Huawei Cloud VPC
STOP - Do not answer from general knowledge. Follow the procedure below.
Always run hcloud <Service> <Operation> --help before constructing commands to discover exact parameter names and requirements.
Multi-version APIs: KooCLI may print a warning like "ListVpcs有多个版本,默认使用该API版本v3" before the actual response. The text BEFORE the first
{is the version selection notice — parse JSON starting from{only. This is normal behavior, not an error.
Overview
Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
Critical Warnings
| Trap | Why |
|---|---|
| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
| Network ACL stateless | ACL rules must allow both inbound AND outbound |
| EIP bills when idle | Unbound EIP still charges. Release when unused |
| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
EIP PER type needs --bandwidth.name | PER bandwidth requires explicit name; --help marks it optional but it's required |
| VPC params need nested prefix | KooCLI 7.x VPC API uses --vpc.<param>, --subnet.<param>, --security_group.<param>. Example: --vpc.name=xxx NOT --name=xxx |
| Security group needs no vpc_id | VPC v3 API CreateSecurityGroup does NOT accept vpc_id. Security groups are region-level, not VPC-bound |
| Subnet DNS empty → ECS no DNS | DNS params (--subnet.primary_dns, --subnet.secondary_dns) marked optional but empty default breaks cloud-init domain resolution — yum/apt installs fail silently. Always set both. Common DNS (primary / secondary): cn-north-4 (100.125.1.250 / 100.125.129.250), cn-north-1 (100.125.1.250 / 100.125.21.250), cn-east-3 (100.125.1.250 / 100.125.64.250), cn-south-1 (100.125.1.250 / 100.125.136.29), ap-southeast-3 (100.125.1.250 / 100.125.128.250). Authoritative per region: hcloud DNS ListNameServers --type=private --region=<r> |
| SCP blocks 0.0.0.0/0 SG rules | If CreateSecurityGroupRule with --remote_ip_prefix=0.0.0.0/0 fails with SYS.0403, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
VPC tags use * separator | VPC tag format: --vpc.tags.1=env*test (asterisk between key and value). NOT --vpc.tags.1.key=env (ECS-style). This is different from ECS --server.metadata.key=value |
Common Workflows
| Task | Command | Steps |
|---|---|---|
| Create VPC | hcloud VPC CreateVpc --vpc.name= --vpc.cidr= | CIDR must not conflict with existing VPCs. Run hcloud VPC ListVpcs first |
| Create subnet | hcloud VPC CreateSubnet --subnet.name= --subnet.vpc_id= --subnet.cidr= --subnet.gateway_ip= --subnet.primary_dns= --subnet.secondary_dns= --subnet.availability_zone= | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
| Update subnet | hcloud VPC UpdateSubnet --subnet_id= --subnet.dnsList.1= --subnet.dnsList.2= | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
| Security group | hcloud VPC CreateSecurityGroup --security_group.name= | references/security-group.md |
| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id= --security_group_rule.direction= --security_group_rule.protocol= --security_group_rule.multiport= --security_group_rule.remote_ip_prefix= | references/security-group.md |
| Create EIP | hcloud EIP CreatePublicip --publicip.type= --bandwidth.size= --bandwidth.share_type= --bandwidth.name= | Run hcloud EIP CreatePublicip --help to confirm valid type values per region |
| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id= --publicip.associate_instance_id= --publicip.associate_instance_type=PORT | Get port ID from hcloud ECS ListServersDetails --server_id=<id> → OS-EXT-IPS:port_id |
| Unbind EIP | hcloud EIP DisassociatePublicips --publicip_id= | references/network.md |
| Delete EIP | hcloud EIP DeletePublicip --publicip_id= | references/network.md |
| List EIPs | hcloud EIP ListPublicips | |
| NAT gateway | hcloud NAT CreateNatGateway --nat.name= --nat.spec= --router_id= --internal_network_id= | Run hcloud NAT CreateNatGateway --help for available spec values |
Troubleshooting
| Error | Root Cause -> Fix |
|---|---|
| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
| EIP quota exceeded | Check actual quota: hcloud EIP ListPublicips --cli-region=<r> to see current usage. Default varies by account (typically 5-10) |
| EIP.7905 | Run hcloud EIP ListPublicips --cli-region=<r> first to check current usage |
| VPC.0301: Bandwidth name invalid | PER type requires --bandwidth.name, even though --help marks it optional |
| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-cloud-apig-instance-management) |
| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check hcloud VPC ShowSubnet --subnet_id=<id> → dnsList empty? Rebuild subnet with --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>. DNS addresses per region: hcloud DNS ListNameServers --type=private --region=<r> |
| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see huawei-ecs — no SSH needed |
Security Considerations
- MUST use security groups, NOT iptables
- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
- SHOULD use network ACLs as defense-in-depth
- SHOULD place databases in private subnets (no EIP)
- MUST enable VPC flow logs for audit
MCP Tools
- huaweicloud_list_operations service=VPC
- huaweicloud_run_readonly_command for VPC/subnet discovery
- huaweicloud_run_approved_command for writes
References
- VPC Docs: https://support.huaweicloud.com/vpc/
- Subnet guide: references/subnet.md
- Security group: references/security-group.md
