Huawei Cloud IaC Reverse Engineering Skill

Overview

Given a Huawei Cloud account with existing resources, this skill:

1. Discovers all resources via RMS (Resource Management Service / 配置审计) API
2. Analyzes resources in batches by service layer (network → storage → compute → database → auxiliary)
3. Synthesizes Terraform HCL configurations from the analyzed topology
4. Validates with terraform fmt → validate → plan
5. Compares the generated code against the original inventory to identify gaps

Prerequisites

• hcloud CLI (KooCLI) installed and configured with AK/SK
• Terraform >= 1.90.0 installed (see references/cli-installation-guide.md)
• Huawei Cloud provider for Terraform (auto-downloaded via Huawei Cloud mirror)
• Environment variables: HUAWEI_ACCESS_KEY, HUAWEI_SECRET_KEY (unset HUAWEI_SECURITY_TOKEN if switching accounts)

Workflow

Phase 0: Credential Setup

# Set credentials (never write AK/SK into .tf files)
export HUAWEI_ACCESS_KEY="your-ak"
export HUAWEI_SECRET_KEY="your-sk"
# CRITICAL: unset stale security token when switching accounts
unset HUAWEI_SECURITY_TOKEN

Phase 1: Resource Discovery (RMS)

Use RMS ListAllResources to get ALL resources across ALL services in one call:

# List all resources in a region
hcloud Config ListAllResources --cli-region={region} --limit=200

Known limitations:

• Subnets are NOT returned by RMS — query VPC API separately
• CCE Turbo cluster nodes may not be returned by CCE API — extract from RMS data
• Some resource properties (e.g., EVS volume_type) may be missing — supplement with service-specific APIs

Phase 2: Batch Analysis (9 phases by dependency layer)

Analyze resources in dependency order:

Phase 3: Terraform Code Generation

Generate .tf files in dependency order:

project/
├── providers.tf      # provider config (version, region, no AK/SK)
├── variables.tf      # variables (image IDs, keypair name, passwords)
├── terraform.tfvars  # region assignment
├── .tfrc             # Huawei Cloud provider mirror
├── main.tf           # Layer 0-1: VPC, subnets, SG, EIP
├── storage.tf        # Layer 2: OBS, SFS Turbo
├── compute.tf        # Layer 3a: ECS
├── cce.tf            # Layer 3b-4: CCE cluster + node pool
├── database.tf       # Layer 3c: GaussDB, DCS, DMS
├── security.tf       # Layer 0 aux: KMS
├── lts.tf            # LTS log groups
└── README.md         # documentation

Key rules:

• Never write AK/SK into .tf files — use env vars or provider profile
• Reference existing resources (keypairs, KMS keys) via variables, don't recreate
• Resources auto-created by parent services (CCE nodes, GaussDB nodes, DCS nodes) are NOT in Terraform
• Use charging_mode = "prePaid" / "postPaid" (string, not numeric)
• CCE node pool volumes use volumetype (not volume_type)
• GaussDB datastore.version uses MySQL-compatible version (e.g., "8.0"), not internal version

Phase 4: Validation

terraform fmt -recursive
terraform validate
terraform plan

Fix provider schema mismatches iteratively. Common issues:

• billing_mode (deprecated) → charging_mode
• volume_type → volumetype (CCE node pool)
• spec_code → flavor (DCS)
• subnet_id → network_id (DMS)
• available_zones (deprecated) → availability_zones
• scale_enable → scall_enable (CCE node pool, provider typo)
• eni_subnet_ids → eni_subnet_id (CCE cluster)

Phase 5: Gap Analysis

Compare generated resources against original inventory:

Common gaps to check:

• GaussDB: provider may not support security_group_id, port, dataVolumeSizeInGBs
• SFS Turbo: share_type mapping (e.g., HPC_STANDARD_20M → HPC + hpc_bandwidth)
• CCE: initial node count vs node pool count
• OBS: custom ACLs / cross-account grants
• LTS: log topics
• KMS: encryption keys

Core Commands

Parameter Confirmation

hcloud Config ListAllResources

hcloud GaussDB ShowGaussMySqlEngineVersion

hcloud SFSTurbo ListShares

hcloud CCE ListClusters

Helper Scripts

KooCLI Command Format Standard

Format template: hcloud <service> <Operation> --cli-region={region} [--key={value} ...] (template only — replace the placeholders with real values; not an executable command)

Provider Schema Discovery

When unsure about argument names, query the provider schema:

terraform providers schema -json | python3 -c "
import json, sys
data = json.load(sys.stdin)
for name, schema in data.get('provider_schemas', {}).items():
    resources = schema.get('resource_schemas', {})
    for rname in ['TARGET_RESOURCE']:
        if rname in resources:
            attrs = resources[rname].get('block', {}).get('attributes', {})
            for an, av in attrs.items():
                req = av.get('required', False)
                print(f'  [{"REQ" if req else "opt"}] {an}')
"

Huawei Cloud API Lookup (for supplementing missing data)

When RMS doesn't return enough detail, use hcloud CLI:

# Query GaussDB engine versions
hcloud GaussDB ShowGaussMySqlEngineVersion --database_name=gaussdb-mysql --cli-region={region}

# Query SFS Turbo shares
hcloud SFSTurbo ListShares --cli-region={region}

# Query CCE clusters
hcloud CCE ListClusters --cli-region={region}

Important Notes

1. Never terraform apply without user confirmation — this skill only generates and validates code.
2. Sensitive variables (passwords, tokens) use sensitive = true and default values marked as placeholders.
3. Provider limitations are documented as comments in the .tf files when a property cannot be set via Terraform.
4. State management: Local state is fine for this use case. Remote backend is not forced.
5. Resource count: The generated code manages "top-level" resources. Sub-resources (CCE nodes, DB nodes, EVS volumes) are auto-created by their parent resources and correctly excluded from Terraform.

Example Output

For a 144-resource environment, the skill generates ~57 Terraform resources:

• 27 network (VPC, subnets, SG + rules, EIPs)
• 10 storage (OBS buckets, ACLs, SFS Turbo)
• 3 compute (ECS)
• 2 CCE (cluster + node pool)
• 6 database (GaussDB, DCS, DMS)
• 1 KMS key
• 7 LTS log groups
• 1 keypair reference (variable)

Reference Documents

• references/iam-policies.md — Least-privilege IAM policies
• references/cli-installation-guide.md — KooCLI installation and credential configuration
• references/verification-method.md — Verification method details
• references/acceptance-criteria.md — Acceptance criteria
• references/dataflow-diagram.md — Data flow diagram