huawei-cloud-smn-dms-message

Manage Huawei Cloud SMN (Simple Message Notification) topics, subscriptions, message templates and message publishing, and manage DMS (Distributed Message Service) Kafka/RabbitMQ/RocketMQ instances and Kafka topics. 15 built-in actions cover query (list topics/subscriptions/message templates/DMS instances/Kafka topics), diagnosis (subscription confirmation status, DMS instance health & capacity), management (create topic, add subscription, create message template, publish message, create DMS instance) and destructive operations (delete SMN topic, confirm subscription, delete DMS instance). KooCLI has no DMS command; the three engine services are the only DMS entry points. Supports both AK/SK and local KooCLI profile authentication. Use this skill when the user wants to: (1) list or create SMN topics and subscriptions, (2) send or diagnose notifications, (3) inspect SMN subscription confirmation status, (4) list, create, or delete DMS Kafka/RabbitMQ/RocketMQ instances, (5) list Kafka topics, (6) analyze DMS instance health or capacity. Triggers include: "SMN", "SMN主题", "消息通知", "subscribe", "topic", "发布消息", "推送消息", "notification", "DMS", "Kafka", "RabbitMQ", "RocketMQ", "消息队列", "实例", "订阅", "消息模板", "MQS"

Huawei Cloud SMN / DMS Messaging Skill

Overview

This skill provides 15 huawei_* actions for Huawei Cloud SMN (Simple Message Notification) and DMS (Distributed Message Service). Only Huawei Cloud is supported; operations against other cloud providers are out of scope. SMN handles pub/sub notifications (topic → subscription → message). DMS is the product umbrella for three message-queue engines: Kafka, RabbitMQ, RocketMQ.

Critical architecture rule: KooCLI has no DMS service of its own. DMS is exposed as three independent services: Kafka, RabbitMQ, RocketMQ (callable as hcloud <service>). Every DMS operation must first determine the engine, then call the matching service. Never issue a DMS command.

text

┌────────────────┐     ┌────────────────┐     ┌─────────────────────────────┐
│ hcloud SMN     │     │ hcloud Kafka   │     │ hcloud RabbitMQ / RocketMQ  │
│ topics/subs/   │     │ instances &    │     │ instances & delete ops      │
│ templates/msgs │     │ topics         │     │                             │
└────────────────┘     └────────────────┘     └─────────────────────────────┘

Precedence of Action Families (Risk-Based Execution)

Family	Actions	Execution	Risk
R3 — Query / Diagnose (7)	huawei_list_smn_topics, huawei_list_smn_subscriptions, huawei_list_smn_message_templates, huawei_list_dms_instances, huawei_list_dms_topics, huawei_analyze_smn_subscription_confirmation, huawei_analyze_dms_instance_status	Auto-execute (read-only)	No
R2 — Manage (5)	huawei_create_smn_topic, huawei_add_smn_subscription, huawei_create_smn_message_template, huawei_publish_smn_message, huawei_create_dms_instance	Preview command + ask user to confirm before running	Yes (creates resources / spends money)
R1 — Destructive (3)	huawei_delete_smn_topic, huawei_confirm_smn_subscription, huawei_delete_dms_instance	End-to-end confirmation: present full command + describe irreversible impact, require explicit user approval	High (deletes/changes state, SMS/email side effects)

Prerequisites

Prerequisite check 1/3: KooCLI (hcloud) 2.x+ installed and authenticated

Install and configure the Huawei Cloud KooCLI:

bash

curl -O https://cn-north-4-hcli.obs.cn-north-4.myhuaweicloud.com/hcli_install.sh && bash hcli_install.sh
# verify: hcloud --help should print the KooCLI version banner

Prerequisite check 2/3: Authentication — AK/SK or hcloud profile (either is supported)

Auth mode	How to configure	When to use
Local hcloud profile	Run hcloud configure set --cli-mode=AKSK --cli-region=cn-north-4 interactively, then enter AK/SK	Recommended; commands run exactly as documented below
AK/SK environment variables	export HUAWEICLOUD_SDK_AK=<ak> and export HUAWEICLOUD_SDK_SK=<sk> (optional HUAWEICLOUD_SDK_SECURITY_TOKEN)	CI / ephemeral runtimes; KooCLI reads these automatically

Verify a profile exists (values are never printed):

bash

# hcloud configure list | head -5   (only metadata is shown, keys are masked)

--project_id and --cli-region are auto-resolved by KooCLI from the profile / authentication info; you normally do not pass them.

Prerequisite check 3/3: IAM permissions

The account must hold the SMN and DMS permissions listed in references/iam-policies.md (e.g., SMN Administrator, DMS User, or least-privilege policies from the same file).

• See references/cli-installation-guide.md for full install/auth details.
• See references/verification-method.md to verify the skill works.

Authentication

Security rules (must be followed):

• Prohibited from reading, echoing, or printing AK/SK values.
• Prohibited from asking the user to input AK/SK directly in the conversation.
• Prohibited from using hcloud configure set with plaintext credential values pasted in chat.
• Prohibited from hardcoding AK/SK in scripts or command lines.
• Allowed: reference the configured hcloud profile, or use HUAWEICLOUD_SDK_AK / HUAWEICLOUD_SDK_SK environment variables set out-of-band.

If the user offers AK/SK inline, refuse politely and point them to the two auth modes above.

Workflow

1. Determine scope — SMN or DMS? For DMS, ask/confirm the engine (kafka, rabbitmq, rocketmq) and choose the matching KooCLI service.
2. Route the action to one of the 15 huawei_* actions below.
3. Risk gate:
   • R3 query/diagnose → run immediately, summarize results.
   • R2 manage → build the exact hcloud command, show it to the user, and wait for confirmation before executing.
   • R1 destructive → show the exact command with its impact (what will be deleted / which endpoint will receive a confirmation), require explicit end-to-end confirmation, then execute.
4. Interpret output — SMN commands return JSON; subscription status field: 0=unconfirmed, 1=confirmed, 2=no confirmation required, 3=cancelled, 4=deleted. DMS status values include RUNNING (healthy) and CREATING/ERROR/DELETING/FROZEN/EXTENDING etc.
5. Report — summarize created/updated/removed resources, and confirm no output contains credentials.

Core Commands

Always run hcloud <Service> <Operation> --help first to re-confirm parameter names before constructing a command, especially for create operations.

R3 — Query (auto-execute)

huawei_list_smn_topics — List SMN topics

bash

hcloud SMN ListTopics --cli-region={region} --limit=20 --offset=0

Parameter	Required	Description
--cli-region	Yes (auto)	Region, agent fills automatically
--limit	No	1–100, default 100
--offset	No	Page offset, default 0
--name	No	Exact topic name match
--fuzzy_name	No	Fuzzy topic name search

huawei_list_smn_subscriptions — List SMN subscriptions

bash

hcloud SMN ListSubscriptions --cli-region={region} --limit=20 --offset=0

Parameter	Required	Description
--cli-region	Yes (auto)	Region
--protocol	No	http | https | sms | email | functionstage
--status	No	0=unconfirmed 1=confirmed 2=no confirm 3=cancelled 4=deleted
--limit / --offset	No	Pagination

huawei_list_smn_message_templates — List SMN message templates

bash

hcloud SMN ListMessageTemplates --cli-region={region} --limit=20

Parameter	Required	Description
--cli-region	Yes (auto)	Region
--message_template_name	No	Template name, 1–64 chars
--protocol	No	default | email | sms | functionstage | http | https

huawei_list_dms_instances — List DMS instances by engine

bash

# Kafka
hcloud Kafka ListInstances --engine=kafka --cli-region={region} --limit=20 --offset=0
# RabbitMQ
hcloud RabbitMQ ListInstancesDetails --engine=rabbitmq --cli-region={region} --limit=20 --offset=0
# RocketMQ
hcloud RocketMQ ListInstances --engine=rocketmq --cli-region={region} --limit=20 --offset=0

Parameter	Required	Description
--engine	Yes	kafka | rabbitmq | rocketmq (fixed per engine)
--cli-region	Yes (auto)	Region
--status	No	RUNNING | CREATING | ERROR | DELETING | ...

huawei_list_dms_topics — List Kafka topics of an instance

bash

hcloud Kafka ListInstanceTopics --instance_id={instance_id} --cli-region={region} --limit=20 --offset=0

Parameter	Required	Description
--instance_id	Yes	Kafka instance ID (from huawei_list_dms_instances)
--cli-region	Yes (auto)	Region

R3 — Diagnose (auto-execute)

huawei_analyze_smn_subscription_confirmation — Subscription confirmation status analysis

bash

hcloud SMN ListSubscriptions --cli-region={region}

Analyze the result: status=0 subscriptions have not been confirmed — HTTP/HTTPS endpoints must implement the ping-back confirmation, email endpoints require the user to click the confirmation link. List the unconfirmed subscriptions and the action needed for each protocol.

Parameter	Required	Description
--cli-region	Yes (auto)	Region
--topic_urn	No	Analyze a single topic
--protocol	No	Focus on one protocol

huawei_analyze_dms_instance_status — DMS instance health & capacity analysis

bash

hcloud Kafka ListInstances --engine=kafka --cli-region={region}     # then per instance:
hcloud Kafka ShowInstance --instance_id={instance_id} --cli-region={region}

Analyze: instance status (RUNNING healthy; ERROR/FROZEN/CREATEFAILED unhealthy), storage usage, restart/maintain state, broker count. Follow the same pattern with RabbitMQ/RocketMQ for other engines.

Parameter	Required	Description
--engine	Yes	Engine
--instance_id	Yes (for ShowInstance)	Instance ID

R2 — Manage (preview + confirm)

huawei_create_smn_topic — Create a topic

bash

hcloud SMN CreateTopic --name={name} --display_name={display_name} --cli-region={region}

Parameter	Required	Description
--name	Yes	1–255 chars, letters/digits/-/_, must start with letter/digit
--display_name	Yes	Display name shown as sender in email (may be empty string)
--enterprise_project_id	No	Enterprise project

huawei_add_smn_subscription — Add a subscription to a topic

bash

hcloud SMN AddSubscription --topic_urn={topic_urn} --protocol={protocol} --endpoint={endpoint} --cli-region={region}

Parameter	Required	Description
--topic_urn	Yes	Topic resource identifier
--protocol	Yes	email | sms | http | https | functionstage | dingding | wechat | feishu | welink
--endpoint	Yes	Per protocol: email address, phone, http(s):// URL, FunctionGraph ARN, chatbot webhook
--remark	No	Remarks, ≤128 bytes

⚠️ After adding, HTTP/HTTPS subscriptions need endpoint ping-back confirmation; email subscriptions need the user to click the confirmation link — the subscription stays status=0 until then.

huawei_create_smn_message_template — Create a message template

bash

hcloud SMN CreateMessageTemplate --message_template_name={message_template_name} --content={content} --cli-region={region}

Parameter	Required	Description
--message_template_name	Yes	1–64 chars, start with letter/digit
--content	Yes	Plain-text template content, ≤256 KB; supports ${variable} placeholders
--protocol	No	default | email | sms | functionstage | http | https

⚠️ SMS is billed per delivered message — publishing via SMS-inclined templates incurs per-message charges.

huawei_publish_smn_message — Publish a message to a topic

bash

hcloud SMN PublishMessage --topic_urn={topic_urn} --message={message} --cli-region={region}

Parameter	Required	Description
--topic_urn	Yes	Topic resource identifier
--message	Yes (or --message_structure/--message_template_name)	≤256 KB; SMS ≤490 chars, no []
--subject	No	Email subject, ≤512 bytes
--message_template_name	No	Publish using a template
--tags.*	No	Template variable substitution, e.g. --tags.name=value
--time_to_live	No	Retention ≤86400 s, default 3600

huawei_create_dms_instance — Create a DMS instance (by engine)

bash

# Kafka
hcloud Kafka CreatePostPaidKafkaInstance --name={name} --engine=kafka --engine_version={engine_version} --product_id={product_id} --available_zones.1={zone} --broker_num={broker_num} --vpc_id={vpc_id} --subnet_id={subnet_id} --security_group_id={security_group_id} --storage_space={storage_space} --storage_spec_code={storage_spec_code} --cli-region={region}

# RabbitMQ
hcloud RabbitMQ CreatePostPaidInstanceByEngine --name={name} --engine=rabbitmq --engine_version={engine_version} --product_id={product_id} --available_zones.1={zone} --access_user={access_user} --password={password} --vpc_id={vpc_id} --subnet_id={subnet_id} --security_group_id={security_group_id} --storage_space={storage_space} --storage_spec_code={storage_spec_code} --cli-region={region}

# RocketMQ
hcloud RocketMQ CreateInstanceByEngine --name={name} --engine=rocketmq --engine_version={engine_version} --product_id={product_id} --available_zones.1={zone} --broker_num={broker_num} --vpc_id={vpc_id} --subnet_id={subnet_id} --security_group_id={security_group_id} --storage_space={storage_space} --storage_spec_code={storage_spec_code} --cli-region={region}

Parameter	Required	Description
--engine	Yes	kafka | rabbitmq | rocketmq
--name	Yes	Instance name
--engine_version	Yes	e.g. Kafka 2.7/3.3, RabbitMQ 3.8.35, RocketMQ 4.8.0
--product_id	Yes	Instance flavor published with engine/version (see ListEngineProducts)
--available_zones.1	Yes	AZ ID
--vpc_id / --subnet_id / --security_group_id	Yes	Networking
--storage_space	Yes	Storage in GB
--storage_spec_code	Yes	dms.physical.storage.high.v2 | dms.physical.storage.ultra.v2 | dms.physical.storage.general | dms.physical.storage.extreme
--broker_num	Yes (Kafka/RocketMQ)	Number of brokers
--access_user / --password	Yes (RabbitMQ)	RabbitMQ console credentials

Run hcloud Kafka ListEngineProducts --engine=kafka --cli-region={region} to get valid --product_id / --engine_version pairs before creating. Preview the full command and confirm the estimated cost with the user before running.

R1 — Destructive (end-to-end confirm)

huawei_delete_smn_topic — Delete a topic (and its subscriptions)

bash

hcloud SMN DeleteTopic --topic_urn={topic_urn} --cli-region={region}

Parameter	Required	Description
--topic_urn	Yes	Topic resource identifier

⚠️ Deleting a topic deletes all subscriptions and message history for it — require explicit user confirmation including the topic name.

huawei_confirm_smn_subscription — Confirm a pending subscription

bash

hcloud SMN ConfirmSubscription --token={token} --cli-region={region}

Parameter	Required	Description
--token	Yes	Confirmation token (from the HTTP ping-back request body or the email confirmation link)
--topic_urn	No	Topic resource identifier
--endpoint	No	Subscription endpoint IP

The token normally arrives at the subscribing endpoint (HTTP/HTTPS ping-back body, or the URL in the email confirmation link). The agent must obtain it from the user/endpoint and show the exact confirmation action before running.

huawei_delete_dms_instance — Delete a DMS instance

bash

# Kafka
hcloud Kafka DeleteInstance --instance_id={instance_id} --cli-region={region}
# RabbitMQ
hcloud RabbitMQ DeleteInstance --instance_id={instance_id} --cli-region={region}
# RocketMQ
hcloud RocketMQ DeleteInstance --instance_id={instance_id} --cli-region={region}

Parameter	Required	Description
--instance_id	Yes	DMS instance ID
--cli-region	Yes (auto)	Region

⚠️ Deleting a message-queue instance is irreversible and deletes all stored messages (topics, queues, offsets). Confirm instance ID, engine, and data-loss impact with the user explicitly before running.

Parameter Confirmation

• All commands use the exact parameter spelling verified against hcloud <Service> <Operation> --help. Do not invent parameter names.
• --cli-region and --project_id are resolved automatically from the hcloud profile / authentication; no user input needed.
• Required parameters are marked "Yes" in each table; optional parameters are described in each table and only added to a command when a value is needed.
• --help is the source of truth: run hcloud <Service> <Operation> --cli-region={region} --help before executing any non-trivial command.

KooCLI Command Format Standard

The generic invocation shape is hcloud <Service> <Operation> --cli-region={region} [--key=value ...] — this is a format description only: <...> and [...] are placeholders, never executed verbatim.

Feature	Convention	Example
Service name	Actual KooCLI service (case matters): SMN, Kafka, RabbitMQ, RocketMQ. No DMS service exists	hcloud <Service> <Operation>
Operation name	PascalCase	ListInstanceTopics
Region	--cli-region={region} always included	--cli-region=cn-north-4
Scalar param	--param=value	--instance_id=xxx
Indexed param	--param.N=value	--available_zones.1=cn-north-4a

RAM / Capacity Notes

• SMN topic display_name is required by the API but can be an empty string; unknown defaults tend to be rejected by parameter validation — always pass --display_name explicitly on CreateTopic.
• Kafka topic listing requires an instance ID; keep instance IDs from huawei_list_dms_instances output for reuse.
• Email/SMS/FunctionGraph notification endpoints each have protocol-specific validation; confirm the endpoint format before AddSubscription.

Reference Documents

• references/iam-policies.md — least-privilege IAM policies (required)
• references/cli-installation-guide.md — KooCLI install + auth setup (required)
• references/verification-method.md — how to verify this skill (recommended)
• references/dataflow-diagram.md — end-to-end data flow (recommended)
• references/acceptance-criteria.md — acceptance checks (recommended)
• references/engine-operation-reference.md — full SMN + DMS engine operation catalog (recommended)
• references/security-audit-guide.md — security audit how-to (recommended)