HCIE-Cloud Service cheat sheet

Region → Availability Zone (AZ) → project (enterprise project) hierarchy: resources are created in a project scoped to one region; an AZ is an isolated power/network site inside a region, and cross-AZ replication is the standard high-availability pattern.

IAM model: account (root) → IAM users → user groups → policies; policies are either system policies (RBAC, service-scoped) or custom policies written in JSON with Effect/Action/Resource/Condition. Enterprise projects add a second, resource-grouping authorization dimension.

ECS instance families: general computing (s), memory-optimized (m), compute-optimized (c), GPU/accelerated (g/p), and Kunpeng ARM-based (k); choose by vCPU:memory ratio, and note that flavor availability differs per AZ.

EVS disk types: ultra-high I/O (SSD, lowest latency), high I/O (SSD), general purpose (SSD), and standard (SATA HDD). Shared EVS supports concurrent attach to multiple ECS instances for cluster quorum or shared-file workloads.

OBS storage classes: Standard, Infrequent Access, Archive, and Deep Archive; lifecycle rules transition objects between classes or expire them, and cross-region replication is configured at bucket level with a target bucket in another region.

VPC basics: subnets are AZ-scoped, security groups are stateful instance-level firewalls (allow rules only), and network ACLs are stateless subnet-level filters (allow and deny). EIP, NAT Gateway, and ELB attach at the VPC edge.

Managed database families: RDS (MySQL, PostgreSQL, SQL Server), GaussDB (distributed OLTP), DDS (MongoDB-compatible), DCS (Redis/Memcached), and GaussDB(DWS) for data warehousing; each offers primary/standby or cluster HA topologies.

DeC (Dedicated Cloud) and Huawei Cloud Stack extend public-cloud services into a customer-dedicated or on-premises environment while keeping the same console/API model; Cloud Connect and VPN link them to the public region.

Design for failure: no single-AZ dependency for stateful tiers; use ELB health checks plus multi-AZ ECS/RDS standby, and place OBS or cross-region replication behind any single-region data store.

Sizing rule of thumb: derive ECS flavor from measured peak vCPU and memory with 30–50% headroom, then validate with a load test (CPTS/CodeArts PerfTest) before committing to a flavor family.

ELB selection: dedicated load balancers (performance-guaranteed, layer 4/7) for production; shared load balancers for low-traffic or test workloads. Use layer 7 for path/host routing and sticky sessions, layer 4 for raw TCP/UDP throughput.

Decoupling pattern: put DCS (Redis) in front of RDS for read-heavy sessions/cache, and use DMS (Kafka/RabbitMQ) between services so that producer and consumer scale independently.

Storage choice rule: OBS for unstructured objects and static website assets, SFS Turbo for shared POSIX file access across ECS, EVS for block storage of a single instance (or shared-disk clusters).

Security layering: WAF in front of public HTTP(S), Anti-DDoS for volumetric protection, HSS on hosts, DEW/KMS for key management, and CTS for audit trails; combine rather than substitute these controls.

Cost architecture: reserved/ yearly subscription for steady-state baseline, pay-per-use for burst, and auto scaling groups to shrink idle capacity; spot or scheduled shutdown for non-production.

Hybrid connectivity decision: VPN for fast, low-cost, moderate-bandwidth links; Cloud Connect (dedicated line) when latency, jitter, or bandwidth SLA matters; Direct Connect gateways attach to a VPC via virtual gateway.

Landing zone sequence: create account structure and IAM groups first, then VPC/subnets and security groups, then shared services (logging, CTS, KMS), then workload stacks; never open 0.0.0.0/0 on management ports.

Infrastructure as code: RFS (Resource Formation Service) templates or Terraform provider for Huawei Cloud make environments reproducible; store state remotely and parameterize per-environment values.

Migration assessment: inventory source workloads, classify as rehost / replatform / refactor / retire, and map each to a target service before scheduling cutover windows.

Server migration with SMS: install the agent on the source, run a replication test, then a final incremental sync during the cutover window; validate boot and drivers on the target ECS before switching DNS.

Database migration with DRS: full + incremental synchronization supports near-zero-downtime cutover; verify schema compatibility, character sets, and account privileges on the target before starting.

Object migration with OMS: source/target bucket pairs, bandwidth throttling, and checksum verification; for very large datasets consider DES (data express service) physical transfer instead of the network.

O&M observability: CES for metric alarms and dashboards, LTS for log collection and search, CTS for API audit; set alarms on leading indicators (CPU steal, connection count, disk latency), not only on failures.

Backup and DR: CBR for ECS/EVS/BMS backups with retention policies, VBS for server-level backup, and define RPO/RTO per tier to choose backup vs. pilot-light vs. active-active across regions.

ECS cannot be reached: check, in order, security group rules (stateful, allow-only), subnet network ACL (stateless, both directions), EIP binding, OS firewall, and whether the service is listening on 0.0.0.0 rather than 127.0.0.1.

High CPU on ECS: distinguish user CPU (application), system CPU (syscall/kernel), and steal (noisy neighbor); use top/pidstat to find the hot process, then scale up, scale out, or optimize the query/code.

Disk I/O bottleneck: compare EVS IOPS and throughput limits for the disk type against measured values; if saturated, move to ultra-high I/O, stripe multiple disks, or cache hot reads in DCS.

RDS slow queries: inspect the slow SQL log, check missing indexes and full table scans, and confirm the instance class IOPS ceiling; read replicas offload read traffic but do not fix write-bound bottlenecks.

Connection failures to RDS/DCS: verify the client is in the same VPC or has a peering/EIP path, that the security group allows the client subnet CIDR, and that the connection count is below the instance maximum.

ELB 5xx or unhealthy backends: check health-check path, port, and timeout; a backend returning non-2xx on the probe path is removed from rotation even if the application is otherwise healthy.

OBS access denied or slow uploads: verify IAM policy action/resource match, bucket policy, and ACL precedence; for throughput, use multipart upload and parallel parts, and confirm the endpoint matches the region.

Cost optimization levers: right-size over-provisioned ECS, convert steady workloads to yearly subscription, delete unattached EVS/EIP, apply OBS lifecycle to cold data, and enable auto scaling to remove idle capacity.