py reports status/error code/trace_id (see Quality Reporting)

Confirmation gates (MUST NOT be skipped):

• R2 actions (huawei_create_kms_key, huawei_enable_csms_secret_rotation): show the full command, the resource to be created/updated, and ask "confirm?" before running.
• R1 actions (huawei_update_csms_secret_version, huawei_delete_kms_key): show the full command and side effects, and require explicit confirmation. For deletion, additionally print the irreversible-deletion warning (7-30 day pending window).

Core Commands

1. Query (R3 — read-only, auto execute)

List all CSMS secrets (names and metadata, no values):

# Optional: --project_id={project_id} --limit={n} --marker={marker}
hcloud CSMS ListSecrets --cli-region={region}

Describe a CSMS secret (rotation config, KMS key, status):

# Optional: --project_id={project_id}
hcloud CSMS ShowSecret --cli-region={region} --secret_name={secret_name}

List versions and stages of a secret (no values):

# Optional: --project_id={project_id} --limit={n} --marker={marker}
hcloud CSMS ListSecretVersions --cli-region={region} --secret_name={secret_name}

List KMS keys:

# Optional: --project_id={project_id} --key_state={state} --key_spec={spec} --limit={n} --marker={marker}
hcloud KMS ListKeys --cli-region={region}

2. Diagnose (R3 — read-only, auto execute)

huawei_analyze_dew_rotation — rotation status analysis for all CSMS secrets:

# Step 1: list all secrets
# Optional: --project_id={project_id}
hcloud CSMS ListSecrets --cli-region={region}

# Step 2: for each secret, describe to read rotation config (auto_rotation, rotation_period, rotation_func_urn, status)
# Optional: --project_id={project_id}
hcloud CSMS ShowSecret --cli-region={region} --secret_name={secret_name}

# Step 3 (optional): for each secret's KMS key, check key rotation status
# Optional: --project_id={project_id}
hcloud KMS ShowKeyRotationStatus --cli-region={region} --key_id={key_id}

Output a table of secrets with rotation status (enabled/disabled, period, function ARN) and flag risks: secrets without automatic rotation, rotation function missing, disabled KMS keys.

huawei_analyze_dew_key_usage — KMS key usage audit via CTS (Cloud Trace Service):

# Optional: --project_id={project_id} --service_type=KMS --resource_type={resource_type}
# Optional: --trace_name={trace_name} --from={start_ts} --to={end_ts} --limit={n} --next={next}
# 可选: --trace_type=data（数据事件）
hcloud CTS ListTraces --cli-region={region} --trace_type=system

Filter service_type=KMS traces to audit who used which key (encrypt/decrypt/delete), when, and from where; flag anomalies (failed kms:Decrypt attempts, operations on deleted/disabled keys).

3. Manage (R2 — preview + confirm)

huawei_create_kms_key — create a customer master key:

# Optional: --key_description={description} --key_spec=AES_256（其他可选: RSA_2048, RSA_3072, RSA_4096, EC_P256, EC_P384, SECP256K1）
# Optional: --key_usage=ENCRYPT_DECRYPT（其他可选: SIGN_VERIFY）--project_id={project_id}
hcloud KMS CreateKey --cli-region={region} --key_alias={alias}

huawei_enable_csms_secret_rotation — enable automatic rotation for a secret:

# Optional: --rotation_period={days} --rotation_func_urn={urn} --description={description}
# Optional: --project_id={project_id}
hcloud CSMS UpdateSecret --cli-region={region} --secret_name={secret_name} --auto_rotation=true

Note: KooCLI exposes rotation enablement through CSMS UpdateSecret --auto_rotation=true (there is no separate EnableSecretRotation operation in KooCLI 7.2.x — verified against huaweicloudsdkcsms 3.1.x, UpdateSecretRequestBody.auto_rotation).

4. Manage (R1 — preview + confirm)

huawei_update_csms_secret_version — manually rotate a secret version (immediate rotation):

# Optional: --project_id={project_id}
hcloud CSMS RotateSecret --cli-region={region} --secret_name={secret_name}

The rotation executes immediately: a new secret version is created with a randomly generated value in the background and marked SYSCURRENT. No secret value passes through the agent context.

Alternative for approved automation when a specific new value must be stored: hcloud CSMS CreateSecretVersion --cli-region={region} --secret_name={secret_name} --secret_string={value} The value must be supplied by the caller via stdin/env (e.g. --secret_string="$(read -s ...)"), never typed into the conversation history and never echoed back.

huawei_delete_kms_key — schedule KMS key deletion. IRREVERSIBLE — read the warning first:

# Optional: --project_id={project_id} --pending_days=7..1096（默认 7）
hcloud KMS DeleteKey --cli-region={region} --key_id={key_id} --pending_days=7

WARNING (must be shown before execution):

• The key is scheduled for deletion and enters a pending window of --pending_days (typical 7-30 days, API allows 7-1096).
• Inside the window the deletion can be cancelled: hcloud KMS CancelKeyDeletion --cli-region={region} --key_id={key_id}.
• After the window passes, the key is permanently deleted and data encrypted with it is UNRECOVERABLE.
• This action is R1: always show the key id, alias, and pending days, then require explicit confirmation.

Blocked Operations (security policy)

The following operations are BLOCKED by this skill's policy — they would expose secret material. Never run them; use the safe alternative instead:

Runtime Injection Pattern

For applications that must consume a secret value, use the MCP proxy resolve mode so the value is injected at the runtime and never enters the agent context:

{{resolve:csms:secret-id:SecretString:key}}

# Terraform / IaC — reference the secret by name; value is resolved at apply time
data "huaweicloud_csms_secret" "db" {
  secret_name = "prod-db-password"
}
# Use: data.huaweicloud_csms_secret.db.secret_string

# SDK — fetch at runtime and consume immediately, never print or persist in agent context
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkcsms.v1.region.csms_region import CsmsRegion
from huaweicloudsdkcsms.v1 import CsmsClient, ShowSecretVersionRequest

# Authenticate with AK/SK and project_id (or use the default credential chain)
credentials = BasicCredentials(ak, sk, project_id)
client = CsmsClient.new_builder() \
    .with_credentials(credentials) \
    .with_region(CsmsRegion.value_of("cn-north-4")) \
    .build()

# version_id="SYSCURRENT" returns the current active version of the secret
request = ShowSecretVersionRequest(secret_name="my-secret", version_id="SYSCURRENT")
secret_value = client.show_secret_version(request).version.secret_string
use(secret_value)

Troubleshooting

Security Considerations

• MUST use runtime injection ({{resolve:csms:...}}). NEVER fetch secret values into agent context.
• MUST rotate credentials every 90 days (配置 rotation_period ≤ 90 days).
• MUST enable automatic rotation for CSMS secrets.
• MUST audit KMS key usage via CTS (huawei_analyze_dew_key_usage).
• SHOULD use customer-managed keys (CMK) for sensitive data.
• MUST NOT use default KMS keys for production workloads.
• MUST NOT echo AK/SK, passwords, tokens, or secret values in any output or report.

KooCLI Command Format Standard

Parameter Confirmation

All parameters below were verified against hcloud <Service> <Operation> --help (KooCLI 7.2.12).

CSMS

KMS

CTS

Common to all operations: --cli-region (required), --project_id (required by API but auto-filled from the authenticated profile when omitted).

Quality Reporting

This Skill integrates skill_quality_sdk.py for execution quality reporting. Every run automatically reports trace_id, status (success/biz_fail/sys_fail/cancel), error code, cost, and masked input/output to the operations console.

Integration

• Python entry point: wrap main logic with quality_context context manager:

  from skill_quality_sdk import quality_context, QualityError
  
  with quality_context(skill_name="huawei-cloud-dew-key-management", skill_version="1.0.0") as q:
      q.input = {"action": "huawei_list_kms_keys", "region": "cn-north-4"}
      result = run_action(action, params)  # your implementation
      q.output = result
  

• CLI-only Skill: the SDK is vendored in scripts/ for future Python wrapper use.

Error Code Convention

Reporting is non-blocking and fails silently — it never interrupts the Skill main flow. Disable via SKILL_QUALITY_DISABLE=1 for local testing.

Reference Documents

• references/iam-policies.md — Least-privilege IAM policies for CSMS/KMS/CTS
• references/cli-installation-guide.md — hcloud CLI installation and AK/SK + profile authentication
• references/csms-usage.md — CSMS usage guide (actions, rotation, policy rules)
• references/kms-usage.md — KMS usage guide (create/list/rotate/delete, blocking rules)
• references/dataflow-diagram.md — Mermaid data flow diagram
• references/verification-method.md — Verification method and acceptance checks
• references/acceptance-criteria.md — Acceptance criteria for the 10 huawei_* actions
• DEW Docs: https://support.huaweicloud.com/dew/
• API Explorer: https://console.huaweicloud.com/apiexplorer/#/openapi/DEW/doc