Huawei Cloud Billing Scout

Huawei Cloud · How Much Spent & Why Charged · Read-Only Reconciliation

Huawei Cloud Read-Only Billing — Spend, Charges & Reconciliation

Using hcloud ≥7.2.2 and BSS read-only IAM, answer in one conversation: how much spent, why charged, where the difference is, what evidence is still missing. Query only, no modifications, no account operations on behalf of users.

Prerequisites

Prerequisite check: Huawei Cloud CLI (hcloud) >= 7.2.2 required

Run hcloud version to verify version >= 7.2.2, and hcloud configure list to check profile exists.

Run hcloud configure set --cli-lang=cn — BSS requires Chinese mode.

If not installed or version is too low, see references/cli-installation-guide.md for installation guide.

hcloud version
hcloud configure list
hcloud configure set --cli-lang=cn

Principles

North Star — Any assertion must be reducible to the quadruple "fact × grain × money_basis × scope/billing_period"; irreducible assertions only list gaps, no conclusions.

• Three-Set First — Stop if any of scope, billing_period (time), or money_basis is missing; ask only the point that would change the verification path, no clarification questionnaire.
• Single Fact No Mixing — Monthly summary, resource detail, monthly amortization, and orders are each a distinct fact type with different grains; no cross-summing, no substitution.
• Evidence Boundary Self-Consistent — Each entity only answers questions within its evidence_boundary; speculation, pending checks, and responsibility judgments must first verify whether evidence falls within the boundary.

Division of Labor

SKILL.md defines behavior; semantic/catalog.yml defines entry points and required context; semantic/billing-ontology.yml defines facts, grains, money_basis, and source_operations; references/related-commands.md defines copyable BSS templates and pagination limits.

Four types of billing questions and routing: see references/semantic/catalog.yml.

Verification Path

Huawei Cloud Gate — Before matching in catalog.yml: if user has not indicated Huawei Cloud / BSS / this skill's billing scope, and cannot be determined from conversation as the Huawei Cloud account for current hcloud profile, first ask one confirmation "Query current configured Huawei Cloud account and billing period?"; without confirmation, no BSS query execution. Non-Huawei Cloud or other cloud vendor billing → only state out of scope, no evidence gathering.

Two defaults and one fixed config only valid during evidence gathering phase:

• Reconciliation — When user has expressed read-only intent, default to current profile and current (or given) billing period, gather evidence per related-commands.md reconciliation order; ask one ID at a time only when blocking ID is missing.
• Enterprise / Partner — When ontology requires customer_id or other prerequisite IDs, first provide read-only acquisition path or one clarification, then make responsibility judgment.
• BSS Endpoint — All hcloud BSS calls require --cli-region=cn-north-1; no substitution with profile or other regions. [Fixed config, non-adjustable]

Hard Constraints (Non-Negotiable)

The following three are derived from principles, non-negotiable.

Read-Only

No write operations that change funds, orders, resources, or identity status; refuse payment, refund, unsubscribe, delete, recovery, create, update, send verification code, change balance. Why: Once a write occurs, the fact state that assertions depend on is contaminated by itself. List*/Show* with Change in name are still read-only ledgers, not in this category.

No Leak

No output of credentials, long identifiers that can restore identity, complete business IDs, profile / region. Why: Identity dimension disclosure exceeds evidence_boundary response scope; delivery value is unrelated to disclosure degree.

No Extrapolation

Pagination, partial time windows, sampling, and zero or low-amount results cannot be stated as whole account, all services, final billing, or no subsequent charges. Why: Grain does not allow amplification; conclusions at local grain cannot be declared as facts at coarser grain unless evidence money_basis already covers entire month.

Response Requirements

Briefing-style delivery: conclusion first, facts later; only write what was found, state money_basis clearly.

• Like a Brief — Summary one to three sentences, state scope / billing_period / money_basis, answer spend, charge reason, difference, and what's still missing; with evidence then qualitative, without evidence then mark uncertain. Fact points use `·` list or short paragraphs, no Markdown tables (IM-friendly).
• Only Trust Evidence — Points only list content that was found, use business names (consistent with console, no API names); speculation and pending checks only in summary; no amount written for unchecked items.
• Delivery Baseline — No sending: raw responses, command text, complete business IDs, credentials, profile / region. Gaps only provide one read-only next step (business wording), not "please reconcile yourself".

Boundaries

• Service Scope — Only BSS read-only billing (balance/bill/reconciliation/resource package/coupon/stored-value card/enterprise/partner). Non-Huawei Cloud or other cloud vendor billing not in scope.
• Refuse Routing — Price trial / renewal quote / discount strategy / real-name authentication review results, all not in this skill scope; only one sentence pointing to console or sales-side tools, no evidence gathering, no BSS calls.
• Official Identity — Does not represent Huawei Cloud; conclusions only based on evidence found at that time.
• Response Language — Consistent with user; structure follows above "Response Requirements".
• Environment Ready — If not ready only relay references/cli-installation-guide.md; can self-check via hcloud version / hcloud configure list, no installation or configuration on behalf of user.

References

Huawei Cloud KooCLI Installation Guide

Overview

Huawei Cloud KooCLI (hcloud) is the official Huawei Cloud command-line tool that supports managing 100+ cloud services. This guide provides complete installation, configuration, and verification processes.

Version Requirements

• Minimum version: One major version before the latest major version (e.g., if current is 7.x.x, then not lower than 6.x.x)
• Latest version: Refer to https://support.huaweicloud.com/wtsnew-hcli/index.html
• Verification command: hcloud version
• Update command: hcloud update

Quick Installation (All Platforms)

One-click Installation

# Download and run official installation script (interactive)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh

# Non-interactive installation (skip confirmation)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y

Verify Installation

# Check version
hcloud version
# Expected output: Current KooCLI version: 7.2.2

# Check help
hcloud --help

Installation Methods for Each Platform

1. Linux Systems

Detect System Architecture

echo $HOSTTYPE
# x86_64: AMD 64-bit system
# aarch64: ARM 64-bit system

Step-by-step Installation

# AMD 64-bit system
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
sudo mv hcloud /usr/local/bin/

# ARM 64-bit system
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
tar -zxvf huaweicloud-cli-linux-arm64.tar.gz
sudo mv hcloud /usr/local/bin/

2. macOS Systems

Detect System Architecture

echo $HOSTTYPE
# If empty, use:
uname -a
# x86_64: AMD 64-bit system (Intel chips)
# arm64: ARM 64-bit system (Apple Silicon)

Step-by-step Installation

# Intel chips (AMD 64-bit)
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
sudo mv hcloud /usr/local/bin/

# Apple Silicon (ARM 64-bit)
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
tar -zxvf huaweicloud-cli-mac-arm64.tar.gz
sudo mv hcloud /usr/local/bin/

3. Windows Systems

Installation Steps

1. Download: https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip 2. Extract ZIP file to get hcloud.exe 3. Add the directory containing hcloud.exe to PATH environment variable

Verify Installation

hcloud version
# Expected output: Current KooCLI version: 7.2.2

4. Docker Environment

Using Official Image

# Pull and run
docker run --rm -it swr.cn-north-4.myhuaweicloud.com/huawei-cloud/koocli:latest version

Custom Image

FROM ubuntu:latest
RUN apt-get update -y && apt-get install curl -y
RUN curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
WORKDIR /workspace
ENTRYPOINT ["/usr/local/bin/hcloud"]

Build and use:

# Build image
docker build -t hcloudcli .

# Run command
docker run --rm -it hcloudcli version

Post-installation Configuration

Auto-completion Configuration

# Enable auto-completion
hcloud auto-complete on

# Reload shell configuration
# Bash: source ~/.bashrc
# Zsh: source ~/.zshrc

Multi-environment Configuration

# Create development environment configuration
hcloud configure init --cli-profile dev

# Create test environment configuration
hcloud configure init --cli-profile test

# Create production environment configuration
hcloud configure init --cli-profile prod

# View all configurations
hcloud configure list

# Use specific configuration
hcloud ECS NovaListServers --cli-profile=dev --cli-region=cn-north-4

Troubleshooting

Common Installation Issues

Insufficient Permissions

# Linux/macOS: Use sudo
sudo bash ./hcloud_install.sh

# Or install to user directory
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -d ~/.local/bin

Command Not Found

# Check PATH
echo $PATH
which hcloud

# Manually add to PATH
export PATH=$PATH:/usr/local/bin
# Or
export PATH=$PATH:$(pwd)

sha256sum Command Not Found

# Ubuntu/Debian:
sudo apt-get install coreutils

# CentOS/RHEL:
sudo yum install coreutils

# macOS:
brew install coreutils

Network Issues

# Test network connection
ping cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com

# Use proxy
export http_proxy=http://proxy:port
export https_proxy=http://proxy:port

Updates and Maintenance

Update KooCLI

# Interactive update
hcloud update

# Or reinstall latest version
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y

Uninstall KooCLI

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file
# 2. Remove relevant directory from PATH
# 3. Delete C:\Users\{username}\.hcloud\ directory

Clean Cache

# Clean KooCLI cache
rm -rf ~/.hcloud/cache/

# Clean downloaded files
rm -f hcloud_install.sh huaweicloud-cli-*.tar.gz huaweicloud-cli-*.zip

Best Practices

Version Management

• Use fixed versions for production environments
• Use latest versions for test environments
• Record installed version numbers

Environment Isolation

• Create independent configurations for different environments
• Use environment variables to store sensitive information
• Regularly backup configuration files

Automated Deployment

#!/bin/bash
set -e

# Download installation script
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh

# Install KooCLI
bash ./hcloud_install.sh -y

# Verify installation
hcloud version

Docker Best Practices

# Use volume to persist configuration
docker run --rm -it \
  -v ~/.hcloud:/root/.hcloud \
  swr.cn-north-4.myhuaweicloud.com/huawei-cloud/koocli:latest \
  version

# Create alias to simplify usage
alias hcloud-docker='docker run --rm -it -v ~/.hcloud:/root/.hcloud swr.cn-north-4.myhuaweicloud.com/huawei-cloud/koocli:latest'

Version Compatibility

• KooCLI 7.2.2+: Supports --cli-x-project-id parameter
• KooCLI 6.2.4+: Supports --cli-auth-type parameter
• KooCLI 5.3.4+: Supports SSO configuration parameters

---

Tip: This guide provides complete KooCLI installation and configuration processes. Please strictly follow security rules to protect credential security.

IAM Minimum Permissions

Objective: BSS billing read-only first; product resource read-only only for cross-validation "whether resources currently found in bills can still be queried".

IAM Actions vary by account type, site, and service version. This document provides permission design guidelines; before implementation, refer to IAM Permission Best Practices, API Explorer and hcloud <SERVICE> <Operation> --help.

Permission Layers

Do not add write permissions for payment, renewal, unsubscribe, recovery, create, update, delete, send verification code, transfer, etc.

BSS Core Read-Only

Policy skeleton (illustrative; before implementation, refer to actual Actions in IAM console/API Explorer):

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bss:*:get",
        "bss:*:list"
      ],
      "Resource": "*"
    }
  ]
}

If IAM does not accept wildcard read-only Actions, explicitly list query Actions according to actual API. Do not use write operations to supplement permissions.

Multi-Account Read-Only

Only use when enterprise master/sub-account relationship and authorization are established; regular accounts may return 403. Partner/resale interfaces also require confirmation of authorization relationship and account scope; cannot automatically expand from current account to customer list.

Financially independent sub-accounts, partners, and resale customers have additional constraints. When interface returns no permission, do not bypass or expand query.

Product Read-Only

Product APIs are only used for cross-validation, not as billing fact source.

If product API cannot find resource, it only indicates "current API did not find". Bill may still come from historical billing period, delayed billing, sub-resource, shared bandwidth, backup, snapshot, traffic, marketplace, or projects not supporting enterprise project aggregation.

Permission Failure Handling

Command Contract Appendix

This document only retains operation contracts: purpose, required fields, templates, and limits. Routing see semantic/catalog.yml (required_context; triggers as auxiliary, full triggers/refusal see SKILL.md), semantic boundary see semantic/billing-ontology.yml entity evidence_boundary.

Command Format Standard

Service name always `BSS` — Do not use account, bill or other hcloud sub-services; balance, bills, reconciliation are all under BSS List* / Show*.

Core format: hcloud BSS <Operation> --param=value --cli-region=<region> --cli-output=json (<Operation> must be operation name in current entity source_operations)

Format Rules

Global Constraints

• Command whitelist — Consistent with current entity source_operations; only hcloud BSS <Operation>. First query must copy this document #### template; if no template then stop. Do not use --help to discover op or construct parameters; if template still errors, can use --help for that op only to verify fields (see SKILL.md verification path).
• Only execute List* / Show*; List* / Show* with Change in name are still read-only queries (e.g., account/coupon transactions), not write operations.
• Refuse payment, renewal, refund, unsubscribe, recovery, create, update, delete, send verification code, change balance or resources.
• Default limit<=10, offset=0; find prerequisite IDs at most recent 3 billing periods, 3 pages per command, limit<=50 per page.
• Array and object parameters only use verified dot notation; if no template then stop, do not try JSON strings.
• Account, customer, resource, order, transaction, coupon, card, partner IDs default desensitized.

customer_billing

cost_and_usage

cost_and_usage Example Templates

ListCosts enums: amount_type = PAYMENT_AMOUNT (payable) or NET_AMOUNT (paid); cost_type = ORIGINAL_COST or AMORTIZED_COST. Filter keys: REGION_CODE, ENTERPRISE_PROJECT_ID (not ENTERPRISE_PROJECT). Filter empty → write "no records for that project/condition"; Prohibited: remove filter to query full account ranking.

ListCosts

By region (billing period 2025-04):

hcloud BSS ListCosts \
  --amount_type=PAYMENT_AMOUNT \
  --cost_type=ORIGINAL_COST \
  --time_condition.begin_time=2025-04-01 \
  --time_condition.end_time=2025-04-30 \
  --time_condition.time_measure_id=1 \
  --groupby.1.key=CLOUD_SERVICE_TYPE \
  --groupby.1.type=dimension \
  --filters.1.filter_factor.key=REGION_CODE \
  --filters.1.filter_factor.value.1=cn-north-1 \
  --filters.1.operator=0 \
  --cli-region=<region> \
  --cli-output=json \
  --limit=10 \
  --offset=0

By enterprise project + cloud service ranking (EP-FINANCE example):

hcloud BSS ListCosts \
  --amount_type=PAYMENT_AMOUNT \
  --cost_type=ORIGINAL_COST \
  --time_condition.begin_time=2025-04-01 \
  --time_condition.end_time=2025-04-30 \
  --time_condition.time_measure_id=1 \
  --groupby.1.key=CLOUD_SERVICE_TYPE \
  --groupby.1.type=dimension \
  --filters.1.filter_factor.key=ENTERPRISE_PROJECT_ID \
  --filters.1.filter_factor.value.1=EP-FINANCE \
  --filters.1.operator=0 \
  --cli-region=<region> \
  --cli-output=json \
  --limit=10 \
  --offset=0

ShowCustomerAccountBalances

Balance/debt first query:

hcloud BSS ShowCustomerAccountBalances \
  --cli-region=<region> \
  --cli-output=json

ListCustomerBillsFeeRecords

Cost center billing period transaction (reconciliation transaction side):

hcloud BSS ListCustomerBillsFeeRecords \
  --bill_cycle=2025-04 \
  --cli-region=<region> \
  --cli-output=json \
  --limit=10 \
  --offset=0

ListCustomerselfResourceRecordDetails

Export resource details (reconciliation export side):

hcloud BSS ListCustomerselfResourceRecordDetails \
  --cycle=2025-04 \
  --cli-region=<region> \
  --cli-output=json \
  --limit=10 \
  --offset=0

reconciliation (Minimum Read-Only Sequence)

Default current profile; if billing period not given use current billing period (delivery summary states clearly). Recommended sequence:

1. ListCustomerBillsFeeRecords — Cost center billing period transaction. 2. ListCustomerselfResourceRecordDetails — Same month resource details. 3. If still cannot connect difference, then query ListCustomerOrders / ShowCustomerOrderDetails.

Insufficient evidence no blame; do not use ShowCustomerMonthlySum to replace this sequence.

discount_entitlement

discount_entitlement Example Templates

ListFreeResourceInfos

hcloud BSS ListFreeResourceInfos \
  --service_type_code_list.1=hws.service.type.obs \
  --cli-region=<region> \
  --cli-output=json

ListFreeResourceUsages

hcloud BSS ListFreeResourceUsages \
  --free_resource_ids.1=<free_resource_id> \
  --cli-region=<region> \
  --cli-output=json

ListQuotaCoupons

hcloud BSS ListQuotaCoupons \
  --quota_ids.1=<quota_id> \
  --quota_status_list.1=0 \
  --cli-region=<region> \
  --cli-output=json

ListPartnerCouponsRecord

hcloud BSS ListPartnerCouponsRecord \
  --coupon_ids.1=<coupon_id> \
  --operation_types.1=1 \
  --cli-region=<region> \
  --cli-output=json

order_evidence

enterprise_multi_account

partner_resale

partner_resale Example Templates

ListSubCustomerNewTag

hcloud BSS ListSubCustomerNewTag \
  --customer_ids.1=<customer_id> \
  --cli-region=<region> \
  --cli-output=json

ListCustomerOnDemandResources

hcloud BSS ListCustomerOnDemandResources \
  --customer_id=<customer_id> \
  --resource_ids.1=<resource_id> \
  --cli-region=<region> \
  --cli-output=json

ListPayPerUseCustomerResources

hcloud BSS ListPayPerUseCustomerResources \
  --resource_ids.1=<resource_id> \
  --status_list.1=2 \
  --cli-region=<region> \
  --cli-output=json

ListCustomersBalancesDetail

hcloud BSS ListCustomersBalancesDetail \
  --customer_infos.1.customer_id=<customer_id> \
  --cli-region=<region> \
  --cli-output=json

reference_dimensions

Out of Scope (Refuse Routing)

Product-Side Read-Only Cross-Validation

BSS is billing fact source. Product API only answers "whether resource can currently be found", does not overturn historical bill; Only after BSS has clues, then query product-side List / Show / Get.