huawei-cloud-config-helper · git:20261102.bad25df · 2026-11-02 · sha256 451431f46657b8c7
huawei-cloud-config-helper git:20261102.bad25dfB
Immutable. This exact content never changes and is served at /api/v1/blob/451431f46657b8c7.
--- name: huawei-cloud-config-helper description: "Queries Huawei Cloud Config service for global resource inventory, resource configurations, resource schemas, advanced SQL queries, and built-in compliance rules. Read-only. Use this skill when the user needs to query cloud resources, audit configurations, check compliance, inventory assets, analyze resource relationships, or run complex SQL resource queries. Triggers include: Config, 配置审计, 资源查询, 资源审计, 合规规则, 合规检查, 资源盘点, 资源Schema, 高级查询, SQL查询, 云上资产, resource inventory, compliance rule, resource schema, SQL query." tags: - huawei-cloud-config - resource-query - compliance-rule - resource-schema - sql-query --- # Huawei Cloud Config Helper > **⚠️ Execution Method (Must Read): This skill executes queries via local Python scripts. Using hcloud, curl, or other CLI tools or direct API calls is prohibited.** > > - Query scripts are located under the skill directory `scripts/config/` > - All scripts are inside the skill package. **You must use `skill action=exec` to execute them; do not run them directly in a shell** > - **All paths are relative to the skill directory, which is the directory where this SKILL.md resides** ## Overview 概述 This skill is a standalone read-only query skill that uses local Python scripts to call the Huawei Cloud Python SDK to query the Config service, providing: 1. 查询资源概览（各服务/类型/区域的资源数量统计） 2. 查询资源 Schema（资源结构定义，含字段名、类型、描述） 3. 按条件通过 SQL 查询资源（高级查询，仅支持 `resources` 表） 4. 查询预置合规规则（Config 内置策略定义） This skill does NOT handle the following: 1. Creating, modifying, or deleting any resources or compliance rules 2. Guessing or fabricating information that has not been queried Before writing SQL or analyzing security posture, read the reference docs: | File | Description | |:-----|:------------| | `references/knowledge.md` | 资源类型映射表、Region 映射、各服务安全知识索引 | | `references/sql-example.json` | SQL 查询示例集合，编写 SQL 前必读 | | `references/service/config.md` | Config 核心概念 | | `references/service/vpc.md` | VPC 安全知识 | | `references/service/iam.md` | IAM 安全知识 | | `references/service/obs.md` | OBS 安全知识 | | `references/iam-policies.md` | 最小权限 IAM 策略（Config ReadOnlyAccess） | | `references/verification-method.md` | 验证方法 | | `references/acceptance-criteria.md` | 验收标准 | ## Prerequisites 前置条件 **Environment Variables:** | Variable | Required | Description | |------|------|------| | HW_ACCESS_KEY | Yes* | Huawei Cloud AK (preferred; fallback: HUAWEICLOUD_AK; only requires `Config ReadOnlyAccess` permission) | | HW_SECRET_KEY | Yes* | Huawei Cloud SK (preferred; fallback: HUAWEICLOUD_SK) | | HW_SECURITY_TOKEN | No | Required when using temporary AK/SK | | HW_IGNORE_SSL_VERIFICATION | No | Set to `true` to disable TLS certificate verification (only for intranet/proxy with self-signed certificates) | | PROXY_URL | No | Proxy URL, e.g. `http://user:pass@host:port` (intranet access); falls back to HTTPS_PROXY/HTTP_PROXY | \* Either `HW_ACCESS_KEY`/`HW_SECRET_KEY` (preferred) or `HUAWEICLOUD_AK`/`HUAWEICLOUD_SK` (fallback) must be set. The scripts check `HW_ACCESS_KEY`/`HW_SECRET_KEY` first, then fall back to `HUAWEICLOUD_AK`/`HUAWEICLOUD_SK`. **Do not output the values of the above environment variables.** **Dependencies:** `pip install -r requirements.txt`（huaweicloudsdkcore、huaweicloudsdkconfig、urllib3） See `references/iam-policies.md` for the least-privilege IAM policy. ## Workflow 工作流 ### Prerequisite: Environment Setup 前置步骤 1. Confirm `HW_ACCESS_KEY` / `HW_SECRET_KEY` (or fallback `HUAWEICLOUD_AK` / `HUAWEICLOUD_SK`) are set (without printing values) 2. Install dependencies: `pip install -r requirements.txt` 3. Run the resource summary query first to confirm connectivity ### Scenario 1: 查询资源概览 Resource Summary 1. Read `references/knowledge.md` to map user intent to provider/region 2. Execute: ```bash skill action=exec: skill://.venv/Scripts/python3.exe skill://scripts/config/query_Config_resource_summary.py [--provider=<provider>] [--region_id=<region_id>] ``` - `--provider`: 可选，只查询某云服务的资源概览（如 `obs`、`vpc`），也支持 `provider.type` 形式（如 `obs.buckets`） - `--region_id`: 可选，只查询某区域（如 `cn-north-4` 北京四、`cn-east-3` 上海一、`global` 全局） 3. Verify: output is a JSON array with `provider`、`type`、`region_id`、`cnt` fields ### Scenario 2: 查询资源 Schema Resource Schema 1. Identify the resource type in `provider.type` format (e.g. `obs.buckets`, `ecs.cloudservers`, `iam.users`, `vpc.securityGroups`) 2. Execute: ```bash skill action=exec: skill://.venv/Scripts/python3.exe skill://scripts/config/query_Config_resource_schema.py --resource_type=<provider.type> ``` 3. Use the returned field names/types to prepare SQL in Scenario 3 ### Scenario 3: 按条件 SQL 查询资源 SQL Resource Query 1. Query the resource Schema first (Scenario 2) to confirm available fields 2. Read `references/sql-example.json` for query patterns 3. Execute: ```bash skill action=exec: skill://.venv/Scripts/python3.exe skill://scripts/config/query_Config_resource_by_sql.py --sql="<SQL>" ``` - SQL 只能查询 `resources` 表；支持标准 SELECT/WHERE/GROUP BY/ORDER BY，数组函数（`transform`/`filter`/`any_match`/`contains`），日期函数（`date_diff`/`date_parse`） - SQL 语句用双引号包裹，内部字符串用单引号 - 示例：`--sql="select id, name, provider, type, properties from resources where region_id = 'cn-north-4'"` 4. If the result is empty, run Scenario 1 first to confirm the actual resource distribution 5. Common top-level fields (`name`, `created`, `updated`, `tag`, `project_id`) are collected by Config uniformly and do NOT appear in `properties`/Schema — do not treat them as missing fields ### Scenario 4: 查询预置合规规则 Built-in Compliance Rules 1. Execute: ```bash skill action=exec: skill://.venv/Scripts/python3.exe skill://scripts/config/query_Config_builtin_rule.py [--keyword=<keyword>] [--limit=<n>] ``` - `--keyword`: 过滤关键词，对规则名称、描述及 keywords 做忽略大小写的子串匹配（如 `obs`、`vpc`） - `--limit`: 限制返回数量，默认 20 2. Map rules to security dimensions (加密静态数据、保护配置、强制执行最低权限、限制网络访问等，完整维度见 `references/knowledge.md`) 3. Analyze resource compliance by combining rule conditions with SQL queries from Scenario 3 ## Core Commands 核心命令 All commands are executed via `skill action=exec` with the skill venv Python: ```bash # Windows skill://.venv/Scripts/python3.exe skill://scripts/config/<script>.py [OPTIONS] # Linux / macOS skill://.venv/bin/python3 skill://scripts/config/<script>.py [OPTIONS] ``` | Script | Purpose | Key Options | |--------|---------|-------------| | `query_Config_resource_summary.py` | 资源概览统计 | `--provider`, `--region_id` | | `query_Config_resource_schema.py` | 资源 Schema 查询 | `--resource_type` (required) | | `query_Config_resource_by_sql.py` | SQL 高级查询 | `--sql` (required) | | `query_Config_builtin_rule.py` | 预置合规规则查询 | `--keyword`, `--limit` | Output: JSON (UTF-8, `ensure_ascii=False`). Empty results print `没有找到数据` and exit with code 0; failures print the error and exit with code 1. ## Parameter Confirmation 参数确认 | Parameter | Required | Description | Example | |-----------|----------|-------------|---------| | `--cli-region` | No | CLI/SDK 区域标识，SDK 默认 `cn-north-4`（Config 为全局服务，固定使用该 endpoint） | `cn-north-4` | | `--provider` | No (Scenario 1) | 云服务标识，支持 `provider.type` 形式 | `obs`, `obs.buckets` | | `--region_id` | No (Scenario 1) | 资源所在区域，`global` 表示全局资源 | `cn-north-4`, `global` | | `--resource_type` | Yes (Scenario 2) | 资源类型标识，格式 `provider.type`，区分大小写 | `vpc.securityGroups` | | `--sql` | Yes (Scenario 3) | 高级查询 SQL，双引号包裹、内部单引号 | `select id, name from resources where provider = 'ecs'` | | `--keyword` | No (Scenario 4) | 合规规则过滤关键词，忽略大小写的子串匹配（名称/描述/keywords） | `obs` | | `--limit` | No (Scenario 4) | 返回数量限制，默认 20 | `10` | ## Reference Documents 参考文档 - [Knowledge Base](references/knowledge.md) — 资源类型映射表、Region 映射、各服务安全知识索引 - [SQL Examples](references/sql-example.json) — SQL 查询示例集合 - [Config Concepts](references/service/config.md) — Config 核心概念 - [VPC Security](references/service/vpc.md) — VPC 安全知识 - [IAM Security](references/service/iam.md) — IAM 安全知识 - [OBS Security](references/service/obs.md) — OBS 安全知识 - [IAM Policies](references/iam-policies.md) — Least-privilege credential model - [Verification Method](references/verification-method.md) — Verification method details - [Acceptance Criteria](references/acceptance-criteria.md) — Acceptance criteria ## Notes 1. This skill only provides read-only query capabilities; it does not perform any write operations 2. 严禁在日志、控制台输出 AK/SK 等敏感信息；AK 仅需 `Config ReadOnlyAccess` 最小权限 3. All scripts must be executed via `skill action=exec`; do not run them directly in a shell 4. SQL 资源类型名称区分大小写（如 `securityGroups`），先查 Schema 确认 5. 大结果集缓存到本地文件，避免重复请求