• Batch create alarm rules (supports Web/Database templates or custom configuration)
• Configure alarm notifications (supports email/SMS/WeChat)
• Query ECS monitoring metrics
• Query and manage alarm rule lists

• Batch configure monitoring alarms for newly purchased ECS instances
• Differentiated alarm policies across environments (dev/test/prod)
• Batch query ECS monitoring data
• Centralized alarm notification management

• ❌ Delete alarm rules is prohibited (prevent accidental deletion causing monitoring gaps)
• ❌ Hardcoding AK/SK is prohibited (must use environment variables or hcloud configure)

The following operations are strictly prohibited, even if requested by the user:

DeleteAlarm

hcloud CES DeleteAlarm

If a user requests a delete operation, must refuse and guide: "Per security constraints, this skill does not support delete operations (delete alarm/batch delete). Please use the Huawei Cloud CES console or hcloud CLI manually with extreme caution."

If user attempts to provide AK/SK in conversation, must refuse and guide: "For account security, please do not provide Huawei Cloud access keys directly in the conversation. Use

hcloud configure

or environment variables to configure credentials."

The following operations are NOT supported by this skill (no script wrapper is provided). If a user requests them, clearly state the limitation and provide the alternative. Do not attempt to improvise commands that this skill has not tested.

ShowAlarmHistory

hcloud CES ListAlarmHistories/v1

UpdateAlarm

UpdateAlarm

./scripts/update_alarm_notifications.sh

CreateTopic

hcloud SMN CreateTopic

CreateOneDashboard

ShowAlarm

./scripts/list_alarms.sh --name <pattern>

If a user requests one of these operations, respond: "This skill does not support <operation>. Use the Huawei Cloud CES/SMN console, or the equivalent hcloud CLI command manually: <alternative>. You may also request an enhancement via the skill's issue tracker."

1. Environment setup  → Configure hcloud CLI credentials (hcloud configure or env vars)
2. Query resources    → ./scripts/list_ecs.sh to get ECS instance list
3. Create alarms      → ./scripts/create_alert_rules.sh --template web --ecs-ids <ids>
4. Configure notify   → ./scripts/manage_notifications.sh --action create ...
5. Verify results     → ./scripts/list_alarms.sh to confirm alarm rules created
6. Continuous monitor → ./scripts/batch_query_metrics.sh to query metrics

Write operation confirmation: Step 3 (create alarms), Step 4 (create/delete subscriptions), update notification config, and other write operations require user confirmation of operation content and target resources before execution.

Prerequisite 1: Huawei Cloud CLI (hcloud / KooCLI) >= 7.2.2 Run

hcloud version

to verify version >= 7.2.2. If not installed or version is too low, see references/cli-installation-guide.md for installation guide.

hcloud version

Prerequisite 2: Huawei Cloud Credentials Configured Check if CLI configuration contains valid credentials (AK/SK, IAM, etc.).

bash

hcloud configure list

Credential Configuration Methods (choose one):

1. hcloud CLI configuration (recommended):

   hcloud configure

   interactive setup, credentials encrypted and stored in

   ~/.hcloud/config.json

2. Per-call AK/SK: pass

   --cli-access-key=<AK> --cli-secret-key=<SK>

   on each command (for automation; note: appears in process list)

⚠️ IMPORTANT: hcloud (KooCLI) authenticates ONLY via

~/.hcloud/config.json

(from

hcloud configure

) or the

--cli-access-key

/

--cli-secret-key

arguments. It does NOT read

HW_ACCESS_KEY

,

HW_SECRET_KEY

,

HUAWEI_CLOUD_AK

,

HUAWEI_CLOUD_SK

,

HUAWEI_CLOUD_REGION

, or

HUAWEI_CLOUD_SECURITY_TOKEN

environment variables — such variables are silently ignored (hcloud falls back to config.json). Do not instruct users to export these env vars as a way to authenticate hcloud.

Credential source for this skill's scripts: The bundled Shell scripts are thin wrappers around hcloud CLI. They read the region from

HW_REGION_NAME

/

HUAWEI_CLOUD_REGION

(or default to

cn-north-4

) to set

--cli-region

, but authentication always comes from

hcloud configure

. Configure credentials once with

hcloud configure

, then the scripts work.

If output does not contain valid configuration, stop operation and guide user to configure. hcloud Parameter Format Requirement hcloud (KooCLI) all parameters must use

--param=value

format (equals sign connection), does not support space separation. ✅ Correct:

hcloud CES ListAlarmRules --cli-region=cn-north-4

❌ Incorrect:

hcloud CES ListAlarmRules --cli-region cn-north-4

This skill provides 8 Shell scripts, encapsulating common hcloud commands, supporting batch operations and formatted output.

<details> <summary>**Script List and Usage Examples (Click to Expand)**</summary>

Script	Function	hcloud Command
list_ecs.sh	Query ECS instance list	hcloud ECS ListServersDetails
list_alarms.sh	Query alarm rule list	hcloud CES ListAlarmRules
create_alert_rules.sh	Batch create alarm rules	hcloud CES CreateAlarmRules
batch_query_metrics.sh	Batch query monitoring data	hcloud CES ShowMetricData
list_subscriptions.sh	Query SMN topics and subscriptions	hcloud SMN ListTopics/Subscriptions
manage_notifications.sh	Manage SMN subscriptions	hcloud SMN Subscribe/Unsubscribe
update_alarm_notifications.sh	Update alarm notification configuration	hcloud CES UpdateAlarmNotifications

Usage Examples:

bash

# Query ECS instances

./scripts/list_ecs.sh                          # Query all ECS
./scripts/list_ecs.sh --name ecs-001           # Filter by name
./scripts/list_ecs.sh --output json            # Output as JSON
./scripts/list_ecs.sh --output ids             # Output only ECS ID list

# Query alarm rules

./scripts/list_alarms.sh                       # Query all alarms
./scripts/list_alarms.sh --name-pattern "cpu.*"  # Filter by name pattern
./scripts/list_alarms.sh --output ids          # Output only alarm IDs

# Create alarm rules

./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001,ecs-002
./scripts/create_alert_rules.sh --metric cpu_util --threshold 80 --ecs-ids ecs-001
./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001 --smn-topic-urn
urn:smn:cn-north-4:xxx:ECS_ALARM_NOTIFY
./scripts/create_alert_rules.sh --template web --ecs-ids ecs-001 --dry-run  # Dry run

```bash

</details>

• Batch Create Alarm Rules: Support template-based creation (Web/Database scenarios) or custom metric/threshold configuration
• Batch Query Monitoring Data: Support multi-ECS concurrent query, output CPU/Memory/Disk metrics
• Notification Configuration: Support email/SMS/WeChat notification, SMN subscription management
• Security Compliance: AK/SK via environment variables or CLI config, never hardcode

1. Query ECS instance IDs
2. Batch create alarm rules using web template
3. Configure email notification

undefined

• AK/SK: Via

  hcloud configure

  (recommended, stored in

  ~/.hcloud/config.json

  ) — hcloud CLI does NOT read AK/SK environment variables
• Security Token (optional): For temporary STS credentials, use

  hcloud configure --cli-mode=AKSK

  +

  --cli-security-token

  or pass

  --cli-security-token=<token>

  per command
• Region: Via

  --cli-region

  parameter or

  HUAWEI_CLOUD_REGION

  /

  HW_REGION_NAME

  env var (default: cn-north-4)
• ECS IDs: Comma-separated ECS instance IDs
• Alarm IDs: Comma-separated alarm rule IDs
• Template: Alarm template (web/database)
• Metric: Monitoring metric name. Host metrics:

  cpu_util

  ,

  disk_util_inband

  (namespace SYS.ECS); memory metric:

  mem_usedPercent

  (namespace AGT.ECS)
• Threshold: Alarm threshold value
• SMN Topic URN: SMN topic URN for notifications

All write operations (Create / Update / Delete) must explicitly show operation content and obtain user confirmation before execution.

create_alert_rules.sh

manage_notifications.sh --action create

create_email_subscription.sh

update_alarm_notifications.sh

manage_notifications.sh --action delete

Query operations (list_ecs / list_alarms / list_subscriptions / batch_query_metrics) are read-only and do not require confirmation.

• Table: Formatted table output (default)
• JSON: JSON format for programmatic processing
• IDs: Only ID list for scripting

1. List Alarms:

   ./scripts/list_alarms.sh --name-pattern <pattern>

2. Query Metrics:

   ./scripts/batch_query_metrics.sh --ecs-ids <ids> --metric cpu_util

3. Check Notifications:

   ./scripts/list_subscriptions.sh

1. Use Templates for Standard Scenarios: Web/Database templates cover most use cases
2. Configure Multiple Notification Channels: Email + SMS for critical alarms
3. Set Reasonable Thresholds: CPU 80%, Memory 85%, Disk 90% recommended
4. Configure Credentials via

   hcloud configure

   (hcloud CLI reads

   ~/.hcloud/config.json

   ; it does NOT read AK/SK env vars):
   • ✅ Recommended:

     hcloud configure

     (encrypted storage in

     ~/.hcloud/config.json

     )
   • ⚠️ Region env var only:

     HUAWEI_CLOUD_REGION

     /

     HW_REGION_NAME

     set the script's

     --cli-region

     default — region only, NOT authentication
   • ❌ Prohibited: Hardcode AK/SK in scripts or configuration files
   • ❌ Misleading:

     export HUAWEI_CLOUD_AK/SK

     or

     export HW_ACCESS_KEY/SECRET_KEY

     will NOT authenticate hcloud (env vars are ignored)
5. Use Environment Check Script: Run

   ./scripts/check_env.sh

   before first use to verify configuration

CLI Version Requirement: Must use hcloud CLI v7.2.2 or later. Older versions may not support certain API parameter formats.

Region Consistency: All operations must specify the same region (

--cli-region

or

HUAWEI_CLOUD_REGION

environment variable). Cross-region operations will fail.

Alarm Threshold Range: CPU/memory utilization thresholds must be between 0-100. Disk usage threshold is recommended to be set between 80-95.

Monitoring Data Delay: CES monitoring data typically has a 5-minute delay. Querying real-time data may return empty results.

SMN Subscription Creation:

• ✅ Recommended: Use

  ./scripts/create_email_subscription.sh

  script, which automatically uses hcloud CLI configured credentials (no need to manually set environment variables)
• ✅ Alternative: Use Huawei Cloud Console (SMN → Topics → Subscribe) for subscription creation
• ⚠️ Note: Email/SMS subscriptions require confirmation before receiving notifications. Check your email and click the confirmation link.

See references/smn-subscription-guide.md for detailed guide.

Batch Operation Limits: Single batch creation is recommended for no more than 20 ECS instances. Too many instances may cause API timeout.

Credential Security:

• ✅ Recommended: Use

  hcloud configure

  — credentials stored encrypted in

  ~/.hcloud/config.json

  , which is the ONLY credential source hcloud CLI reads
• ⚠️ Region env var only (NOT auth):

  HUAWEI_CLOUD_REGION

  /

  HW_REGION_NAME

  set the scripts'

  --cli-region

  default
• ❌ Misleading:

  export HW_ACCESS_KEY/HW_SECRET_KEY

  or

  export HUAWEI_CLOUD_AK/HUAWEI_CLOUD_SK

  do NOT authenticate hcloud (env vars are ignored)
• ❌ Prohibited: Hardcode AK/SK in scripts or configuration files

Authentication: hcloud CLI authenticates ONLY via

~/.hcloud/config.json

(from

hcloud configure

) or

--cli-access-key

/

--cli-secret-key

per-command arguments. Environment variables for AK/SK/token are silently ignored. Do not document env-var export as a working authentication method.

• CLI Installation Guide
• IAM Policies
• Related APIs
• Troubleshooting
• SMN Subscription Guide
• Common Commands
• Memory Monitoring Guide
• Acceptance Criteria