huawei-cloud-config-helper

Queries Huawei Cloud Config service for global resource inventory, resource configurations, resource schemas, advanced SQL queries, and built-in compliance rules. Read-only. Use this skill when the user needs to query cloud resources, audit configurations, check compliance, inventory assets, analyze resource relationships, or run complex SQL resource queries. Triggers include: Config, 配置审计, 资源查询, 资源审计, 合规规则, 合规检查, 资源盘点, 资源Schema, 高级查询, SQL查询, 云上资产, resource inventory, compliance rule, resource schema, SQL query.

⚠️ Execution Method (Must Read): This skill executes queries via local Python scripts. Using hcloud, curl, or other CLI tools or direct API calls is prohibited.

• Query scripts are located under the skill directory scripts/config/
• All scripts are inside the skill package. You must use skill action=exec to execute them; do not run them directly in a shell
• All paths are relative to the skill directory, which is the directory where this SKILL.md resides

Overview 概述

This skill is a standalone read-only query skill that uses local Python scripts to call the Huawei Cloud Python SDK to query the Config service, providing:

1. 查询资源概览（各服务/类型/区域的资源数量统计）
2. 查询资源 Schema（资源结构定义，含字段名、类型、描述）
3. 按条件通过 SQL 查询资源（高级查询，仅支持 resources 表）
4. 查询预置合规规则（Config 内置策略定义）

This skill does NOT handle the following:

1. Creating, modifying, or deleting any resources or compliance rules
2. Guessing or fabricating information that has not been queried

Before writing SQL or analyzing security posture, read the reference docs:

File	Description
references/knowledge.md	资源类型映射表、Region 映射、各服务安全知识索引
references/sql-example.json	SQL 查询示例集合，编写 SQL 前必读
references/service/config.md	Config 核心概念
references/service/vpc.md	VPC 安全知识
references/service/iam.md	IAM 安全知识
references/service/obs.md	OBS 安全知识
references/iam-policies.md	最小权限 IAM 策略（Config ReadOnlyAccess）
references/verification-method.md	验证方法
references/acceptance-criteria.md	验收标准

Prerequisites 前置条件

Environment Variables:

Variable	Required	Description
HW_ACCESS_KEY	Yes*	Huawei Cloud AK (preferred; fallback: HUAWEICLOUD_AK; only requires Config ReadOnlyAccess permission)
HW_SECRET_KEY	Yes*	Huawei Cloud SK (preferred; fallback: HUAWEICLOUD_SK)
HW_SECURITY_TOKEN	No	Required when using temporary AK/SK
HW_IGNORE_SSL_VERIFICATION	No	Set to true to disable TLS certificate verification (only for intranet/proxy with self-signed certificates)
PROXY_URL	No	Proxy URL, e.g. http://user:pass@host:port (intranet access); falls back to HTTPS_PROXY/HTTP_PROXY

* Either HW_ACCESS_KEY/HW_SECRET_KEY (preferred) or HUAWEICLOUD_AK/HUAWEICLOUD_SK (fallback) must be set. The scripts check HW_ACCESS_KEY/HW_SECRET_KEY first, then fall back to HUAWEICLOUD_AK/HUAWEICLOUD_SK.

Do not output the values of the above environment variables.

Dependencies: pip install -r requirements.txt（huaweicloudsdkcore、huaweicloudsdkconfig、urllib3）

See references/iam-policies.md for the least-privilege IAM policy.

Workflow 工作流

Prerequisite: Environment Setup 前置步骤

1. Confirm HW_ACCESS_KEY / HW_SECRET_KEY (or fallback HUAWEICLOUD_AK / HUAWEICLOUD_SK) are set (without printing values)
2. Install dependencies: pip install -r requirements.txt
3. Run the resource summary query first to confirm connectivity

Scenario 1: 查询资源概览 Resource Summary

1. Read references/knowledge.md to map user intent to provider/region
2. Execute:

   bash

   skill action=exec: skill://.venv/Scripts/python3.exe skill://scripts/config/query_Config_resource_summary.py [--provider=<provider>] [--region_id=<region_id>]
   

   • --provider: 可选，只查询某云服务的资源概览（如 obs、vpc），也支持 provider.type 形式（如 obs.buckets）
   • --region_id: 可选，只查询某区域（如 cn-north-4 北京四、cn-east-3 上海一、global 全局）
3. Verify: output is a JSON array with provider、type、region_id、cnt fields

Scenario 2: 查询资源 Schema Resource Schema

1. Identify the resource type in provider.type format (e.g. obs.buckets, ecs.cloudservers, iam.users, vpc.securityGroups)
2. Execute:

   bash

   skill action=exec: skill://.venv/Scripts/python3.exe skill://scripts/config/query_Config_resource_schema.py --resource_type=<provider.type>
   

3. Use the returned field names/types to prepare SQL in Scenario 3

Scenario 3: 按条件 SQL 查询资源 SQL Resource Query

1. Query the resource Schema first (Scenario 2) to confirm available fields
2. Read references/sql-example.json for query patterns
3. Execute:

   bash

   skill action=exec: skill://.venv/Scripts/python3.exe skill://scripts/config/query_Config_resource_by_sql.py --sql="<SQL>"
   

   • SQL 只能查询 resources 表；支持标准 SELECT/WHERE/GROUP BY/ORDER BY，数组函数（transform/filter/any_match/contains），日期函数（date_diff/date_parse）
   • SQL 语句用双引号包裹，内部字符串用单引号
   • 示例：--sql="select id, name, provider, type, properties from resources where region_id = 'cn-north-4'"
4. If the result is empty, run Scenario 1 first to confirm the actual resource distribution
5. Common top-level fields (name, created, updated, tag, project_id) are collected by Config uniformly and do NOT appear in properties/Schema — do not treat them as missing fields

Scenario 4: 查询预置合规规则 Built-in Compliance Rules

1. Execute:

   bash

   skill action=exec: skill://.venv/Scripts/python3.exe skill://scripts/config/query_Config_builtin_rule.py [--keyword=<keyword>] [--limit=<n>]
   

   • --keyword: 过滤关键词，对规则名称、描述及 keywords 做忽略大小写的子串匹配（如 obs、vpc）
   • --limit: 限制返回数量，默认 20
2. Map rules to security dimensions (加密静态数据、保护配置、强制执行最低权限、限制网络访问等，完整维度见 references/knowledge.md)
3. Analyze resource compliance by combining rule conditions with SQL queries from Scenario 3

Core Commands 核心命令

All commands are executed via skill action=exec with the skill venv Python:

bash

# Windows
skill://.venv/Scripts/python3.exe skill://scripts/config/<script>.py [OPTIONS]
# Linux / macOS
skill://.venv/bin/python3 skill://scripts/config/<script>.py [OPTIONS]

Script	Purpose	Key Options
query_Config_resource_summary.py	资源概览统计	--provider, --region_id
query_Config_resource_schema.py	资源 Schema 查询	--resource_type (required)
query_Config_resource_by_sql.py	SQL 高级查询	--sql (required)
query_Config_builtin_rule.py	预置合规规则查询	--keyword, --limit

Output: JSON (UTF-8, ensure_ascii=False). Empty results print 没有找到数据 and exit with code 0; failures print the error and exit with code 1.

Parameter Confirmation 参数确认

Parameter	Required	Description	Example
--cli-region	No	CLI/SDK 区域标识，SDK 默认 cn-north-4（Config 为全局服务，固定使用该 endpoint）	cn-north-4
--provider	No (Scenario 1)	云服务标识，支持 provider.type 形式	obs, obs.buckets
--region_id	No (Scenario 1)	资源所在区域，global 表示全局资源	cn-north-4, global
--resource_type	Yes (Scenario 2)	资源类型标识，格式 provider.type，区分大小写	vpc.securityGroups
--sql	Yes (Scenario 3)	高级查询 SQL，双引号包裹、内部单引号	select id, name from resources where provider = 'ecs'
--keyword	No (Scenario 4)	合规规则过滤关键词，忽略大小写的子串匹配（名称/描述/keywords）	obs
--limit	No (Scenario 4)	返回数量限制，默认 20	10

Reference Documents 参考文档

• Knowledge Base — 资源类型映射表、Region 映射、各服务安全知识索引
• SQL Examples — SQL 查询示例集合
• Config Concepts — Config 核心概念
• VPC Security — VPC 安全知识
• IAM Security — IAM 安全知识
• OBS Security — OBS 安全知识
• IAM Policies — Least-privilege credential model
• Verification Method — Verification method details
• Acceptance Criteria — Acceptance criteria

Notes

1. This skill only provides read-only query capabilities; it does not perform any write operations
2. 严禁在日志、控制台输出 AK/SK 等敏感信息；AK 仅需 Config ReadOnlyAccess 最小权限
3. All scripts must be executed via skill action=exec; do not run them directly in a shell
4. SQL 资源类型名称区分大小写（如 securityGroups），先查 Schema 确认
5. 大结果集缓存到本地文件，避免重复请求