Huawei Cloud Computing Security
Domain scope
This domain tests Huawei Cloud security: shared responsibility, identity, network controls, data protection, and managed security services.
Core rules
- Shared responsibility: Huawei Cloud secures the infrastructure; the customer secures identities, configurations, data, and guest OS.
- IAM manages users, groups, policies, and roles; enable MFA for privileged accounts. AK/SK are for API and programmatic access and must not be embedded in code.
- Security groups are stateful virtual firewalls on ECS; network ACLs are stateless subnet-level rules. Return traffic is automatically allowed by stateful security groups but must be explicitly allowed by stateless ACLs.
- Anti-DDoS absorbs volumetric attacks; WAF filters HTTP/HTTPS application attacks; HSS protects hosts; VSS scans vulnerabilities.
- KMS/DEW manages keys and secrets; encrypt OBS buckets and EVS volumes with customer-managed keys where required.
Worked example
A public web app needs defense in depth. Put Anti-DDoS on the public IP, WAF in front of the ELB, allow only 443 from the WAF/ELB to the ECS security group, install HSS on ECS, and encrypt the OBS bucket with KMS. Reason: each control covers a different layer: volumetric, application, network, host, and data. A single WAF does not stop a SYN flood, and a security group does not inspect HTTP payloads.
Traps
IAM users are not Linux users; IAM controls cloud API permissions, not SSH logins. Do not confuse stateful security groups with stateless ACLs. Anti-DDoS is not WAF. Encrypting data at rest does not protect data in transit; use TLS. Do not place AK/SK in a public repository.