Huawei Cloud IAM Role List Skill

Overview

This skill lists all Huawei Cloud IAM (Identity and Access Management) roles owned by the authenticated account. It is a read-only inventory skill: it never creates, modifies, deletes roles, or changes any IAM configuration.

Architecture:

Agent → hcloud CLI (KooCLI IAM, primary) → Huawei Cloud IAM API
       ↘ ListPoliciesV5 / huaweicloudsdkiam Python SDK (fallback)  ↗

Applicable Scenarios:

• IAM role (permission) inventory and resource discovery
• Security and compliance auditing (account access review)
• Permission review (checking which roles exist and their scope)
• Troubleshooting account-level IAM configuration

Prerequisites

1. hcloud CLI (KooCLI) installed and authenticated — See references/cli-installation-guide.md
2. IAM permissions — iam:roles:listRoles — See references/iam-policies.md
3. Python 3.6+ with huaweicloudsdkiam package (SDK fallback) — pip install huaweicloudsdkiam

Credentials. KooCLI reads credentials from hcloud configure (AK/SK) or environment variables. The IAM API is global (no region endpoint), so the same account credentials used for other Huawei Cloud services work here. Never ask the user to paste AK/SK into the conversation.

Workflow

1. Verify prerequisites — hcloud version, then run the list command (below)
2. Run the query — hcloud IAM KeystoneListPermissions (CLI primary) with desired options
3. Handle results — Parse role IDs, display names, internal names, catalogs, and types; report the total role count
4. Fallback — If the CLI is unavailable, use hcloud IAM ListPoliciesV5 or the Python SDK example below

Core Commands

List All IAM Roles (Permissions)

hcloud IAM KeystoneListPermissions --cli-region=cn-north-4

List IAM Roles (JSON Output)

hcloud IAM KeystoneListPermissions --cli-region=cn-north-4 --cli-output=json

List System-Defined Roles Only

hcloud IAM KeystoneListPermissions --cli-region=cn-north-4 --permission_type=role

List System-Defined Policies Only

hcloud IAM KeystoneListPermissions --cli-region=cn-north-4 --permission_type=policy

List Custom (Account) Policies

hcloud IAM KeystoneListPermissions --cli-region=cn-north-4 --domain_id=<domain-id>

Filter by Service Catalog

hcloud IAM KeystoneListPermissions --cli-region=cn-north-4 --permission_type=role --catalog=CCE

Filter by Display Name

hcloud IAM KeystoneListPermissions --cli-region=cn-north-4 --display_name=<display-name>

v5 API Fallback (Identity Policies)

hcloud IAM ListPoliciesV5 --cli-region=cn-north-4 --policy_type=system

SDK Fallback Example

import os
from huaweicloudsdkcore.auth.credentials import GlobalCredentials
from huaweicloudsdkiam.v3 import IamClient
from huaweicloudsdkiam.v3.model import KeystoneListPermissionsRequest
from huaweicloudsdkiam.v3.region.iam_region import IamRegion

# IAM role listing is a domain-level (global) operation, so use GlobalCredentials
# with the domain ID (account ID). Obtain the domain ID from the console or via
# `hcloud IAM KeystoneListAuthDomains`.
credentials = GlobalCredentials(
    os.environ["HUAWEI_CLOUD_ACCESS_KEY"],
    os.environ["HUAWEI_CLOUD_SECRET_KEY"],
).with_domain_id(os.environ["HUAWEI_CLOUD_DOMAIN_ID"])

client = IamClient.new_builder() \
    .with_credentials(credentials) \
    .with_region(IamRegion.value_of("cn-north-4")) \
    .build()

response = client.keystone_list_permissions(KeystoneListPermissionsRequest())
roles = response.roles or []
for role in roles:
    print(role.id, role.display_name, role.name, role.catalog, role.type)
print("Role number:", len(roles))

Parameter Confirmation

Reference Documents

• CLI Installation Guide
• IAM Policies
• Verification Method
• Data Flow Diagram
• Acceptance Criteria

KooCLI Command Format Standard

The hcloud IAM module maps directly to the Huawei Cloud IAM API operations.