Security and Compliance Design: IAM, KMS, WAF, HSS and Cloud Firewall
What to know
Design security in layers, because questions usually ask which control fixes which risk.
Identity (IAM): the Huawei Cloud account is the root of trust; day-to-day work should use IAM users in groups with policies (system or custom JSON), MFA enabled, and least privilege granted through roles/agencies for cross-service access. Never distribute the account's access keys. Enterprise projects group resources for both permission scoping and cost attribution.
Data (KMS/DEW): customer master keys encrypt EVS, OBS, and database storage using envelope encryption; rotation is configurable. Deleting a CMK is scheduled and irreversible - the correct sequence is disable, verify, then delete.
Application (WAF): L7 protection against SQL injection, XSS, malicious crawlers, and CC floods; placed in front of ELB, ECS, or CDN. Anti-DDoS handles L3/L4 volumetric attacks - WAF does not stop those, and vice versa.
Network (Cloud Firewall): VPC-level traffic control for both north-south and east-west flows, complementing security groups with centralised policy. Host (HSS): requires the agent installed on the server; covers baseline checks, vulnerability and patch visibility, intrusion detection, ransomware protection, and file integrity.
Audit (CTS): records management-plane operations; retain long-term by transferring trails to OBS.
Traps
Policy evaluation: an explicit Deny always wins, and the default is deny. WAF is not a substitute for Anti-DDoS or for host hardening. Security groups and Cloud Firewall overlap - know which layer the question is describing. HSS cannot protect a host without the agent, and OS patching remains your responsibility.
Rule of thumb
Identity → network → application → host → data → audit. Name the layer, then the service: IAM/MFA, SG/ACL/CFW, WAF, HSS, KMS, CTS.