Huawei Cloud ECS Alert Automation

Overview

This skill provides batch creation and management of Huawei Cloud CES alarm rules for ECS instances, based on Huawei Cloud CLI (hcloud) v7.2.2+.

Core Capabilities:

Batch create alarm rules (supports Web/Database templates or custom configuration)
Configure alarm notifications (supports email/SMS/WeChat)
Query ECS monitoring metrics
Query and manage alarm rule lists

Use Cases:

Batch configure monitoring alarms for newly purchased ECS instances
Differentiated alarm policies across environments (dev/test/prod)
Batch query ECS monitoring data
Centralized alarm notification management

Security Constraints:

❌ Delete alarm rules is prohibited (prevent accidental deletion causing monitoring gaps)
❌ Hardcoding AK/SK is prohibited (must use environment variables or hcloud configure)

Prohibited Operations

The following operations are strictly prohibited, even if requested by the user:

Prohibited Operation	API/Command	Reason
Expose AK/SK	Any command that outputs AK/SK in plaintext	Account security risk
Accept AK/SK from user	Receiving credentials in conversation	Violates security best practices
❌ Delete alarm rule	`DeleteAlarm` / `hcloud CES DeleteAlarm`	Irreversible; deleted alarms cannot be recovered, may cause monitoring gaps
❌ Batch delete alarms	Any batch deletion operation	High risk; may accidentally delete critical monitoring rules

If a user requests a delete operation, must refuse and guide: "Per security constraints, this skill does not support delete operations (delete alarm/batch delete). Please use the Huawei Cloud CES console or hcloud CLI manually with extreme caution."

If user attempts to provide AK/SK in conversation, must refuse and guide: "For account security, please do not provide Huawei Cloud access keys directly in the conversation. Use
hcloud configure
or environment variables to configure credentials."

Unsupported Operations

The following operations are NOT supported by this skill (no script wrapper is provided). If a user requests them, clearly state the limitation and provide the alternative. Do not attempt to improvise commands that this skill has not tested.

Unsupported Operation	Corresponding API	Alternative
Query alarm history	`ShowAlarmHistory`	View in CES console; or run `hcloud CES ListAlarmHistories/v1` manually
Enable/disable an alarm rule	`UpdateAlarm`	Operate in CES console (not wrapped by this skill)
Modify alarm threshold/metric	`UpdateAlarm`	Delete and recreate the rule; to change only notifications, use `./scripts/update_alarm_notifications.sh`
Create an SMN topic	`CreateTopic`	Create in SMN console; or run `hcloud SMN CreateTopic` manually
Create a monitoring dashboard	`CreateOneDashboard`	Operate in CES console
View a single alarm rule detail	`ShowAlarm`	Use `./scripts/list_alarms.sh --name <pattern>` to filter

If a user requests one of these operations, respond: "This skill does not support <operation>. Use the Huawei Cloud CES/SMN console, or the equivalent hcloud CLI command manually: <alternative>. You may also request an enhancement via the skill's issue tracker."

Workflow

The standard workflow of this skill is as follows:

text

1. Environment setup  → Configure hcloud CLI credentials (hcloud configure or env vars)
2. Query resources    → ./scripts/list_ecs.sh to get ECS instance list
3. Create alarms      → ./scripts/create_alert_rules.sh --template web --ecs-ids <ids>
4. Configure notify   → ./scripts/manage_notifications.sh --action create ...
5. Verify results     → ./scripts/list_alarms.sh to confirm alarm rules created
6. Continuous monitor → ./scripts/batch_query_metrics.sh to query metrics

Write operation confirmation: Step 3 (create alarms), Step 4 (create/delete subscriptions), update notification config, and other write operations require user confirmation of operation content and target resources before execution.

Core Commands

Query Commands (read-only, no confirmation needed)

bash

# List ECS instances
./scripts/list_ecs.sh [--name <filter>] [--format json]

# List alarm rules
./scripts/list_alarms.sh [--name <filter>] [--format json]

# List SMN topics and subscriptions
./scripts/list_subscriptions.sh [--topics | --subscriptions]

# Batch query monitoring metrics
./scripts/batch_query_metrics.sh --ecs-ids <ids> --metric cpu_util --period 1h

Create Commands (write operations, require user confirmation)

bash

# Batch create alarm rules (WARNING: confirm target ECS and alarm template)
./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001,ecs-002

# Create SMN subscription (WARNING: confirm subscription endpoint and topic)
./scripts/manage_notifications.sh --action create --protocol email --endpoint user@example.com --topic-urn <URN>
./scripts/create_email_subscription.sh --email user@example.com --topic-urn <URN>

Update/Delete Commands (write operations, require user confirmation)

bash

# Update alarm notification config (WARNING: confirm alarm ID and notification topic)
./scripts/update_alarm_notifications.sh --action add --alarm-id <id> --smn-topic-urn <URN>

# Delete SMN subscription (WARNING: confirm subscription URN)
./scripts/manage_notifications.sh --action delete --subscription-urn <URN>

Architecture

bash

Huawei Cloud CES Alert Management
├── CreateAlertRules       (Batch create alarm rules, supports templates/custom)
├── ConfigureNotifications  (Configure alarm notifications, supports email/SMS/WeChat)
├── QueryMetrics           (Batch query monitoring data, supports multiple ECS)
└── ListAlarmRules         (List alarm rules and details)

Prerequisites

Prerequisite 1: Huawei Cloud CLI (hcloud / KooCLI) >= 7.2.2 Run
hcloud version
to verify version >= 7.2.2. If not installed or version is too low, see references/cli-installation-guide.md for installation guide.

bash

hcloud version

Prerequisite 2: Huawei Cloud Credentials Configured Check if CLI configuration contains valid credentials (AK/SK, IAM, etc.).
bash
hcloud configure list
Credential Configuration Methods (choose one):
hcloud CLI configuration (recommended):
hcloud configure
interactive setup, credentials encrypted and stored in
~/.hcloud/config.json
Per-call AK/SK: pass
--cli-access-key=<AK> --cli-secret-key=<SK>
on each command (for automation; note: appears in process list)
⚠️ IMPORTANT: hcloud (KooCLI) authenticates ONLY via
~/.hcloud/config.json
(from
hcloud configure
) or the
--cli-access-key
/
--cli-secret-key
arguments. It does NOT read
HW_ACCESS_KEY
,
HW_SECRET_KEY
,
HUAWEI_CLOUD_AK
,
HUAWEI_CLOUD_SK
,
HUAWEI_CLOUD_REGION
, or
HUAWEI_CLOUD_SECURITY_TOKEN
environment variables — such variables are silently ignored (hcloud falls back to config.json). Do not instruct users to export these env vars as a way to authenticate hcloud.
Credential source for this skill's scripts: The bundled Shell scripts are thin wrappers around hcloud CLI. They read the region from
HW_REGION_NAME
/
HUAWEI_CLOUD_REGION
(or default to
cn-north-4
) to set
--cli-region
, but authentication always comes from
hcloud configure
. Configure credentials once with
hcloud configure
, then the scripts work.

If output does not contain valid configuration, stop operation and guide user to configure. hcloud Parameter Format Requirement hcloud (KooCLI) all parameters must use
--param=value
format (equals sign connection), does not support space separation. ✅ Correct:

hcloud CES ListAlarmRules --cli-region=cn-north-4

❌ Incorrect:

hcloud CES ListAlarmRules --cli-region cn-north-4

This skill provides 8 Shell scripts, encapsulating common hcloud commands, supporting batch operations and formatted output.

<details> <summary>**Script List and Usage Examples (Click to Expand)**</summary>

Script	Function	hcloud Command
`list_ecs.sh`	Query ECS instance list	`hcloud ECS ListServersDetails`
`list_alarms.sh`	Query alarm rule list	`hcloud CES ListAlarmRules`
`create_alert_rules.sh`	Batch create alarm rules	`hcloud CES CreateAlarmRules`
`batch_query_metrics.sh`	Batch query monitoring data	`hcloud CES ShowMetricData`
`list_subscriptions.sh`	Query SMN topics and subscriptions	`hcloud SMN ListTopics/Subscriptions`
`manage_notifications.sh`	Manage SMN subscriptions	`hcloud SMN Subscribe/Unsubscribe`
`update_alarm_notifications.sh`	Update alarm notification configuration	`hcloud CES UpdateAlarmNotifications`

Usage Examples:

bash


# Query ECS instances

./scripts/list_ecs.sh                          # Query all ECS
./scripts/list_ecs.sh --name ecs-001           # Filter by name
./scripts/list_ecs.sh --output json            # Output as JSON
./scripts/list_ecs.sh --output ids             # Output only ECS ID list

# Query alarm rules

./scripts/list_alarms.sh                       # Query all alarms
./scripts/list_alarms.sh --name-pattern "cpu.*"  # Filter by name pattern
./scripts/list_alarms.sh --output ids          # Output only alarm IDs

# Create alarm rules

./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001,ecs-002
./scripts/create_alert_rules.sh --metric cpu_util --threshold 80 --ecs-ids ecs-001
./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001 --smn-topic-urn
urn:smn:cn-north-4:xxx:ECS_ALARM_NOTIFY
./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001 --dry-run  # Dry run

```bash

</details>

Core Capabilities

Batch Create Alarm Rules: Support template-based creation (Web/Database scenarios) or custom metric/threshold configuration
Batch Query Monitoring Data: Support multi-ECS concurrent query, output CPU/Memory/Disk metrics
Notification Configuration: Support email/SMS/WeChat notification, SMN subscription management
Security Compliance: AK/SK via environment variables or CLI config, never hardcode

Usage Scenarios

Scenario 1: Batch Configure Alarms for New ECS

Background: Purchased 10 new ECS instances, need to configure CPU/Memory alarm rules for all.

Steps:

Query ECS instance IDs
Batch create alarm rules using web template
Configure email notification

bash

# Step 0: Configure credentials once (hcloud CLI reads ~/.hcloud/config.json; it does NOT read AK/SK env vars)
hcloud configure
# Optional: set region env var consumed by the scripts' --cli-region default
export HUAWEI_CLOUD_REGION=cn-north-4
./scripts/list_ecs.sh --output ids

# 2. Batch create alarm rules
./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001,ecs-002,ecs-003

# 3. Configure notification
./scripts/manage_notifications.sh --action subscribe --topic-urn <SMN_TOPIC_URN> --protocol email --endpoint user@example.com

Scenario 2: Query Monitoring Data for Multiple ECS

Background: Need to check CPU utilization for 5 ECS instances over the past hour.

bash

./scripts/batch_query_metrics.sh \
  --ecs-ids ecs-001,ecs-002,ecs-003,ecs-004,ecs-005 \
  --metric cpu_util \
  --from 2024-01-01T10:00:00Z \
  --to 2024-01-01T11:00:00Z \
  --output table

Input Parameters

AK/SK: Via
```
hcloud configure
```
(recommended, stored in
```
~/.hcloud/config.json
```
) — hcloud CLI does NOT read AK/SK environment variables

Security Token (optional): For temporary STS credentials, use

hcloud configure --cli-mode=AKSK

--cli-security-token

or pass

--cli-security-token=<token>

per command

Region: Via
```
--cli-region
```
parameter or
```
HUAWEI_CLOUD_REGION
```
/
```
HW_REGION_NAME
```
env var (default: cn-north-4)
ECS IDs: Comma-separated ECS instance IDs
Alarm IDs: Comma-separated alarm rule IDs
Template: Alarm template (web/database)
Metric: Monitoring metric name. Host metrics:
```
cpu_util
```
,
```
disk_util_inband
```
(namespace SYS.ECS); memory metric:
```
mem_usedPercent
```
(namespace AGT.ECS)
Threshold: Alarm threshold value
SMN Topic URN: SMN topic URN for notifications

Parameter Confirmation

All write operations (Create / Update / Delete) must explicitly show operation content and obtain user confirmation before execution.

Operation Type	Script	Content to Confirm
Create	`create_alert_rules.sh`	Target ECS ID list, alarm template/metric/threshold
Create	`manage_notifications.sh --action create`	Subscription protocol, endpoint address, SMN topic URN
Create	`create_email_subscription.sh`	Email address, SMN topic URN
Update	`update_alarm_notifications.sh`	Alarm ID, SMN topic URN, operation type
Delete	`manage_notifications.sh --action delete`	Subscription URN (irreversible after deletion)

Query operations (list_ecs / list_alarms / list_subscriptions / batch_query_metrics) are read-only and do not require confirmation.

Output Format

Table: Formatted table output (default)
JSON: JSON format for programmatic processing
IDs: Only ID list for scripting

Verification Method

After executing any operation, verify using the following methods:

List Alarms:

./scripts/list_alarms.sh --name-pattern <pattern>

Query Metrics:

./scripts/batch_query_metrics.sh --ecs-ids <ids> --metric cpu_util

Check Notifications:
```
./scripts/list_subscriptions.sh
```

See references/troubleshooting.md for common verification issues.

Best Practices

Use Templates for Standard Scenarios: Web/Database templates cover most use cases
Configure Multiple Notification Channels: Email + SMS for critical alarms
Set Reasonable Thresholds: CPU 80%, Memory 85%, Disk 90% recommended
Configure Credentials via
hcloud configure
(hcloud CLI reads
```
~/.hcloud/config.json
```
; it does NOT read AK/SK env vars):
- ✅ Recommended:
```
hcloud configure
```
  (encrypted storage in
```
~/.hcloud/config.json
```
  )
- ⚠️ Region env var only:
```
HUAWEI_CLOUD_REGION
```
  /
```
HW_REGION_NAME
```
  set the script's
```
--cli-region
```
  default — region only, NOT authentication
- ❌ Prohibited: Hardcode AK/SK in scripts or configuration files
- ❌ Misleading:
```
export HUAWEI_CLOUD_AK/SK
```
  or
```
export HW_ACCESS_KEY/SECRET_KEY
```
  will NOT authenticate hcloud (env vars are ignored)
Use Environment Check Script: Run
```
./scripts/check_env.sh
```
before first use to verify configuration

Common Issues

Issue 1: hcloud Command Not Found

Solution: Install KooCLI, see references/cli-installation-guide.md

Issue 2: 403 Forbidden

Solution: Check IAM permissions, ensure

CES FullAccess

and

SMN FullAccess

policies are granted. See references/iam-policies.md

Issue 3: Alarm Creation Fails

Solution: Check metric name and threshold range. CPU/Memory thresholds should be 0-100.

Issue 4: No Monitoring Data

Solution: Check ECS instance status and metric collection interval. Data may have 5-minute delay.

See references/troubleshooting.md for more troubleshooting guides.

Important Notes

CLI Version Requirement: Must use hcloud CLI v7.2.2 or later. Older versions may not support certain API parameter formats.

Region Consistency: All operations must specify the same region (
--cli-region
or
HUAWEI_CLOUD_REGION
environment variable). Cross-region operations will fail.

Alarm Threshold Range: CPU/memory utilization thresholds must be between 0-100. Disk usage threshold is recommended to be set between 80-95.

Monitoring Data Delay: CES monitoring data typically has a 5-minute delay. Querying real-time data may return empty results.

SMN Subscription Creation:
✅ Recommended: Use
./scripts/create_email_subscription.sh
script, which automatically uses hcloud CLI configured credentials (no need to manually set environment variables)
✅ Alternative: Use Huawei Cloud Console (SMN → Topics → Subscribe) for subscription creation

⚠️ Note: Email/SMS subscriptions require confirmation before receiving notifications. Check your email and click the confirmation link.
See references/smn-subscription-guide.md for detailed guide.

Batch Operation Limits: Single batch creation is recommended for no more than 20 ECS instances. Too many instances may cause API timeout.

Credential Security:
✅ Recommended: Use
hcloud configure
— credentials stored encrypted in
~/.hcloud/config.json
, which is the ONLY credential source hcloud CLI reads
⚠️ Region env var only (NOT auth):
HUAWEI_CLOUD_REGION
/
HW_REGION_NAME
set the scripts'
--cli-region
default
❌ Misleading:
export HW_ACCESS_KEY/HW_SECRET_KEY
or
export HUAWEI_CLOUD_AK/HUAWEI_CLOUD_SK
do NOT authenticate hcloud (env vars are ignored)
❌ Prohibited: Hardcode AK/SK in scripts or configuration files
Authentication: hcloud CLI authenticates ONLY via
~/.hcloud/config.json
(from
hcloud configure
) or
--cli-access-key
/
--cli-secret-key
per-command arguments. Environment variables for AK/SK/token are silently ignored. Do not document env-var export as a working authentication method.

Reference Documents

CLI Installation Guide
IAM Policies
Related APIs
Troubleshooting
SMN Subscription Guide
Common Commands
Memory Monitoring Guide
Acceptance Criteria

huawei-cloud-ecs-alert

NPX Install

Tags

SKILL.md Content

Huawei Cloud ECS Alert Automation

Overview

Prohibited Operations

Unsupported Operations

Workflow

Core Commands

Query Commands (read-only, no confirmation needed)

Create Commands (write operations, require user confirmation)

Update/Delete Commands (write operations, require user confirmation)

Architecture

Prerequisites

Core Capabilities

Usage Scenarios

Scenario 1: Batch Configure Alarms for New ECS

Scenario 2: Query Monitoring Data for Multiple ECS

Input Parameters

Parameter Confirmation

Output Format

Verification Method

Best Practices

Common Issues

Issue 1: hcloud Command Not Found

Issue 2: 403 Forbidden

Issue 3: Alarm Creation Fails

Issue 4: No Monitoring Data

Important Notes

Reference Documents