Huawei Cloud Security Guide: IAM, Agencies and CTS

Huawei Cloud tenants inherit the same identity failures as any other cloud, root credentials used daily, access keys in code and delegations nobody reviews, but the controls have different names and there is no CIS Benchmark to hand the team. Huawei Cloud is a significant provider for public sector and enterprise workloads in parts of EMEA, Latin America and Asia-Pacific, and security teams that know AWS or Azure often have to map their baseline across. This guide covers the account and IAM user model, agencies for delegation to other accounts and services, account security settings, access keys, Cloud Trace Service (CTS), Data Encryption Workshop (DEW) and the security services SecMaster and Host Security Service (HSS). It is written for cloud security engineers, auditors and platform teams. For a cross-provider view, see the Multi-Cloud Identity Guide.

Key takeaways

The account is the root. Huawei Cloud's account has full permissions and pays for resources. Huawei advises not creating access keys for it, sharing its password, or using it for daily work: create IAM users and an administrator user instead.
Agencies are the role mechanism. An account agency delegates operations on your resources to another account, and a cloud service agency lets a Huawei Cloud service act for you. Applications on ECS should use an agency for temporary, automatically rotated credentials instead of stored keys.
Protect the security settings themselves. Critical operation protection, login authentication policy, password policy and the console and API ACLs are changed through IAM actions such as iam:securitypolicies:updateProtectPolicy. Restrict and alert on them.
CTS is your audit trail, but only seven days lives in the console. Configure the management tracker to transfer trace files to OBS or LTS, enable trace file verification, and add data trackers for sensitive OBS buckets.
Layer the native services. HSS covers host baselines and vulnerabilities, SecMaster aggregates HSS, WAF and Anti-DDoS detections and runs cloud service baseline inspection, and DEW holds keys and secrets.

How identity and access work in Huawei Cloud

Huawei Cloud's model will feel familiar to AWS users, with different terms. The table maps the main concepts, so teams porting a baseline know what to look for.

Huawei Cloud concept	What it is	Closest AWS equivalent	Security note
Account	The owner identity with full permissions, which pays for resources	Root user	MFA, no access keys, no daily use
IAM user	Individual identity created by the account, with password, access keys or both	IAM user	Choose console, programmatic or both per user
User group	Container for permissions assigned to users	IAM group	Assign permissions to groups, not users
System-defined and custom policies, roles	Permission documents attached to groups or agencies	Managed and customer managed policies	Custom policies for API users limit the impact of a leaked key
Account agency	Trust relationship that lets another full account operate on your resources	Cross-account role	Delegated party switches role with its own credentials
Cloud service agency	Lets a Huawei Cloud service access other services for you	Service role or instance profile	ECS agencies issue temporary credentials rotated by ECS
Enterprise project	Grouping of resources used as an authorisation scope	Loosely, resource groups or accounts in an organisation	Scope grants to projects rather than the whole account

Policies and scope. Huawei's IAM best practices tell administrators to grant only the permissions a task needs, using system-defined or custom policies, and to use custom policies for API, CLI and SDK users so a leaked or lost key does limited damage. When an agency is created, the authorisation scope is chosen alongside the permissions. Huawei also publishes documentation for a newer IAM version (an "IAM 5.0" documentation set) with its own policy model; confirm which version your account uses before writing policies, because syntax and features differ.

Access types. Huawei recommends matching the access type to the user: password only for console users, access keys only for programmatic users, and both only where a console task requires it. Console-only users should have their access keys deleted.

Admin roles and privileged access

Privilege in Huawei Cloud concentrates in three places: the account itself, administrator users, and the account security settings that govern everyone else.

Account security settings

The IAM Security Settings page covers basic information, critical operation protection, login authentication policy, password policy and access control lists. Each has its own query and modify permission, which makes it practical to separate who can view from who can change.

Setting	What it controls	Modify permission	Recommended baseline
Critical operation protection	Requires a verification code before sensitive actions such as deleting resources or generating access keys	iam:securitypolicies:updateProtectPolicy	Enable for the account and all IAM users
Access key protection	Protection setting for access key management, configured with operation protection	iam:securitypolicies:updateProtectPolicy	Enable, so key operations need extra verification or administrator control
Login authentication policy	Session and login behaviour	iam:securitypolicies:updateLoginPolicy	Short session timeouts and lockout after failed attempts
Password policy	Minimum length, consecutive identical characters, reuse of previous passwords, validity period	iam:securitypolicies:updatePasswordPolicy	Length and reuse rules; IAM reminds users 15 days before expiry
Console access ACL	IP ranges allowed to sign in to the console	iam:securitypolicies:updateConsoleAclPolicy	Corporate egress ranges and VPN only
API access ACL	IP ranges allowed to call APIs with access keys	iam:securitypolicies:updateApiAclPolicy	Pipeline and integration egress ranges

MFA: Huawei advises MFA for the account and privileged IAM users. Its IAM best practices state that only software-based virtual MFA devices generating six-digit codes are supported, so plan phishing-resistant sign-in through federation to your identity provider where it matters.
Administrator users: create a named IAM user, or better a federated identity, with administrator permissions for routine management, and keep the account credentials for billing and recovery only.
Security Administrator: Huawei's agency documentation notes that you can assign the Security Administrator role to a delegated account but does not recommend it. Treat any grant of security policy permissions as a privileged change.
Break-glass: store the account password and MFA seed under dual control, test recovery yearly, and alert on every account sign-in.

Integrations, API tokens and service accounts

Non-human access in Huawei Cloud runs through access keys (AK/SK pairs), agencies and secrets stored in DEW.

Access keys: Huawei advises never embedding keys in code, deleting unused keys, and rotating by alternating two keys or by deleting and regenerating. Keys for pipelines and integrations should belong to dedicated programmatic IAM users with custom policies, protected by the API access ACL. If a key leaks, follow the Cloud Access Key Leak Playbook.
ECS agencies: for applications on ECS, create an agency that grants the needed permissions to the ECS and specify it when the instance is created. The application obtains temporary credentials that ECS rotates, which removes stored keys from the host.
Account delegation: when a managed service provider or another business unit needs access, create an account agency rather than sharing passwords or keys. The delegated party must be a full account, not an IAM user or federated user. It signs in with its own credentials and switches role. Give it only the account name, agency name, agency ID and agreed permissions, and set a validity period.
Cloud service agencies: services that act for you (for example to read OBS or write logs) hold agencies too. Review them like any other role, because a service agency with broad permissions is a standing privileged non-human identity.
Secrets: DEW's Cloud Secret Management Service (CSMS) hosts credentials through their lifecycle to reduce hard-coded and plaintext secrets. Applications should fetch database passwords and third-party tokens from CSMS at runtime, authorised by an agency. See the Cloud Secrets Managers Guide.
Keys and key pairs: DEW's Key Management Service uses HSMs that Huawei states meet FIPS 140-2 Level 3. Key Pair Service manages SSH key pairs, with HSM-generated randomness; the private key can be downloaded, which makes its storage your responsibility. Dedicated HSM provides single-tenant hardware where compliance requires it.

Logging and detection

Cloud Trace Service records console operations, API calls and operations triggered by connected services. Huawei documents that the console shows only the last seven days of traces, so retention depends on delivery.

CTS feature	What it does	Configuration to apply
Management tracker ("system")	Created automatically when CTS is first enabled; one per account; records management traces such as create, modify and delete	Configure delivery of trace files to a dedicated OBS bucket and to LTS for search
Data trackers	Up to 100 per account; record read and write operations on OBS data	Create for buckets holding regulated or sensitive data
Trace file transfer	Compresses traces per service and transfers them periodically to OBS or LTS, encrypted with DEW keys in transfer	Restrict bucket access to the security team; use lifecycle rules for your retention requirement
Trace file verification	Hashes each trace file and writes an hourly RSA-signed digest file to the tracker's OBS bucket	Enable and verify digests during investigations; modification or deletion of trace files is itself recorded
Key event notifications	Sends alerts on key operations through Simple Message Notification (SMN) to email or mobile	Alert on the operations in the next list

Operations worth alerting on:

Any sign-in or API activity by the account itself.
Changes to security settings: protection policy, login policy, password policy, console or API ACL.
Access key creation, especially for users who are meant to be console only.
Agency creation or permission changes, and new account delegations.
Tracker deletion, tracker configuration changes, or changes to the trace bucket's policy.
Key deletion scheduling and secret deletion in DEW.

Security services. HSS uses agents on protected servers to scan accounts, ports, processes, web directories, software and auto-start tasks, report Linux, Windows, Web-CMS and application vulnerabilities, and check baselines such as weak passwords. SecMaster is Huawei's security operations platform: it collects detections from HSS, WAF and Anti-DDoS, provides asset and posture management, incident management and orchestrated response, and runs cloud service baseline inspection against built-in checks. Feed CTS and SecMaster alerts into your SIEM so Huawei Cloud is not a separate island. See the Cloud Logging and Audit Trail Guide.

Metrics that show it is working

Account usage: sign-ins and API calls by the account per month (target: zero outside break-glass).
Key hygiene: access keys older than your rotation period, and keys on console-only users (target: zero).
Agency review: share of account and service agencies reviewed in the last quarter, and agencies without a validity period.
Log integrity: trackers with OBS delivery and file verification enabled (target: all regions in use).
Baseline findings: open SecMaster baseline inspection and HSS unsafe setting findings, trending down.

Hardening baseline

With no CIS Benchmark for Huawei Cloud, build the baseline from Huawei's own IAM best practices and map it to your control framework.

Secure the account: enable MFA, remove any account access keys, store credentials under dual control, and stop daily use.
Create the admin model: named administrators through federation or IAM users with MFA, permissions assigned to groups, and enterprise projects to scope teams.
Apply security settings: enable critical operation protection, set the password and login policies, and set console and API ACLs to known egress ranges. Pilot the ACLs with a small group first, because a wrong range locks users out; keep a break-glass path that is not subject to the ACL, or confirm the account can still recover access, before enforcing.
Turn on CTS properly: configure the management tracker in every region you use, deliver to a locked-down OBS bucket and LTS, enable trace file verification, and add data trackers for sensitive buckets.
Replace stored keys: move ECS workloads to agencies, move secrets into CSMS, and restrict remaining programmatic users with custom policies and the API ACL.
Review delegations: list every account agency and service agency, remove unused ones, set validity periods, and avoid granting Security Administrator.
Deploy HSS and SecMaster: agents on all servers and containers, baseline inspection enabled, findings routed to owners.
Roll back safely: record every settings change with its previous value so it can be reverted from the IAM console, and change one setting at a time during the rollout.

Framework mapping

Control area	NIST SP 800-53 Rev 5	NIST CSF 2.0	ATT&CK
Account protection, MFA, ACLs	AC-2, IA-2, AC-17	PR.AA-03	T1078.004 Cloud Accounts
Least privilege and agencies	AC-6	PR.AA-05	T1098 Account Manipulation
Access keys and secrets	IA-5	PR.AA-01	T1552.001 Credentials In Files
CTS delivery and verification	AU-2, AU-9, AU-12	DE.CM-09	T1685 Disable or Modify Tools (logging tampering)
HSS and SecMaster baselines	CM-6, RA-5	ID.RA-01	Not applicable

In ISO/IEC 27001:2022 terms the work maps mainly to A.5.15 Access control, A.5.18 Access rights, A.8.2 Privileged access rights, A.8.5 Secure authentication and A.8.15 Logging.

Common misconfigurations

Account access keys in automation: scripts and integrations using an AK/SK pair created for the account, which carries full permissions and cannot be scoped.
Keys on every user: IAM users created with both password and access keys by default, leaving unused keys on console-only users.
Stale delegations: account agencies for a former supplier left in place without a validity period, or granted Security Administrator for convenience.
Logs only in the console: CTS enabled but no OBS or LTS delivery, so traces older than seven days are unavailable when an incident is found.
Open console and API access: no ACLs, so a stolen password or key works from anywhere. Leaked cloud keys are abused by automated tooling, as the 230 Million AWS Cloud Environments Campaign showed with keys taken from exposed .env files on another provider; an API ACL would have blocked use of those keys from attacker infrastructure, and the same applies to Huawei AK/SK pairs.
Downloaded private keys on laptops: KPS private keys downloaded at creation and left in user folders.

Practitioner checklist

Confirm the account has MFA, no access keys, and no routine use.
Enable critical operation protection and set password and login policies.
Set console and API ACLs to known IP ranges after a pilot.
Delete access keys on console-only users and rotate the rest on a schedule.
Move ECS applications to agencies and secrets into CSMS.
Review all account and service agencies quarterly and set validity periods.
Deliver CTS traces to OBS and LTS in every region, with file verification enabled.
Configure SMN key event notifications for account, security setting, key and agency changes.
Deploy HSS agents and enable SecMaster baseline inspection.

Huawei Cloud Security Guide: IAM, Agencies, CTS and Security Services