Huawei HCIP-Cloud Service Solutions Architect cheat sheet

Region = physically isolated geography; AZ = isolated data center group inside a region. ECS, EVS, RDS and VPC subnets are AZ-scoped; nothing is replicated across regions by default.

Evaluate every solution on six dimensions: performance, availability, security/compliance, elasticity, operability and cost (TCO).

Service selection rule: need OS-level control or legacy apps -> ECS/BMS; containerized microservices -> CCE/CCI; event-driven short tasks -> FunctionGraph; stateful data -> managed RDS/DCS/OBS.

Prefer managed (PaaS) services when no OS customization is required: built-in HA, backup and patching reduce operational load and TCO.

BMS vs ECS: choose BMS for bare-metal performance, hardware isolation or per-socket/per-core licensing; otherwise ECS.

Pricing models: pay-per-use (no commitment, spiky or temporary workloads), yearly/monthly subscription (discounted, steady state), spot (cheapest, interruptible batch jobs).

TCO must include compute, storage capacity and IOPS, backup vaults, ELB/NAT/VPN/Direct Connect, EIP outbound traffic, and cross-region replication traffic.

Portfolio map: compute (ECS/BMS/CCE/FunctionGraph), storage (EVS/OBS/SFS), network (VPC/ELB/EIP/NAT/DC/VPN), data (RDS/DCS/DWS/DDM), security (IAM/KMS/WAF/HSS/CFW), ops (CES/LTS/AOM).

Compliance-first: data residency decides the region; regulated data may require dedicated hosts (DeH), customer-managed KMS keys and audited access via CTS.

ECS creation inputs: region/AZ, flavor (vCPU + memory), image, disk type and size, VPC + subnet, security group, plus optional EIP and key pair.

Flavor families: general-purpose (balanced), compute-optimized (web/batch), memory-optimized (databases, caches), disk-intensive (big data, HPC), GPU-accelerated (AI, rendering).

Vertical scaling changes the flavor and normally requires a restart; horizontal scaling adds instances, so keep the app tier stateless and put ELB in front.

AS components: scaling configuration (image + flavor + disk + network + key pair), scaling group (min/max/desired, VPC, AZs, ELB association), scaling policy (alarm, scheduled, periodic).

The AS cooldown suppresses further scaling right after an action, preventing flapping; set the health-check grace period longer than the application boot time.

Bind the scaling group to an ELB backend group so new instances register automatically; enable 'replace unhealthy' so failed checks trigger replacement instead of idle capacity.

CCE is managed Kubernetes: Huawei Cloud operates the control plane, worker nodes are ECS/BMS organized in node pools; CCI provides serverless containers with no node management.

BMS has no hypervisor and no live migration; HA must be provided by the application, database replication or an ELB-fronted cluster.

FunctionGraph is billed per invocation and execution duration; use it for scheduled jobs, OBS-event processing and glue code, not for long-running services.

Decision rule by access pattern: block (EVS) for one ECS and low-latency databases; file (SFS) for shared POSIX access by many ECS; object (OBS) for unlimited-scale unstructured data, backup and archive.

EVS is AZ-scoped: a disk attaches only to an ECS in the same AZ, so cross-AZ protection needs SDRS replication or CBR backups.

EVS tiers rank by performance: Extreme SSD (highest IOPS, lowest latency) > general purpose SSD > SAS/SATA; SSD baseline IOPS scales with capacity, so size capacity and performance together.

EVS supports online capacity expansion without detaching; snapshots and CBR backups provide rollback points, and a snapshot can create a new disk or a private image.

OBS storage classes: Standard, Infrequent Access, Archive, Deep Archive; lifecycle rules transition objects automatically, and colder classes add retrieval delay and retrieval fees.

OBS offers multi-AZ redundancy inside a region; cross-region replication copies objects to a second region for DR, and versioning protects against overwrite and accidental deletion.

OBS is accessed through REST API, SDK, obsutil or OBS Browser+; for POSIX-style mounting on Linux use the obsfs tool, because OBS is not a block device.

SFS capacity grows automatically and supports NFS/CIFS for many concurrent ECS; SFS Turbo delivers far higher throughput for latency-sensitive shared workloads and container persistent volumes.

Archive decision rule: data read less than once a month and tolerant of retrieval delay -> OBS Archive; long-term compliance copies -> Deep Archive; hot web assets -> Standard or IA.

VPC CIDRs must use private ranges (10/8, 172.16/12, 192.168/16) with masks /8 to /24; subnets must not overlap with peered VPCs, on-premises ranges or other connected networks.

Security group = stateful and instance-level, allow rules only; network ACL = stateless and subnet-level, with allow and deny rules. Both apply and the most restrictive result wins.

ELB choice: layer 4 (TCP/UDP) for raw throughput and non-HTTP protocols; layer 7 (HTTP/HTTPS) for host/path routing, TLS offload and session persistence. Dedicated LBs give guaranteed performance.

Health checks remove unhealthy backends; align interval, timeout and unhealthy threshold with real application response time to avoid false removal during GC or slow queries.

EIP is a public IP bound to ECS/BMS/ELB/NAT, billed either by fixed bandwidth or by actual traffic; inbound traffic is generally free while outbound is charged.

NAT Gateway: SNAT lets private subnets reach the internet without public IPs; DNAT publishes an internal port. Prefer one NAT Gateway to per-instance EIPs for outbound-only fleets.

Hybrid choice: IPsec VPN over the internet is fast to deploy and cheap but has unpredictable latency and jitter; Direct Connect is a dedicated line with stable bandwidth and latency for heavy or latency-sensitive traffic.

Interconnect matrix: same-region VPC-to-VPC -> VPC peering; cross-region VPC -> Cloud Connect; many VPCs in hub-and-spoke -> Enterprise Router; private access to cloud services without internet -> VPC endpoint.

DNS: public zones resolve internet-facing domains, private zones resolve names only inside associated VPCs; use private DNS for internal service discovery instead of editing hosts files.

IAM model: account -> user groups -> users; permissions come from policies (system or custom) attached to groups or users, and roles/agencies issue temporary credentials for service or cross-account access.

Least privilege: assign permissions to groups, scope policies to specific actions and resources, never use account (root) credentials for daily work, and enable MFA on privileged identities.

KMS envelope encryption: a customer master key protects data encryption keys, and the DEK encrypts the data; CMKs are region-scoped, so cross-region DR needs keys in the recovery region.

Layer separation: Anti-DDoS and security groups/ACL handle layers 3-4; WAF handles layer 7 attacks such as SQL injection, XSS and CC floods and processes only HTTP/HTTPS traffic.

HSS requires an agent on the ECS/BMS and covers intrusion detection, antivirus, vulnerability and baseline checks, file integrity monitoring and ransomware protection.

Cloud Firewall (CFW) provides north-south and east-west layer 3-7 filtering at the VPC boundary and between subnets; it complements rather than replaces security groups.

Bastion host (CBH) centralizes O&M access with protocol proxy, session recording and approval; block direct SSH/RDP from the internet in security group rules.

Audit and compliance: CTS records API operations, LTS retains logs, Situation Awareness aggregates alerts; retention windows must satisfy the applicable compliance regime.

Defense in depth chain: Anti-DDoS -> WAF -> security group/ACL -> HSS -> data encryption with KMS -> IAM least privilege -> CTS audit; no single control is sufficient.

Selection rule: OLTP -> RDS (MySQL/PostgreSQL/SQL Server) or GaussDB; OLAP -> DWS; sharding beyond one instance -> DDM; key-value/document -> DCS or DDS; full-text search -> CSS.

RDS HA uses a primary/standby pair in different AZs with automatic failover; read replicas scale read traffic but replicate asynchronously and may lag.

RDS backup = automated full plus incremental backups with point-in-time recovery inside the retention window, plus manual backups that persist until deleted.

DCS: master/standby for cache HA, cluster mode for horizontal scale; a cache is not durable storage, so design for cache miss and never keep the only copy of data there.

DWS is MPP and column-oriented: strong for large scans and aggregations, poor for high-frequency point updates; load data in bulk (parallel COPY) rather than row by row.

DDM shards tables by a sharding key; choose a high-cardinality, evenly distributed key that appears in most queries, otherwise queries fan out to every shard.

Big data options: MRS for full Hadoop/Spark/Hive control, DLI for serverless SQL and Spark directly on OBS, CDM/DRS/OMS to move data in, DGC/DLV for governance and visualization.

Data lake pattern: land raw immutable data in OBS -> catalog and govern it -> query with DLI or DWS external tables -> serve BI; apply OBS lifecycle rules to move cold partitions to colder tiers.

Migration: DRS handles homogeneous and heterogeneous database migration with incremental synchronization; run a full data comparison before cutover.

RPO = tolerable data loss (sets backup/replication frequency); RTO = tolerable downtime (sets the standby type). Both must be agreed with the business before choosing a DR topology.

DR tiers ordered by cost and RTO: backup and restore (hours to days) < pilot light < warm standby < multi-site active-active (seconds, highest cost).

In-region HA pattern: ECS across at least two AZs behind ELB with Auto Scaling, RDS primary/standby across AZs, and a stateless app tier so instances can be replaced at any time.

Cross-region DR building blocks: OBS cross-region replication, CBR cross-region backup replication, SDRS cross-region protection groups, plus a pre-built template for the recovery site.

Eliminate single points of failure: one AZ, one ECS, one NAT Gateway, one ELB, one database instance, one Direct Connect line (add a second line or a VPN backup).

Backup rule 3-2-1: three copies, two different systems or media, one offsite in another region; test restores periodically, because an untested backup is not a recovery plan.

Availability of a serial chain multiplies (0.999 x 0.999 is about 0.998); an independent parallel path gives 1 - (1-a)(1-b), which is how redundancy buys uptime.

Migration path: inventory and assess -> design target architecture -> replicate (SMS for servers, DRS for databases, OMS/CDM for object and bulk data, DES for very large offline sets) -> rehearsal -> cutover -> optimize.

Cutover rule: run source and target in parallel, verify with data comparison and business smoke tests, then switch DNS/ELB traffic, keeping a defined rollback window.

Cloud Eye (CES) collects platform metrics and, with the agent installed, OS metrics such as memory and disk; alarm actions can send SMN notifications or trigger Auto Scaling policies.

Alarm design: warning at sustained 70-80% utilization over 5-15 minutes, critical at 90%; combine metrics or use multi-period rules to suppress transient spikes.

Operations stack split: LTS for host/container/cloud-service logs, AOM for application and resource O&M dashboards, APM for call-chain tracing and latency root-cause analysis.

CTS records API-level operations for audit and change tracking; export trails to OBS or LTS when retention beyond the default window is required.

Automation ladder: manual scripts -> scheduled AS policies -> FunctionGraph event automation -> IaC templates -> full orchestration; automate repetitive remediation before complex workflows.

Cost levers: right-size from measured utilization, subscribe for steady load, pay-per-use for spiky load, spot for interruptible batch, delete unattached EVS/EIP and stale snapshots, lifecycle OBS data to colder tiers.

Cost visibility: tag resources by project, environment and owner; review monthly spend by tag and set budget alerts, since idle and unattached resources are usually the fastest saving.

Egress control: use a NAT Gateway for outbound-heavy fleets instead of per-instance EIPs, keep traffic inside the VPC or region, and serve public content from OBS or CDN to cut bandwidth charges.

SLA monitoring: track availability, latency and error-rate SLIs per service, alert against error budgets, and review capacity quarterly so growth causes neither throttling nor over-provisioning.