Huawei Cloud Security Group Management (安全组管理)

STOP - Do not answer from general knowledge. Follow the procedure below. Always run hcloud VPC <Operation> --help before constructing commands to discover exact parameter names and requirements.

Overview

This skill manages Huawei Cloud security groups (安全组) — the VPC subnet-level stateful firewall (security group is a VPC sub-resource). It provides 11 huawei_* actions:

Architecture

User request → Action Router (scripts/huawei-cloud.py dispatcher)
  ├─ Query (R3)      → hcloud VPC ListSecurityGroups/ListSecurityGroupRules/ShowSecurityGroup
  ├─ Analyze (R3)    → hcloud VPC ListSecurityGroupRules + deterministic rule engine
  │                     (priority-ordered matching, CIDR/port/protocol semantics)
  └─ Manage (R2/R1)  → preview → hcloud VPC Create/Update/Delete (confirmed only after user approval)

All cloud operations execute through the local hcloud (KooCLI) CLI — no Python SDK, no raw HTTP API calls. The bundled dispatcher builds and runs the hcloud commands.

Scope boundaries

• ✅ List/query security groups and their rules
• ✅ Port connectivity diagnosis (ingress/egress rule matching, priority-ordered)
• ✅ Rule conflict detection (duplicates, allow/deny contradictions, shadowed rules)
• ✅ Over-exposure audit (world-open 0.0.0.0/0 / ::/0, wide port ranges, ineffective denies)
• ✅ Create/update/delete security groups and rules (with preview + confirmation)
• ❌ Doesn't manage other VPC resources (VPCs, subnets, routers, firewalls, network queries) — those are out of scope for this skill
• ❌ Doesn't resolve remote-security-group / address-group member IPs (not exposed by the API)

Dependency: Quality telemetry is collected automatically via skill-quality-cli (installed by scripts/ensure_cli.sh if absent).

Critical Warnings

Prerequisites

1. hcloud CLI (KooCLI 7.2.x or later) installed and authenticated.
   • Installation and configuration guide:
   • Two supported authentication modes:
     • AK/SK credentials: environment variables HUAWEICLOUD_SDK_AK / HUAWEICLOUD_SDK_SK (or HUAWEI_ACCESS_KEY / HUAWEI_SECRET_KEY / HW_ACCESS_KEY / HW_SECRET_KEY)
     • Local hcloud profile: "hcloud configure list" must show a valid AKSK profile
   • Verify with "hcloud configure list"
2. Region: always pass --cli-region={region} (e.g. cn-north-4). --project_id is auto-filled from the authenticated profile when available; pass an explicit project_id= if the profile cannot resolve it.
3. IAM permissions: least-privilege policies in references/iam-policies.md (vpc:securityGroups:*, vpc:securityGroupRules:*).

• skill-quality-cli — ensured by bash scripts/ensure_cli.sh (idempotent, skips if present)
  • Upgrade: run skill-quality-cli upgrade manually (no auto-upgrade)
  • Disable telemetry report: set SKILL_QUALITY_REPORT=0

Workflow

1. Identify target → region, security_group_id / security_group_rule_id, filters
2. Classify intent →
   - Query/Analyze (R3): list / get / diagnose / conflict / audit — execute automatically
   - Manage (R2/R1): create / update / delete — ALWAYS preview first, then ask for
     explicit user confirmation before confirmed execution
3. Execute → dispatcher or the wrapped hcloud commands below
4. Output → structured JSON + readable summary

Confirmation gates (MUST NOT be skipped):

• R2 actions (huawei_create_security_group, huawei_create_sg_rule, huawei_update_security_group): show the full command and the resource to be created/updated, then ask "confirm?" before running. Execution requires confirmed=true.
• R1 actions (huawei_delete_security_group, huawei_delete_sg_rule): show the full command and side effects, print the connectivity-impact warning, and require explicit confirmation. Execution requires confirmed=true.
• The dispatcher enforces this at the tool level: without confirmed=true it only previews (prints the exact command + impact, no API call).

Core Commands

All direct hcloud commands below are shown in dual form: the bare executable command and the identical command wrapped with skill-quality-cli run --skill-name huawei-cloud-sg-manage -- for quality reporting. The bundled dispatcher (python3 scripts/huawei-cloud.py <action> key=value ...) is the recommended entry — it routes the 11 actions, builds the hcloud commands and prints JSON. No Python SDK package is needed for any business command.

1. Query (R3 — read-only, auto execute)

huawei_list_security_groups — list security groups:

> **⚠️ Mandatory: every direct `hcloud` command in this skill MUST be wrapped with `skill-quality-cli run --skill-name huawei-cloud-sg-manage -- ` — bare `hcloud` calls are strictly forbidden.**
> **Exception**: the bundled dispatcher (`python3 scripts/huawei-cloud.py <action> key=value ...`) is the recommended entry — it builds and executes `hcloud` commands internally with quality reporting attached. The wrapping requirement applies only to direct `hcloud VPC ...` CLI calls.

python3 scripts/huawei-cloud.py huawei_list_security_groups region=cn-north-4
python3 scripts/huawei-cloud.py huawei_list_security_groups region=cn-north-4 name=my-sg
# Direct CLI (optional filters: --name.1=, --id.1=, --enterprise_project_id=, --limit=)
skill-quality-cli run --skill-name huawei-cloud-sg-manage -- hcloud VPC ListSecurityGroups/v3 --cli-region={region}

huawei_list_security_group_rules — list security group rules (optionally filtered by SG):

python3 scripts/huawei-cloud.py huawei_list_security_group_rules region=cn-north-4
python3 scripts/huawei-cloud.py huawei_list_security_group_rules region=cn-north-4 security_group_id={sg_id}
# Direct CLI (optional filters: --security_group_id.1=, --direction=, --protocol.=, --action=, --enabled=)
skill-quality-cli run --skill-name huawei-cloud-sg-manage -- hcloud VPC ListSecurityGroupRules/v3 --cli-region={region}

huawei_get_security_group — show a security group's detail:

python3 scripts/huawei-cloud.py huawei_get_security_group security_group_id={sg_id} region=cn-north-4
# Direct CLI:
skill-quality-cli run --skill-name huawei-cloud-sg-manage -- hcloud VPC ShowSecurityGroup/v3 --cli-region={region} --security_group_id={sg_id}

2. Analyze (R3 — read-only, auto execute)

huawei_diagnose_sg_port_connectivity — port connectivity diagnosis. Evaluates the ingress/egress rules of one security group in priority order against a (direction, protocol, port, remote) probe and reports the effective verdict (ALLOW / DENY / INDETERMINATE) with the deciding rule:

# Is TCP/22 from 10.0.0.0/8 allowed inbound to this SG?
python3 scripts/huawei-cloud.py huawei_diagnose_sg_port_connectivity \
  security_group_id={sg_id} direction=ingress protocol=tcp port=22 remote=10.0.0.0/8 \
  region=cn-north-4
# Is outbound HTTPS allowed?
python3 scripts/huawei-cloud.py huawei_diagnose_sg_port_connectivity \
  security_group_id={sg_id} direction=egress protocol=tcp port=443 \
  region=cn-north-4

huawei_analyze_sg_rule_conflict — rule conflict detection (duplicates, allow/deny contradictions, shadowed rules). Runs against one SG, or all SGs when no SG is given:

python3 scripts/huawei-cloud.py huawei_analyze_sg_rule_conflict security_group_id={sg_id} region=cn-north-4
python3 scripts/huawei-cloud.py huawei_analyze_sg_rule_conflict region=cn-north-4

huawei_audit_sg_overexposed_rules — security audit identifying over-exposed rules (world-open 0.0.0.0/0 / ::/0 allows, wide port ranges, ineffective denies):

python3 scripts/huawei-cloud.py huawei_audit_sg_overexposed_rules security_group_id={sg_id} region=cn-north-4
python3 scripts/huawei-cloud.py huawei_audit_sg_overexposed_rules region=cn-north-4

3. Manage (R2 — preview + confirm)

huawei_create_security_group — create a security group:

# [W] 写操作 (WRITE): creates a security group — R2: preview + explicit confirmation required
# Step 1 — preview (no resource is changed):
python3 scripts/huawei-cloud.py huawei_create_security_group name={name} description={desc} region=cn-north-4
# Step 2 — execute ONLY after user approval:
python3 scripts/huawei-cloud.py huawei_create_security_group name={name} description={desc} region=cn-north-4 confirmed=true
# Direct CLI equivalent:
skill-quality-cli run --skill-name huawei-cloud-sg-manage -- hcloud VPC CreateSecurityGroup/v3 --cli-region={region} --security_group.name={name} --security_group.description={desc}

huawei_create_sg_rule — add a security group rule (direction is required; protocol, ports, ethertype and one of remote_ip_prefix / remote_group_id / remote_address_group_id are the key selectors):

# [W] 写操作 (WRITE): adds a security group rule — R2: preview + explicit confirmation required
# Step 1 — preview:
python3 scripts/huawei-cloud.py huawei_create_sg_rule \
  security_group_id={sg_id} direction=ingress protocol=tcp multiport=22 \
  ethertype=IPv4 remote_ip_prefix=10.0.0.0/8 action=allow priority=1 \
  region=cn-north-4
# Step 2 — execute ONLY after user approval:
python3 scripts/huawei-cloud.py huawei_create_sg_rule \
  security_group_id={sg_id} direction=ingress protocol=tcp multiport=22 \
  ethertype=IPv4 remote_ip_prefix=10.0.0.0/8 action=allow priority=1 \
  region=cn-north-4 confirmed=true
# Direct CLI equivalent:
skill-quality-cli run --skill-name huawei-cloud-sg-manage -- hcloud VPC CreateSecurityGroupRule/v3 --cli-region={region} --security_group_rule.security_group_id={sg_id} --security_group_rule.direction=ingress --security_group_rule.protocol=tcp --security_group_rule.multiport=22 --security_group_rule.remote_ip_prefix=10.0.0.0/8

huawei_update_security_group — update a security group's name/description:

# [W] 写操作 (WRITE): updates a security group — R2: preview + explicit confirmation required
python3 scripts/huawei-cloud.py huawei_update_security_group \
  security_group_id={sg_id} name={new_name} description={new_desc} region=cn-north-4
# ... then re-run with confirmed=true after user approval:
python3 scripts/huawei-cloud.py huawei_update_security_group \
  security_group_id={sg_id} name={new_name} description={new_desc} region=cn-north-4 confirmed=true
# Direct CLI equivalent:
skill-quality-cli run --skill-name huawei-cloud-sg-manage -- hcloud VPC UpdateSecurityGroup --cli-region={region} --security_group_id={sg_id} --security_group.name={new_name}

4. Manage (R1 — preview + confirm)

huawei_delete_security_group — delete a security group. IRREVERSIBLE — it removes the SG and ALL of its rules; instances/ports still associated will lose connectivity:

# [W] 写操作 (WRITE) — IRREVERSIBLE: deletes a security group and its rules — R1: explicit confirmation required
python3 scripts/huawei-cloud.py huawei_delete_security_group security_group_id={sg_id} region=cn-north-4
# ... then re-run with confirmed=true after user approval:
python3 scripts/huawei-cloud.py huawei_delete_security_group security_group_id={sg_id} region=cn-north-4 confirmed=true
# Direct CLI equivalent:
skill-quality-cli run --skill-name huawei-cloud-sg-manage -- hcloud VPC DeleteSecurityGroup/v3 --cli-region={region} --security_group_id={sg_id}

WARNING (must be shown before execution): the preview prints the SG name and how many rules will be deleted with it. Verify no running instance uses this SG (huawei_list_security_groups + port association check) before confirming.

huawei_delete_sg_rule — delete a security group rule. Changes live network connectivity — VPC default is DENY for unmatched traffic:

# [W] 写操作 (WRITE): deletes a security group rule — R1: explicit confirmation required
python3 scripts/huawei-cloud.py huawei_delete_sg_rule security_group_rule_id={rule_id} region=cn-north-4
# ... then re-run with confirmed=true after user approval:
python3 scripts/huawei-cloud.py huawei_delete_sg_rule security_group_rule_id={rule_id} region=cn-north-4 confirmed=true
# Direct CLI equivalent:
skill-quality-cli run --skill-name huawei-cloud-sg-manage -- hcloud VPC DeleteSecurityGroupRule/v3 --cli-region={region} --security_group_rule_id={rule_id}

WARNING (must be shown before execution): traffic previously permitted/denied by this rule may be allowed or blocked immediately after deletion. Confirm the rule id, direction, ports and remote from the preview before proceeding.

KooCLI Command Format Standard

Parameter Confirmation

All parameters below were verified against hcloud VPC <Operation> --help (KooCLI 7.2.12). Common to all commands: --cli-region (required), --project_id (required by API but auto-filled from the authenticated profile when omitted).

ListSecurityGroups/v3

ListSecurityGroupRules/v3

ShowSecurityGroup/v3 / ShowSecurityGroupRule/v2

CreateSecurityGroup/v3

CreateSecurityGroupRule/v3

UpdateSecurityGroup

DeleteSecurityGroup/v3 / DeleteSecurityGroupRule/v3

Troubleshooting

Security Considerations

• MUST preview every R2/R1 manage action and obtain explicit user confirmation (confirmed=true only after approval).
• MUST show the connectivity-impact warning before deleting rules or security groups.
• MUST treat 0.0.0.0/0 / ::/0 allow rules as high risk (huawei_audit_sg_overexposed_rules flags them; restrict to real CIDRs).
• MUST NOT echo AK/SK or any credential values in commands, outputs or reports.
• SHOULD run huawei_diagnose_sg_port_connectivity before changing rules that affect business traffic.
• SHOULD audit security groups periodically with huawei_audit_sg_overexposed_rules.

Reference Documents

• references/iam-policies.md — Least-privilege IAM policies (vpc:securityGroups:*, vpc:securityGroupRules:*)
• references/sg-rule-reference.md — Security-group rule field semantics (direction/ethertype/protocol/ports/priority/action)
• references/dataflow-diagram.md — Mermaid data flow diagram
• references/verification-method.md — Verification method and acceptance checks
• references/acceptance-criteria.md — Acceptance criteria for the 11 huawei_* actions
• VPC security group docs: https://support.huaweicloud.com/usermanual-vpc/vpc_SecurityGroup_0001.html
• API Explorer: https://console.huaweicloud.com/apiexplorer/#/openapi/VPC/doc