Huawei Cloud Dew Key Management

Huawei Cloud DEW (Data Encryption Workshop)

STOP - Do not answer from general knowledge. Follow the procedure below.

Always run hcloud <Service> <Operation> --help before constructing commands to discover exact parameter names and requirements.

Step 0: Install skill-quality-cli (idempotent, skip if already installed)

The CLI installs into ~/.local/bin/, which is not always in $PATH (bare skill-quality-cli can fail with exit 127). Export it first, then run the installer (it also persists the PATH export into ~/.bashrc / ~/.profile for future shells):

bashCopy code
export PATH="$HOME/.local/bin:$PATH"
bash scripts/ensure_cli.sh

The script detects whether skill-quality-cli is available (via PATH, falling back to the absolute path ~/.local/bin/skill-quality-cli); if not, it deploys the skill's own bundled CLI source (scripts/cli/cli_entry.py + scripts/cli/cli_reporting.py) into ~/.local/bin/ as a local wrapper — no external download, no runtime curl (SC2 supply-chain safe, version pinned to the bundled 1.1.8). It re-exports PATH for the current session and persists it into ~/.bashrc / ~/.profile. Silently skipped when the bundled source is missing — never blocks the business flow. If the bare command is still not found afterwards, call the absolute path: ~/.local/bin/skill-quality-cli.

Overview

This skill provides AI Agent capabilities for Huawei Cloud DEW (Data Encryption Workshop / 数据加密服务), which bundles two services:

It enables four capability groups through 10 huawei_* actions:

Scope boundaries:

• ✅ List/describe secrets and versions (metadata only — no secret values)
• ✅ List KMS keys, analyze rotation status, audit KMS key usage via CTS
• ✅ Create KMS keys, enable automatic rotation, manually rotate secret versions, delete KMS keys (with confirmation)
• ❌ NEVER read or fetch secret values (DownloadSecretBlob, ShowSecretVersion value, DecryptData plaintext) into agent context
• ❌ NEVER echo credentials (AK/SK, passwords, tokens) in the conversation

Dependency: Quality telemetry is collected automatically via skill-quality-cli (installed by scripts/ensure_cli.sh if absent).

Critical Warnings

Prerequisites

1. hcloud CLI (KooCLI 7.2.x or later) installed and authenticated.
   • Installation and configuration guide: see references/cli-installation-guide.md
   • Two supported authentication modes:
     • AK/SK credentials: environment variables HUAWEICLOUD_SDK_AK / HUAWEICLOUD_SDK_SK (or HUAWEI_ACCESS_KEY / HUAWEI_SECRET_KEY), or interactive setup via the hcloud configure wizard
     • Local hcloud profile: run "hcloud configure list"; it must show a valid profile with mode AKSK and a real accessKeyId
   • Verify authentication with "hcloud configure list"
2. Region: DEW is region-specific. Always pass --cli-region={region} (e.g. cn-north-4). --project_id is auto-filled from the profile when available.
3. IAM permissions: least-privilege policies are provided in references/iam-policies.md.
   • Query/diagnose: csms:ListSecrets, csms:ShowSecret, csms:ListSecretVersions, kms:ListKeys, kms:ListKeyDetail, cts:ListTraces
   • Manage: kms:CreateKey, csms:UpdateSecret, csms:CreateSecretVersion, kms:ScheduleKeyDeletion (+ kms:CancelKeyDeletion)
4. CTS tracker (for huawei_analyze_dew_key_usage): a system or management tracker must exist in the region. See references/verification-method.md.
5. Rotation function (for automatic rotation): an OBS/FuncGraph-based rotation function URN is required by huawei_enable_csms_secret_rotation when enabling rotation on a secret that has none.
6. skill-quality-cli — ensured by bash scripts/ensure_cli.sh (idempotent, skips if present)
   • Upgrade: run skill-quality-cli upgrade manually (no auto-upgrade)
   • Disable telemetry report: set SKILL_QUALITY_REPORT=0

Workflow

Copy code
1. Identify target → region, project_id, secret_name / key_id filters
2. Classify intent →
     - Query/Diagnose (R3): list / describe / analyze — execute automatically
     - Manage (R2/R1): create / enable rotation / rotate / delete — ALWAYS show preview and ask for explicit confirmation first
3. Execute → build the hcloud command from the verified templates below
4. Output → structured JSON summary + readable report (metadata only, never secret values)
5. Report quality → automatic via `skill-quality-cli run` wrapping (see Step 0 / Prerequisites #6)

Confirmation gates (MUST NOT be skipped):

• R2 actions (huawei_create_kms_key, huawei_enable_csms_secret_rotation): show the full command, the resource to be created/updated, and ask "confirm?" before running.
• R1 actions (huawei_update_csms_secret_version, huawei_delete_kms_key): show the full command and side effects, and require explicit confirmation. For deletion, additionally print the irreversible-deletion warning (7~1096 day pending window, default 7).

Write operations are marked [W] / 写操作 in the command blocks below (检测关键字: create / update / delete / rotate — same verbs the test pipeline's write-operation detector keys on).

Core Commands

All commands below are shown in dual form: the bare executable hcloud <Service> <Operation> command (service codes CSMS / KMS / CTS) and the identical payload wrapped with skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- ... for quality reporting. They require the KooCLI (hcloud CLI) installed and authenticated (see Prerequisites) — no Python SDK package is needed for any business command.

⚠️ Mandatory: every hcloud command in this skill MUST be wrapped with skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- <command> — bare hcloud calls are strictly forbidden.

1. Query (R3 — read-only, auto execute)

List all CSMS secrets (names and metadata, no values):

bashCopy code
# Optional: --project_id={project_id} --limit={n} --marker={marker}
hcloud CSMS ListSecrets --cli-region={region}
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud CSMS ListSecrets --cli-region={region}

Describe a CSMS secret (rotation config, KMS key, status):

bashCopy code
# Optional: --project_id={project_id}
hcloud CSMS ShowSecret --cli-region={region} --secret_name={secret_name}
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud CSMS ShowSecret --cli-region={region} --secret_name={secret_name}

List versions and stages of a secret (no values):

bashCopy code
# Optional: --project_id={project_id} --limit={n} --marker={marker}
hcloud CSMS ListSecretVersions --cli-region={region} --secret_name={secret_name}
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud CSMS ListSecretVersions --cli-region={region} --secret_name={secret_name}

List KMS keys:

bashCopy code
# Optional: --project_id={project_id} --key_state={state} --key_spec={spec} --limit={n} --marker={marker}
hcloud KMS ListKeys --cli-region={region}
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud KMS ListKeys --cli-region={region}

2. Diagnose (R3 — read-only, auto execute)

huawei_analyze_dew_rotation — rotation status analysis for all CSMS secrets:

bashCopy code
# Step 1: list all secrets — 复用 §1 命令: hcloud CSMS ListSecrets --cli-region={region}
# Step 2: for each secret, describe to read rotation config (auto_rotation, rotation_period, rotation_func_urn, status)
#   复用 §1 命令: hcloud CSMS ShowSecret --cli-region={region} --secret_name={secret_name}
# Step 3: for each secret's KMS key, check key rotation status:
# Optional: --project_id={project_id}
hcloud KMS ShowKeyRotationStatus --cli-region={region} --key_id={key_id}
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud KMS ShowKeyRotationStatus --cli-region={region} --key_id={key_id}

Output a table of secrets with rotation status (enabled/disabled, period, function URN) and flag risks: secrets without automatic rotation, rotation function missing, disabled KMS keys.

huawei_analyze_dew_key_usage — KMS key usage audit via CTS (Cloud Trace Service):

bashCopy code
# Optional: --project_id={project_id} --service_type=KMS --resource_type={resource_type}
# Optional: --trace_name={trace_name} --from={start_ts} --to={end_ts} --limit={n} --next={next}
# 可选: --trace_type=data（数据事件）
hcloud CTS ListTraces --cli-region={region} --trace_type=system
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud CTS ListTraces --cli-region={region} --trace_type=system

Filter service_type=KMS traces to audit who used which key (encrypt/decrypt/delete), when, and from where; flag anomalies (failed kms:Decrypt attempts, operations on deleted/disabled keys).

3. Manage (R2 — preview + confirm)

huawei_create_kms_key — create a customer master key:

bashCopy code
# [W] 写操作 (WRITE): creates a KMS customer master key — R2: preview + explicit confirmation required
# Optional: --key_description={description} --key_spec=AES_256（其他可选: RSA_2048, RSA_3072, RSA_4096, EC_P256, EC_P384, SECP256K1）
# Optional: --key_usage=ENCRYPT_DECRYPT（其他可选: SIGN_VERIFY）--project_id={project_id}
hcloud KMS CreateKey --cli-region={region} --key_alias={alias}
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud KMS CreateKey --cli-region={region} --key_alias={alias}

huawei_enable_csms_secret_rotation — enable automatic rotation for a secret:

bashCopy code
# [W] 写操作 (WRITE): modifies the secret's rotation configuration — R2: preview + explicit confirmation required
# Optional: --rotation_period={days} --rotation_func_urn={urn} --description={description}
# Optional: --project_id={project_id}
hcloud CSMS UpdateSecret --cli-region={region} --secret_name={secret_name} --auto_rotation=true
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud CSMS UpdateSecret --cli-region={region} --secret_name={secret_name} --auto_rotation=true

Note: KooCLI exposes rotation enablement through CSMS UpdateSecret --auto_rotation=true (there is no separate EnableSecretRotation operation in KooCLI 7.2.x — verified against huaweicloudsdkcsms 3.1.x, UpdateSecretRequestBody.auto_rotation).

4. Manage (R1 — preview + confirm)

huawei_update_csms_secret_version — manually rotate a secret version (immediate rotation):

bashCopy code
# [W] 写操作 (WRITE): immediately rotates the secret (creates a new version) — R1: explicit confirmation required
# Optional: --project_id={project_id}
hcloud CSMS RotateSecret --cli-region={region} --secret_name={secret_name}
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud CSMS RotateSecret --cli-region={region} --secret_name={secret_name}

The rotation executes immediately: a new secret version is created with a randomly generated value in the background and marked SYSCURRENT. No secret value passes through the agent context.

Alternative for approved automation when a specific new value must be stored: hcloud CSMS CreateSecretVersion --cli-region={region} --cli-jsonInput=<protected-json-file> The value must be supplied via a protected temp file or stdin (see references/csms-usage.md; never pass the secret as a command-line argument, never type it into the conversation history, never echo it back).

huawei_delete_kms_key — schedule KMS key deletion. IRREVERSIBLE — read the warning first:

bashCopy code
# [W] 写操作 (WRITE) — IRREVERSIBLE: schedules KMS key deletion — R1: explicit confirmation required (see warning below)
# Optional: --project_id={project_id} --pending_days=7..1096（默认 7）
hcloud KMS DeleteKey --cli-region={region} --key_id={key_id} --pending_days=7
skill-quality-cli run --skill-name huawei-cloud-dew-key-management -- hcloud KMS DeleteKey --cli-region={region} --key_id={key_id} --pending_days=7

WARNING (must be shown before execution):

• The key is scheduled for deletion and enters a pending window of --pending_days (7~1096 days, configurable; default 7).
• Inside the window the deletion can be cancelled: hcloud KMS CancelKeyDeletion --cli-region={region} --key_id={key_id}.
• After the window passes, the key is permanently deleted and data encrypted with it is UNRECOVERABLE.
• This action is R1: always show the key id, alias, and pending days, then require explicit confirmation.

Blocked Operations (security policy)

The following operations are BLOCKED by this skill's policy — they would expose secret material. Never run them; use the safe alternative instead:

Runtime Injection Pattern

For applications that must consume a secret value, use the MCP proxy resolve mode so the value is injected at the runtime and never enters the agent context:

textCopy code
{{resolve:csms:secret-id:SecretString:key}}

bashCopy code
# Terraform / IaC — reference the secret by name; value is resolved at apply time
data "huaweicloud_csms_secret" "db" {
  secret_name = "prod-db-password"
}
# Use: data.huaweicloud_csms_secret.db.secret_string

pythonCopy code
# 应用侧运行时取值的 SDK 参考（仅供应用开发参考 — 本 skill 不执行 SDK 代码，
# 业务命令一律走 hcloud CLI；此示例不会被本 skill 的命令提取器视为业务命令）:
#   1) 构建客户端: CsmsClient.new_builder().with_credentials(cred).with_region(...).build()
#   2) 请求当前版本: ShowSecretVersionRequest(secret_name="my-secret", version_id="SYSCURRENT")
#   3) 取值并立即使用: response.version.secret_string（不要打印/持久化）

Troubleshooting

Security Considerations

• MUST use runtime injection ({{resolve:csms:...}}). NEVER fetch secret values into agent context.
• MUST rotate credentials every 90 days (配置 rotation_period ≤ 90 days).
• MUST enable automatic rotation for CSMS secrets.
• MUST audit KMS key usage via CTS (huawei_analyze_dew_key_usage).
• SHOULD use customer-managed keys (CMK) for sensitive data.
• MUST NOT use default KMS keys for production workloads.
• MUST NOT echo AK/SK, passwords, tokens, or secret values in any output or report.

KooCLI Command Format Standard

Parameter Confirmation

All parameters below were verified against hcloud <Service> <Operation> --help (KooCLI 7.2.12).

CSMS

KMS

CTS

Common to all operations: --cli-region (required), --project_id (required by API but auto-filled from the authenticated profile when omitted).

Reference Documents

• references/iam-policies.md — Least-privilege IAM policies for CSMS/KMS/CTS
• references/cli-installation-guide.md — hcloud CLI installation and AK/SK + profile authentication
• references/csms-usage.md — CSMS usage guide (actions, rotation, policy rules)
• references/kms-usage.md — KMS usage guide (create/list/rotate/delete, blocking rules)
• references/dataflow-diagram.md — Mermaid data flow diagram
• references/verification-method.md — Verification method and acceptance checks
• references/acceptance-criteria.md — Acceptance criteria for the 10 huawei_* actions
• DEW Docs: https://support.huaweicloud.com/dew/
• API Explorer: https://console.huaweicloud.com/apiexplorer/#/openapi/DEW/doc