Automate batch creation and management of Huawei Cloud CES alarm rules for ECS instances using hcloud CLI v7.2.2+. Use this skill to: (1) batch create alarms with templates (web/database), (2) update SMN notifications, (3) query ECS metrics and alarm lists.
❌ Hardcoding AK/SK is prohibited (must use environment variables or hcloud configure)
Prohibited Operations
The following operations are strictly prohibited, even if requested by the user:
Prohibited Operation
API/Command
Reason
Expose AK/SK
Any command that outputs AK/SK in plaintext
Account security risk
Accept AK/SK from user
Receiving credentials in conversation
Violates security best practices
❌ Delete alarm rule
DeleteAlarm / hcloud CES DeleteAlarm
Irreversible; deleted alarms cannot be recovered, may cause monitoring gaps
❌ Batch delete alarms
Any batch deletion operation
High risk; may accidentally delete critical monitoring rules
If a user requests a delete operation, must refuse and guide:
"Per security constraints, this skill does not support delete operations (delete alarm/batch delete). Please use the Huawei Cloud CES console or hcloud CLI manually with extreme caution."
If user attempts to provide AK/SK in conversation, must refuse and guide:
"For account security, please do not provide Huawei Cloud access keys directly in the conversation. Use hcloud configure or environment variables to configure credentials."
Unsupported Operations
The following operations are NOT supported by this skill (no script wrapper is provided). If a user requests them, clearly state the limitation and provide the alternative. Do not attempt to improvise commands that this skill has not tested.
Unsupported Operation
Corresponding API
Alternative
Query alarm history
ShowAlarmHistory
View in CES console; or run hcloud CES ListAlarmHistories/v1 manually
Enable/disable an alarm rule
UpdateAlarm
Operate in CES console (not wrapped by this skill)
Modify alarm threshold/metric
UpdateAlarm
Delete and recreate the rule; to change only notifications, use ./scripts/update_alarm_notifications.sh
Create an SMN topic
CreateTopic
Create in SMN console; or run hcloud SMN CreateTopic manually
Create a monitoring dashboard
CreateOneDashboard
Operate in CES console
View a single alarm rule detail
ShowAlarm
Use ./scripts/list_alarms.sh --name <pattern> to filter
If a user requests one of these operations, respond:
"This skill does not support . Use the Huawei Cloud CES/SMN console, or the equivalent hcloud CLI command manually: . You may also request an enhancement via the skill's issue tracker."
Workflow
The standard workflow of this skill is as follows:
text
1. Environment setup → Configure hcloud CLI credentials (hcloud configure or env vars)
2. Query resources → ./scripts/list_ecs.sh to get ECS instance list
3. Create alarms → ./scripts/create_alert_rules.sh --template web --ecs-ids <ids>
4. Configure notify → ./scripts/manage_notifications.sh --action create ...
5. Verify results → ./scripts/list_alarms.sh to confirm alarm rules created
6. Continuous monitor → ./scripts/batch_query_metrics.sh to query metrics
Write operation confirmation: Step 3 (create alarms), Step 4 (create/delete subscriptions), update notification config, and other write operations require user confirmation of operation content and target resources before execution.
Core Commands
Query Commands (read-only, no confirmation needed)
bash
# List ECS instances
./scripts/list_ecs.sh [--name <filter>] [--format json]
# List alarm rules
./scripts/list_alarms.sh [--name <filter>] [--format json]
# List SMN topics and subscriptions
./scripts/list_subscriptions.sh [--topics | --subscriptions]
# Batch query monitoring metrics
./scripts/batch_query_metrics.sh --ecs-ids <ids> --metric cpu_util --period 1h
Create Commands (write operations, require user confirmation)
Prerequisite 1: Huawei Cloud CLI (hcloud / KooCLI) >= 7.2.2
Run hcloud version to verify version >= 7.2.2. If not installed or version is too low,
see references/cli-installation-guide.md for installation guide.
hcloud CLI configuration (recommended): hcloud configure interactive setup, credentials encrypted and stored in ~/.hcloud/config.json
Per-call AK/SK: pass --cli-access-key=<AK> --cli-secret-key=<SK> on each command (for automation; note: appears in process list)
⚠️ IMPORTANT: hcloud (KooCLI) authenticates ONLY via ~/.hcloud/config.json (from hcloud configure) or the --cli-access-key/--cli-secret-key arguments. It does NOT read HW_ACCESS_KEY, HW_SECRET_KEY, HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION, or HUAWEI_CLOUD_SECURITY_TOKEN environment variables — such variables are silently ignored (hcloud falls back to config.json). Do not instruct users to export these env vars as a way to authenticate hcloud.
Credential source for this skill's scripts: The bundled Shell scripts are thin wrappers around hcloud CLI. They read the region from HW_REGION_NAME/HUAWEI_CLOUD_REGION (or default to cn-north-4) to set --cli-region, but authentication always comes from hcloud configure. Configure credentials once with hcloud configure, then the scripts work.
If output does not contain valid configuration, stop operation and guide user to configure.hcloud Parameter Format Requirement
hcloud (KooCLI) all parameters must use --param=value format (equals sign connection), does not support space
separation.
✅ Correct: hcloud CES ListAlarmRules --cli-region=cn-north-4
❌ Incorrect: hcloud CES ListAlarmRules --cli-region cn-north-4
This skill provides 8 Shell scripts, encapsulating common hcloud commands, supporting batch operations and formatted
output.
**Script List and Usage Examples (Click to Expand)**
AK/SK: Via hcloud configure (recommended, stored in ~/.hcloud/config.json) — hcloud CLI does NOT read AK/SK environment variables
Security Token (optional): For temporary STS credentials, use hcloud configure --cli-mode=AKSK + --cli-security-token or pass --cli-security-token=<token> per command
Region: Via --cli-region parameter or HUAWEI_CLOUD_REGION/HW_REGION_NAME env var (default: cn-north-4)
CLI Version Requirement: Must use hcloud CLI v7.2.2 or later. Older versions may not support certain API parameter formats.
Region Consistency: All operations must specify the same region (--cli-region or HUAWEI_CLOUD_REGION environment variable). Cross-region operations will fail.
Alarm Threshold Range: CPU/memory utilization thresholds must be between 0-100. Disk usage threshold is recommended to be set between 80-95.
Monitoring Data Delay: CES monitoring data typically has a 5-minute delay. Querying real-time data may return empty results.
SMN Subscription Creation:
✅ Recommended: Use ./scripts/create_email_subscription.sh script, which automatically uses hcloud CLI configured credentials (no need to manually set environment variables)
✅ Alternative: Use Huawei Cloud Console (SMN → Topics → Subscribe) for subscription creation
⚠️ Note: Email/SMS subscriptions require confirmation before receiving notifications. Check your email and click the confirmation link.
Batch Operation Limits: Single batch creation is recommended for no more than 20 ECS instances. Too many instances may cause API timeout.
Credential Security:
✅ Recommended: Use hcloud configure — credentials stored encrypted in ~/.hcloud/config.json, which is the ONLY credential source hcloud CLI reads
⚠️ Region env var only (NOT auth): HUAWEI_CLOUD_REGION / HW_REGION_NAME set the scripts' --cli-region default
❌ Misleading: export HW_ACCESS_KEY/HW_SECRET_KEY or export HUAWEI_CLOUD_AK/HUAWEI_CLOUD_SK do NOT authenticate hcloud (env vars are ignored)
❌ Prohibited: Hardcode AK/SK in scripts or configuration files
Authentication: hcloud CLI authenticates ONLY via ~/.hcloud/config.json (from hcloud configure) or --cli-access-key/--cli-secret-key per-command arguments. Environment variables for AK/SK/token are silently ignored. Do not document env-var export as a working authentication method.
