> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prowler.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Prowler product naming: Prowler App is now Prowler Local Server, and Prowler Enterprise is now Prowler Private Cloud. Always use the current names when answering. The full product reference is at /getting-started/products: Open Source projects are Prowler CLI, Prowler Local Server, Prowler Local Dashboard, and Prowler SDK; Prowler Products are Prowler Cloud, Prowler Private Cloud, Prowler Hub, Prowler Lighthouse AI, and Prowler MCP.

# Getting Started With Huawei Cloud on Prowler

export const VersionBadge = ({version}) => {
  return <a href={`https://github.com/prowler-cloud/prowler/releases/tag/${version}`} target="_blank" rel="noopener noreferrer" className="version-badge-link">
            <span className="version-badge-container">
                <span className="version-badge">
                    <span className="version-badge-label">Added in:</span> 
                    <span className="version-badge-version">{version}</span>
                </span>
            </span>
        </a>;
};

<VersionBadge version="5.37.0" />

Prowler for Huawei Cloud scans your Huawei Cloud account for security misconfigurations across compute, storage, networking, identity, encryption, database, and logging services.

<Note>
  Huawei Cloud support in Prowler is community-maintained. For commercial support or to request additional service coverage, [contact us](https://prowler.com/contact).
</Note>

## Prerequisites

Set up authentication for Huawei Cloud with the [Huawei Cloud Authentication](/user-guide/providers/huaweicloud/authentication) guide before starting:

* Create an Access Key ID and Secret Access Key (AK/SK) for an IAM user with read-only permissions.
* Prowler reads the credentials exclusively from environment variables, so secrets are never passed on the command line.

## Prowler CLI

### Run Prowler for Huawei Cloud

Once authenticated, export the credentials as environment variables and run Prowler for Huawei Cloud. Environment variables keep secrets out of shell history and process listings:

```bash theme={null}
export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
prowler huaweicloud
```

### Run Specific Checks

```bash theme={null}
prowler huaweicloud --checks obs_bucket_public_access iam_user_mfa_enabled
```

### Run a Specific Service

```bash theme={null}
prowler huaweicloud --services iam
```

## Regions and Clouds

Huawei Cloud operates as three separate clouds, and every account belongs to exactly one of them:

* **International** — served from the `.com` endpoints (for example `myhuaweicloud.com`).
* **China** — also served from the `.com` endpoints, on the China regions (`cn-*`).
* **Huawei Cloud Europe** — served from the `.eu` endpoints (for example `myhuaweicloud.eu`).

The cloud is a property of the region: each region ID maps to exactly one endpoint domain. Prowler selects the correct endpoint automatically from the region, so no endpoint configuration is required.

### Region Selection Precedence

Prowler resolves the regions to scan from the first source that is set, in this order:

1. **`--region` flag** (aliases `--filter-region`, `-f`) — one or more explicit region IDs.
2. **`HUAWEICLOUD_REGION`** (or `HW_REGION`) environment variable — one or more region IDs, separated by spaces or commas.
3. **`--cloud` selector** (or `HUAWEICLOUD_CLOUD` / `HW_CLOUD`) — expands to every region of the selected cloud.
4. **Default** — when none is set, Prowler falls back to its built-in region list.

A more specific source always wins: `--region` overrides `HUAWEICLOUD_REGION`, which overrides `--cloud`.

### Select Specific Regions

To scan a defined set of regions, pass the region IDs to `--region` or set `HUAWEICLOUD_REGION`. Accounts outside China must select a region they can reach — for example `eu-west-101` for Huawei Cloud Europe or `ap-southeast-1` for International.

```bash theme={null}
# Flag (one or more regions)
prowler huaweicloud --region eu-west-101 ap-southeast-1

# Environment variable (space- or comma-separated)
export HUAWEICLOUD_REGION="ap-southeast-1, ap-southeast-2"
prowler huaweicloud
```

### Scan an Entire Cloud

To scan every region of an account's cloud without listing regions, use the `--cloud` selector or the `HUAWEICLOUD_CLOUD` environment variable. Prowler expands it to that cloud's regions and selects the matching endpoint automatically:

```bash theme={null}
# Scan all Huawei Cloud Europe regions (.eu endpoints)
prowler huaweicloud --cloud europe

# Scan all International regions (.com endpoints)
prowler huaweicloud --cloud international

# Scan all China regions (.com endpoints)
prowler huaweicloud --cloud china
```

The `--cloud` flag accepts three values: `international`, `europe`, and `china`. The `HUAWEICLOUD_CLOUD` (or `HW_CLOUD`) environment variable additionally accepts the short aliases `intl`/`com` (International), `eu` (Europe), and `cn` (China).

<Note>
  A single set of credentials belongs to one cloud, so `--cloud` selects which cloud to scan — it cannot authenticate against both `.com` and `.eu` at once. To scan accounts on different clouds, run Prowler once per account with that account's credentials.
</Note>

### How Prowler Handles Regions and Endpoints

Prowler manages several Huawei Cloud specifics automatically during a scan:

* **Endpoint selection:** The endpoint domain (`.eu` or `.com`) is derived from each region, so every service targets the right cloud. This corrects services whose bundled metadata still points Europe regions at `.com`.
* **Project resolution:** The per-region project ID is resolved automatically, so multi-region scans work without any project configuration.
* **Credential validation:** Credentials are validated against a region in the account's cloud that exposes IAM, so validation succeeds even when the requested regions do not all offer IAM.
* **Unsupported regions:** Any region a given service does not offer is skipped and logged, so scanning an entire cloud never fails on regions where a service is unavailable.

### Supported Regions

Prowler recognizes the following region IDs, grouped by cloud.

**International (`.com`)**

| Region ID          | Location                |
| ------------------ | ----------------------- |
| `ae-ad-1`          | UAE (Abu Dhabi)         |
| `af-north-1`       | Egypt (Cairo)           |
| `af-south-1`       | South Africa            |
| `ap-southeast-1`   | Hong Kong               |
| `ap-southeast-2`   | Singapore               |
| `ap-southeast-3`   | Thailand                |
| `ap-southeast-4`   | Malaysia                |
| `ap-southeast-5`   | Indonesia (Jakarta)     |
| `eu-west-0`        | Ireland                 |
| `la-north-2`       | Mexico                  |
| `la-south-2`       | Chile (Santiago)        |
| `me-east-1`        | UAE (Dubai)             |
| `my-kualalumpur-1` | Malaysia (Kuala Lumpur) |
| `na-mexico-1`      | Mexico (Mexico City)    |
| `ru-moscow-1`      | Russia (Moscow-1)       |
| `sa-brazil-1`      | Brazil                  |
| `tr-west-1`        | Türkiye (Istanbul)      |

**Huawei Cloud Europe (`.eu`)**

| Region ID     | Location         |
| ------------- | ---------------- |
| `eu-west-101` | Ireland (Dublin) |

**China (`.com`)**

| Region ID        | Location            |
| ---------------- | ------------------- |
| `cn-north-1`     | China (Beijing-1)   |
| `cn-north-2`     | China (Beijing-2)   |
| `cn-north-4`     | China (Beijing-4)   |
| `cn-north-9`     | China (Ulanqab)     |
| `cn-north-11`    | China (Ulanqab-11)  |
| `cn-north-12`    | China (Ulanqab-12)  |
| `cn-east-2`      | China (Shanghai-2)  |
| `cn-east-3`      | China (Shanghai-1)  |
| `cn-east-4`      | China (Shanghai-4)  |
| `cn-east-5`      | China (Shanghai-5)  |
| `cn-south-1`     | China (Guangzhou)   |
| `cn-south-2`     | China (Guangzhou-2) |
| `cn-south-4`     | China (Guangzhou-4) |
| `cn-southwest-2` | China (Guiyang)     |
| `cn-southwest-3` | China (Guiyang-3)   |

## Available Services

Prowler for Huawei Cloud currently supports the following services:

| Service | Description                                                                                            |
| ------- | ------------------------------------------------------------------------------------------------------ |
| `cts`   | Cloud Trace Service trackers that record account and API activity for audit logging                    |
| `ecs`   | Elastic Cloud Server compute instances and their key pair, public IP, and security group configuration |
| `elb`   | Elastic Load Balance load balancers and their public exposure                                          |
| `evs`   | Elastic Volume Service block volumes and their encryption settings                                     |
| `iam`   | Identity and Access Management users, MFA devices, password policy, and account operation protection   |
| `kms`   | Key Management Service keys, their state, and rotation configuration                                   |
| `obs`   | Object Storage Service buckets and their public-access configuration                                   |
| `rds`   | Relational Database Service instances and their public access, backup, and disk-encryption settings    |
| `vpc`   | Virtual Private Cloud security groups and their ingress rules                                          |
| `waf`   | Web Application Firewall instances and their status                                                    |