network-eip-huawei-cloud-eip-cost-optimizer

Optimize Huawei Cloud Elastic IP costs by listing, analyzing idle EIPs, generating reports, monitoring with alerts, and auditing operations using read-only S...

Huawei Cloud EIP Cost Optimizer

Overview

This skill provides batch management and cost optimization capabilities for Huawei Cloud Elastic Public IPs (EIPs).

Architecture: Python SDK v2 → EIP Service API → VPC/Bandwidth/Tag resources

Related Skills: For broader cost optimization across all resource types (ECS, EVS, OBS, etc.), see the archived huaweicloud-cost-optimizer skill. This skill focuses exclusively on EIP optimization with deeper functionality and 100% Python SDK compliance.

• Periodic cleanup of idle EIPs to reduce holding costs
• Cost analysis and optimization recommendations
• Multi-region unified management
• Automated monitoring and alerting for idle resources
• Operation audit logging for compliance

Typical Use Cases:

• "Help me identify idle EIPs and generate an optimization report"
• "Generate an EIP cost analysis report to identify high-cost resources"
• "Set up idle EIP monitoring with automatic alerts via webhook or email"
• "View EIP distribution and status summary across all regions"
• "Show audit logs for EIP operations in the last 30 days"
• "List all EIPs in cn-north-4 with detailed information"

Prerequisites

1. Python Environment Requirements (MANDATORY)

• Python 3.8+
• Install SDKs: pip install huaweicloudsdkeip huaweicloudsdkcore
• All scripts use Python SDK v2 exclusively

Available Python Scripts:

• scripts/analyze_idle_eips.py - Analyze idle EIPs and generate optimization reports (read-only, no release capability)
• scripts/monitor_idle_eips.py - Monitor idle EIPs with webhook/email alerts and cron support
• scripts/eip_cost_report.py - Generate EIP cost analysis reports (HTML/JSON formats)
• scripts/list_eips.py - List all EIPs in a region (supports filtering and multi-region summary)

Available Shell Wrappers:

• scripts/eip_audit_log.sh - Operation audit logging (standalone, no SDK dependency)

Note: All scripts are READ-ONLY. This skill does NOT perform bandwidth adjustment, tag management, or EIP release/deletion.

• Valid Huawei Cloud credentials (AK/SK mode)
• Security Rules:
  • 🚫 Never expose AK/SK values in code, conversation, or commands
  • 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
  • ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION
  • ✅ Prefer IAM users over root account for cloud operations
  • ✅ Enable MFA for sensitive operations

Configuration Method (Environment Variables Only):

bash

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

⚠️ Important Security Notes:

• Never commit credentials to version control
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly

2. IAM Permission Requirements

Note: This skill is READ-ONLY for EIP resources. It does NOT perform any write operations (update, delete, tag management).

API Action	Permission	Purpose
vpc:publicIps:list	List EIPs	Query all EIPs and their status
vpc:publicIps:get	Get EIP details	View individual EIP information

See IAM Permission Policies for complete policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md
2. Display the required permission list and policy JSON to the user
3. Guide the user to create a custom policy in the IAM console and grant authorization
4. Pause execution and wait for user confirmation that permissions have been granted

Python SDK API Format Standard

All EIP operations use the Python SDK v2 format:

EIP Service API (v2 SDK)

python

from huaweicloudsdkeip.v2 import EipClient, ListPublicipsRequest, ShowPublicipRequest
from huaweicloudsdkeip.v2.region.eip_region import EipRegion
from huaweicloudsdkcore.auth.credentials import BasicCredentials

# Initialize client
credentials = BasicCredentials(ak, sk)
client = EipClient(credentials, EipRegion.value_of(region))

# List all EIPs
request = ListPublicipsRequest()
request.limit = 100
response = client.list_publicips(request)

# Show EIP details
request = ShowPublicipRequest()
request.publicip_id = "<eip-id>"
response = client.show_publicip(request)

Tag Management API

python

from huaweicloudsdkeip.v2 import UpdatePublicipRequest, UpdatePublicipOption, UpdatePublicipRequestBody
from huaweicloudsdkeip.v2.model.tag import Tag

# Add tags to EIP
option = UpdatePublicipOption()
option.tags = [Tag(key="env", value="prod")]
body = UpdatePublicipRequestBody()
body.publicip = option

request = UpdatePublicipRequest()
request.publicip_id = "<eip-id>"
request.body = body

client.update_publicip(request)

Special Rules

Rule	Description	Example
v2 SDK	EIP operations use v2 SDK	huaweicloudsdkeip.v2
Region parameter	Use EipRegion.value_of(region)	EipRegion.value_of('cn-north-4')
Credentials	Use BasicCredentials(ak, sk)	Environment variables preferred

Core Commands

EIP Query

Python SDK Method (Recommended):

bash

# List all EIPs with bandwidth info
python3 scripts/adjust_eip_bandwidth.py --list

# Analyze idle EIPs and generate report (read-only)
python3 scripts/analyze_idle_eips.py

# Adjust bandwidth for all EIPs
python3 scripts/adjust_eip_bandwidth.py --all --bandwidth 5

# Adjust bandwidth for idle EIPs only
python3 scripts/adjust_eip_bandwidth.py --idle-only --bandwidth 1

2. jq Dependency (Shell Wrappers Only)

Required for: eip_audit_log.sh

bash

# Verify jq installation
jq --version  # Should return "jq-1.x"

# If jq fails or shows "Not Found", diagnose:
which jq
cat $(which jq)  # If this shows text instead of binary, jq is broken

# Fix broken jq (common in WSL):
sudo rm /usr/local/bin/jq  # Remove invalid PATH-prioritized jq
which jq  # Should now show /usr/bin/jq

Note: jq is only required for Shell wrapper scripts. All Python SDK scripts work without jq.

Python SDK Method (Recommended for batch operations):

bash

# Adjust all EIPs to 5 Mbps
python3 scripts/adjust_eip_bandwidth.py --all --bandwidth 5

# Adjust idle EIPs to 1 Mbps
python3 scripts/adjust_eip_bandwidth.py --idle-only --bandwidth 1

# Adjust specific EIPs
python3 scripts/adjust_eip_bandwidth.py --eip-ids "eip-id1,eip-id2" --bandwidth 10

# View current bandwidth configuration
python3 scripts/adjust_eip_bandwidth.py --list

Tag Management

Python SDK Method:

bash

# Add tags to EIP
python3 scripts/manage_tags.py --action add --tags "env=prod,team=backend" --eip-ids <ID1,ID2>

# Remove tags from EIP
python3 scripts/manage_tags.py --action remove --tags "env" --eip-ids <ID1,ID2>

# List tags for EIP
python3 scripts/list_eips.py --region cn-north-4  # Shows tags in output

Multi-Region Management

Using Python Scripts (Recommended):

bash

# List EIPs in multiple regions (manually specify regions)
python3 scripts/list_eips.py --region cn-north-4
python3 scripts/list_eips.py --region cn-east-3
python3 scripts/list_eips.py --region cn-south-1

# Generate summary report for automation
python3 scripts/list_eips.py --region cn-north-4 --summary
# Output: CSV format (count,idle,bandwidth)

Note: The multi_region_manage.sh wrapper was removed in v3.0.3. Users can achieve the same functionality by running list_eips.py for each region individually, or by scripting multiple calls in their own automation.

Operation Audit Logging

Using Audit Script:

bash

# Log an EIP release operation
bash scripts/eip_audit_log.sh --action release --eip-id eip-xxx --operator admin

# Log a bandwidth adjustment
bash scripts/eip_audit_log.sh --action update_bandwidth --eip-id eip-xxx --details '{"old": 5, "new": 10}'

# Query audit logs for last 30 days
bash scripts/eip_audit_log.sh --query --days 30

# Export audit logs to CSV
bash scripts/eip_audit_log.sh --export --format csv

# Export to HTML report
bash scripts/eip_audit_log.sh --export --format html

Audit Log Entry Format (JSONL):

json

{
  "timestamp": "2026-05-25T03:30:00Z",
  "operation": "release",
  "eip_id": "eip-xxx",
  "operator": "admin",
  "region": "cn-north-4",
  "details": {"reason": "idle_cleanup", "cost_saved": "2.5"}
}

Parameter Confirmation

Python Script Parameters

Parameter	Required/Optional	Description	Default
--region	Optional (Python scripts)	Huawei Cloud region ID	HUAWEI_CLOUD_REGION or cn-north-4
--eip-ids	Optional (scripts)	Comma-separated EIP IDs	All EIPs
--bandwidth	Required (adjust script)	Target bandwidth in Mbps	N/A
--all	Optional	Apply to all EIPs	false
--idle-only	Optional	Apply to idle EIPs only	false
--list	Optional	List EIPs with bandwidth info	false
--summary	Optional (list_eips.py)	Output CSV stats (count,idle,bandwidth)	false
--idle-days	Optional (scripts)	Idle threshold in days	7
--interactive	Optional (scripts)	Interactive confirmation mode	false
--confirm	Optional (release script)	Confirm release operation	false

Shell Wrapper Parameters

Script	Parameter	Description
eip_audit_log.sh	--action ACTION	Log operation (release, create, update)
eip_audit_log.sh	--eip-id ID	EIP ID for audit log
eip_audit_log.sh	--query	Query audit logs
eip_audit_log.sh	--export --format csv	Export audit logs

Output Format

EIP List Output (JSON)

json

{
  "publicips": [
    {
      "id": "eip-xxx1",
      "public_ip_address": "123.45.67.89",
      "bandwidth": { "size": 5 },
      "status": "ACTIVE",
      "binding_status": "BOUND",
      "associate_instance_type": "ECS",
      "create_time": "2026-04-15T10:30:00Z"
    }
  ]
}

Script Output (Formatted Text)

text

========================================
Huawei Cloud EIP List (Region: cn-north-4)
========================================
EIP ID: eip-xxx1, IP: 123.45.67.89, BW: 5 Mbps, Status: BOUND (ECS: ecs-xxx)
EIP ID: eip-xxx2, IP: 98.76.54.32, BW: 10 Mbps, Status: UNBOUND ⚠️
========================================
Total: 2 EIPs, Idle: 1

Cost Report Output (HTML)

Generated by scripts/eip_cost_report.py — includes statistics cards, idle EIP table, full EIP list, and optimization recommendations.

Verification

See Verification Method

Compliance Check Script

Before any skill update or release, run the automated compliance check:

bash

# Run compliance check
python3 scripts/compliance_check.py

# Verbose mode (show all findings)
python3 scripts/compliance_check.py --verbose

Checks performed:

1. All required Python SDK scripts exist
2. No hardcoded credentials (AK/SK)
3. No hardcoded local paths
4. SKILL.md metadata correctness

Exit codes:

• 0 - All checks passed, skill is compliant
• 1 - Compliance issues found, must fix before release

Best Practices

1. Use Python SDK Scripts EXCLUSIVELY: Always use scripts/adjust_eip_bandwidth.py, scripts/analyze_idle_eips.py, and scripts/monitor_idle_eips.py
2. Regular Monitoring: Set up daily cron jobs with monitor_idle_eips.py --setup-cron to catch idle EIPs early
3. Tag Governance: Use consistent tags (env, team, project) for all EIPs
4. Bandwidth Policy: Set minimum bandwidth (1 Mbps) for idle EIPs to reduce costs before release
5. Interactive Mode: Always use --interactive flag for release operations in production
6. Audit Logging: Enable audit logging for all EIP operations using scripts/eip_audit_log.sh --action <operation> --eip-id <id>
7. Multi-Region Management: Run list_eips.py for each region individually, or use --summary flag for programmatic access to EIP statistics
8. Bandwidth Policy: Set minimum bandwidth (1 Mbps) for idle EIPs to reduce costs before release
9. Summary Mode for Automation: Use list_eips.py --summary for programmatic access to EIP statistics (returns CSV: count,idle,bandwidth)
10. Documentation Synchronization: When updating SKILL.md, ALWAYS update SKILL-CN.md simultaneously to maintain bilingual consistency. Both documents must have identical structure, parameters, and examples.
11. Shell Wrapper Audit: After any migration or script deletion, audit ALL Shell wrappers for broken dependencies using grep -r "<deleted-script>.sh" scripts/. Test each wrapper before marking compliance complete.
12. jq Dependency Validation: Before using audit log or multi-region scripts, verify jq is correctly installed: jq --version should return "jq-1.x". If it fails or shows "Not Found", check for broken PATH-prioritized installations at /usr/local/bin/jq and remove them.
13. Use Case Coverage Audit: Before any skill release, verify typical use cases cover 100% of scripts. Run: grep -A 20 "Typical Use Cases" SKILL.md | grep -c "^- \"" - should be 9+ for full coverage. Missing use cases indicate undocumented functionality.

Reference Documents

Document	Description
IAM Permission Policies	Required permissions and policy JSON
EIP API Guide	EIP API reference (Python SDK v2)
Verification Method	Step-by-step verification
Python SDK Usage Guide	Python SDK patterns, common errors, and working examples. See "Issue 4" for critical bandwidth adjustment API pitfalls.

Notes

• Cost estimates are for reference only — based on cn-north-4 on-demand pricing (~¥2-4/Mbps/month). Actual costs may vary by region and billing mode.
• This skill is READ-ONLY — it analyzes and reports idle EIPs but does NOT release or delete any resources. Manual action in the console is required to release EIPs.
• EIP release is irreversible — if you choose to release idle EIPs based on the analysis report, the public IP address will be reclaimed and cannot be recovered. Always verify before releasing manually.
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables.
• Python SDK is the only supported method — all scripts use Python SDK v2 natively.
• Bandwidth adjustment API: Uses BatchModifyBandwidth API (NOT UpdatePublicip or UpdateBandwidth).

Common Pitfalls

See Common Pitfalls & Solutions for detailed troubleshooting guides.

Quick Reference:

Pitfall	Symptom	Quick Fix
jq path issues	eip_audit_log.sh fails	sudo rm /usr/local/bin/jq
Wrong bandwidth API	VPC.0301 error	Use BatchModifyBandwidthRequest
Missing bandwidth_id	Empty bandwidth ID	Access eip.bandwidth_size directly
v3 SDK import error	No EipRegion attribute	Use v2 SDK
Timestamp parsing	Unknown idle days	Handle ISO format