HCIA-Cloud Service cheat sheet

Huawei Cloud's service portfolio is organized into compute, storage, network, database, security, big data/AI, and management/operations categories; each console service is region-scoped unless explicitly global.

Region and AZ model: a region is a geographic area; each region contains multiple isolated AZs connected by low-latency fiber. Resources such as ECS, EVS, and VPC are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures the platform (physical facilities, hypervisor, network fabric); the customer secures what they deploy (OS patching, IAM policies, data encryption, security group rules).

Account model: an account (root) owns resources and billing; IAM users and user groups inherit permissions through policies. Enterprise projects and tags provide cost and resource grouping.

Billing models: pay-per-use (hourly/second-level for some services), yearly/monthly subscription (discount for commitment), and spot/auction-style pricing for fault-tolerant workloads.

Service selection rule: choose ECS for full OS control, BMS for bare metal performance, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: distribute ECS instances across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no protection against AZ-level failure.

Huawei Cloud API/CLI and SDK access uses AK/SK credentials; AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS instance families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor naming encodes vCPUs and memory, e.g., a flavor with 4 vCPUs and 16 GB RAM is memory-heavy.

ECS purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage duration), and spot instances (low price, may be reclaimed).

ECS lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges, while compute charges stop.

Key pairs are used for Linux SSH login; password login can be enabled. Resetting a password requires the instance to support the agent and may require a reboot.

IMS image types: public images (Huawei-provided OS), private images (created from ECS or imported), shared images (from another account), and marketplace images.

A full-ECS image captures OS plus data disks and can be used to launch new ECS or to migrate a server; a system-disk image captures only the OS disk.

AS (Auto Scaling) components: scaling configuration (template: image, flavor, network, key pair), scaling group (min/desired/max instances), and scaling policy (alarm-based, scheduled, or periodic).

AS health check replaces unhealthy instances automatically; cooldown period prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automated configuration.

OBS is object storage accessed via HTTP/HTTPS REST API and is organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard (frequent access), Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS durability/redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup/restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; file system expansion inside the OS is required after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: block (EVS) for a single server's database or OS disk, file (SFS) for shared directories across servers, object (OBS) for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped. Resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP that can be bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances in a VPC without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared). Listeners define protocol and port; backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connection connects two VPCs privately; VPN connects on-premises networks to a VPC over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoint (private endpoint) allows access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow. Permissions are attached to users or groups, not directly to resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit; it answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports operational troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

Backup and disaster recovery: CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports DR scenarios.

Principle of least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.

Huawei Cloud service categories include compute, storage, network, database, security, AI/big data, and management/operations; each console service is region-scoped unless explicitly global.

Region/AZ model: a region is a geographic area containing multiple isolated AZs; ECS, EVS, and VPC resources are AZ- or region-scoped, while OBS buckets are region-scoped with cross-region replication.

Shared responsibility: Huawei Cloud secures facilities, hypervisor, and network fabric; the customer secures OS patching, IAM policies, data encryption, and security group rules.

Account model: a root account owns resources and billing; IAM users and groups inherit permissions through policies; enterprise projects and tags group resources for cost control.

Billing models: pay-per-use, yearly/monthly subscription, and spot pricing for fault-tolerant workloads; reserved commitment lowers unit price.

Service selection rule: ECS for full OS control, BMS for bare metal, CCE/CCI for containers, and FunctionGraph for event-driven short tasks.

Availability design: spread ECS across AZs, pair with ELB health checks, and use AS for elasticity; single-AZ deployments have no AZ-failure protection.

API/CLI access uses AK/SK: AK identifies the caller, SK signs requests and must never be embedded in client code.

ECS families: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d); flavor names encode vCPU and memory ratio.

Purchasing modes: yearly/monthly (fixed term, lower unit price), pay-per-use (billed by usage), and spot instances (low price, may be reclaimed).

Lifecycle states include creating, running, stopped, and deleted; a stopped pay-per-use ECS still incurs EVS and EIP charges while compute charges stop.

Key pairs enable Linux SSH login; password reset requires the agent and may require a reboot.

IMS image types: public images, private images (from ECS or imported), shared images, and marketplace images.

A full-ECS image captures OS plus data disks and can launch new ECS or migrate servers; a system-disk image captures only the OS disk.

AS components: scaling configuration (image, flavor, network, key pair), scaling group (min/desired/max), and scaling policy (alarm, scheduled, or periodic).

AS health checks replace unhealthy instances automatically; cooldown prevents rapid repeated scaling actions after a scaling event.

ECS metadata service (169.254.169.254) exposes instance ID, AZ, and user data; user data scripts run at first boot for automation.

OBS is object storage accessed via HTTP/HTTPS REST API, organized as buckets and objects; it is region-scoped, virtually unlimited, and suited to backups, static websites, media, and archives.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lower-cost classes have higher retrieval latency and minimum storage duration constraints.

OBS redundancy options include multi-AZ and cross-region replication; bucket policies, ACLs, and IAM control access, and pre-signed URLs grant temporary access.

EVS is block storage attached to a single ECS in the same AZ; disk types include general-purpose SSD, ultra-high I/O, and high I/O, differing in IOPS and throughput.

EVS snapshots are incremental and stored independently of the source disk; a snapshot can create a new disk or be used for backup and restore.

EVS disks can be enlarged online in most cases, but shrinking is not supported; the file system inside the OS must be expanded after resizing.

SFS is shared file storage (NFS/CIFS) mountable by multiple ECS concurrently; SFS Turbo provides higher performance for latency-sensitive shared workloads.

Selection rule: EVS for a single server's database or OS disk, SFS for shared directories across servers, OBS for unstructured data at scale and web access.

OBS lifecycle rules transition objects between storage classes or delete them after a defined number of days, automating cost control.

VPC provides an isolated virtual network with a CIDR block; subnets divide the VPC and are AZ-scoped, and resources in different VPCs cannot communicate by default.

Security groups are stateful, instance-level virtual firewalls with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules.

EIP is a public IP bound to ECS, ELB, NAT Gateway, or BMS; bandwidth is billed by bandwidth or by traffic.

NAT Gateway lets instances without EIPs access the internet outbound; DNAT provides inbound port forwarding.

ELB types: dedicated load balancer (enhanced, supports layer 4 and layer 7) and classic load balancer (shared); listeners define protocol and port, and backend server groups hold targets.

ELB health checks determine backend availability; an unhealthy backend is removed from rotation until checks pass again.

Layer 7 (HTTP/HTTPS) features include URL-based routing, host-based routing, and session persistence via cookies; layer 4 (TCP/UDP) forwards by IP and port.

Peering connects two VPCs privately; VPN connects on-premises networks over IPsec; Direct Connect provides dedicated private physical links.

VPC endpoints allow access to OBS or other services without traversing the public internet.

IAM policies are JSON documents granting Allow or Deny on actions and resources; explicit Deny overrides Allow, and permissions attach to users or groups, not resources.

Huawei Cloud security services include HSS (host security), WAF (web application firewall), Anti-DDoS, VSS (vulnerability scanning), and DEW (key management).

Anti-DDoS protects public IPs against volumetric attacks; WAF filters layer 7 attacks such as SQL injection and cross-site scripting against web applications.

CTS (Cloud Trace Service) records API-level operations on account resources for audit and answers who did what and when.

CES (Cloud Eye) collects metrics and supports alarms that can trigger AS scaling or notifications via SMN.

LTS (Log Tank Service) centralizes log collection and query; combined with CTS and CES it supports troubleshooting and compliance.

Tagging and enterprise projects are the primary mechanisms for cost allocation and resource grouping; cost center reports break down spend by tag or project.

CBR (Cloud Backup and Recovery) provides policy-based backups for ECS, EVS, and SFS; cross-region replication supports disaster recovery.

Least privilege: grant the minimum actions and resources needed, use user groups for role-based assignment, and rotate AK/SK regularly.