Huawei Cloud Authentication in Prowler

Prowler for Huawei Cloud authenticates against the Huawei Cloud APIs using an IAM user’s Access Key ID and Secret Access Key (AK/SK). Credentials are read exclusively from environment variables to avoid exposing secrets in shell history or process listings; there are no credential CLI flags.

Required Credentials

Prowler requires read access to the Huawei Cloud account. The following values are supported:

Credential	Environment Variable	Description
Access Key ID	`HUAWEICLOUD_ACCESS_KEY_ID` (or `HW_ACCESS_KEY`)	Permanent access key ID of the IAM user
Secret Access Key	`HUAWEICLOUD_SECRET_ACCESS_KEY` (or `HW_SECRET_KEY`)	Secret access key paired with the access key ID
Domain ID	`HUAWEICLOUD_DOMAIN_ID` (or `HW_DOMAIN_ID`)	Optional account (domain) ID
Security Token	`HUAWEICLOUD_SECURITY_TOKEN`	Optional security token for temporary credentials
Region	`HUAWEICLOUD_REGION` (or `HW_REGION`)	Default region(s) when `--region` is not passed (e.g. `eu-west-101`)
Cloud	`HUAWEICLOUD_CLOUD` (or `HW_CLOUD`)	Scan every region of a cloud (`international`, `europe`, or `china`) when no region is set

The endpoint domain (.eu or .com) and the per-region project ID are resolved automatically from the region, so neither endpoint nor project configuration is needed. Multi-region scans work out of the box. For the region precedence rules and the full list of supported regions, see Regions and Clouds.

Huawei Cloud runs separate clouds: International and China (.com endpoints) and Huawei Cloud Europe (.eu endpoints). The region (or --cloud selector) determines the endpoint, so accounts outside China must select a region they can reach — for example eu-west-101 for a Huawei Cloud Europe account. A single set of credentials belongs to one cloud, so it cannot authenticate against both .com and .eu; scan each account with its own credentials.

API Credentials

Step 1: Create an Access Key (AK/SK)

Log in to the Huawei Cloud console.
Open My Credentials from the account menu, then select Access Keys.
Click Create Access Key and complete the identity verification.
Download the credentials.csv file — it contains the Access Key ID and Secret Access Key. The secret is not shown again.

Use an IAM user with read-only permissions (for example, the built-in ReadOnly policy) rather than the account root credentials.

Step 2: Configure Authentication

Export the credentials as environment variables:

export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"

Then run Prowler:

prowler huaweicloud

Assuming an Agency (Cross-Account)

To scan a different account, assume an agency delegated to your account. Set the agency name and the target account, and Prowler exchanges the base credentials for temporary credentials scoped to the agency:

export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
export HUAWEICLOUD_AGENCY_NAME="your-agency-name"
export HUAWEICLOUD_ASSUME_DOMAIN_ID="target-account-domain-id"   # or HUAWEICLOUD_ASSUME_DOMAIN_NAME
prowler huaweicloud

Environment Variable	Description
`HUAWEICLOUD_AGENCY_NAME`	Name of the agency to assume in the target account
`HUAWEICLOUD_ASSUME_DOMAIN_ID`	Domain ID of the target (delegating) account
`HUAWEICLOUD_ASSUME_DOMAIN_NAME`	Domain name of the target account (alternative to the domain ID)

Verifying Authentication

To confirm that Prowler can reach the account, run a scan against a single region the account can reach:

# China account
prowler huaweicloud --region cn-north-4

# International account
prowler huaweicloud --region ap-southeast-1

# Huawei Cloud Europe account
prowler huaweicloud --region eu-west-101

To scan the account’s entire cloud instead, use the --cloud selector:

prowler huaweicloud --cloud europe

A successful run reports findings for the discovered resources. A failed run displays an error message indicating the credential or connectivity issue.

CI/CD Integration

For automated pipelines, set the credentials as secret environment variables: GitHub Actions:

env:
  HUAWEICLOUD_ACCESS_KEY_ID: ${{ secrets.HUAWEICLOUD_ACCESS_KEY_ID }}
  HUAWEICLOUD_SECRET_ACCESS_KEY: ${{ secrets.HUAWEICLOUD_SECRET_ACCESS_KEY }}

steps:
  - name: Run Prowler
    run: prowler huaweicloud

GitLab CI:

variables:
  HUAWEICLOUD_ACCESS_KEY_ID: $HUAWEICLOUD_ACCESS_KEY_ID
  HUAWEICLOUD_SECRET_ACCESS_KEY: $HUAWEICLOUD_SECRET_ACCESS_KEY

prowler_scan:
  script:
    - prowler huaweicloud

Prowler Cloud

Prowler for MSPs and MSSPs

Prowler Lighthouse AI

Prowler for AI Agents

CI/CD

CLI

Providers

Cookbooks

Huawei Cloud Authentication in Prowler

Required Credentials

API Credentials

Step 1: Create an Access Key (AK/SK)

Step 2: Configure Authentication

Assuming an Agency (Cross-Account)

Verifying Authentication

CI/CD Integration

​Required Credentials

​API Credentials

​Step 1: Create an Access Key (AK/SK)

​Step 2: Configure Authentication

​Assuming an Agency (Cross-Account)

​Verifying Authentication

​CI/CD Integration

Required Credentials

API Credentials

Step 1: Create an Access Key (AK/SK)

Step 2: Configure Authentication

Assuming an Agency (Cross-Account)

Verifying Authentication

CI/CD Integration