Huawei Cloud EIP Cost Optimizer

Overview

This skill provides batch management and cost optimization capabilities for Huawei Cloud Elastic Public IPs (EIPs).

Architecture: Shell + hcloud CLI (KooCLI) → EIP Service API → VPC/Bandwidth resources

Related Skills: For broader cost optimization across all resource types (ECS, EVS, OBS, etc.), see the archived huaweicloud-cost-optimizer skill. This skill focuses exclusively on EIP optimization with deeper functionality and 100% hcloud CLI compliance.

• Periodic cleanup of idle EIPs to reduce holding costs
• Cost analysis and optimization recommendations
• Multi-region unified management
• Automated monitoring and alerting for idle resources
• Operation audit logging for compliance

Typical Use Cases:

• "Help me identify idle EIPs and generate an optimization report"
• "Generate an EIP cost analysis report to identify high-cost resources"
• "Set up idle EIP monitoring with automatic alerts via webhook or email"
• "View EIP distribution and status summary across all regions"
• "Show audit logs for EIP operations in the last 30 days"
• "List all EIPs in cn-north-4 with detailed information"

Prerequisites

1. CLI Environment Requirements (MANDATORY)

• hcloud CLI (KooCLI) v7.0+ — Huawei Cloud command-line tool
• jq — JSON processor for parsing API responses
• bc — Arbitrary precision calculator for cost estimation
• curl — HTTP client for webhook notifications

Install hcloud CLI:

# Linux/macOS one-click install
curl -sSL https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh | bash

# Verify installation
hcloud --version

Install jq, bc, curl:

# Ubuntu/Debian
sudo apt install -y jq bc curl

# CentOS/RHEL
sudo yum install -y jq bc curl

# macOS
brew install jq bc curl

Available Shell Scripts:

• scripts/config.sh - Shared configuration (credentials, regions, proxy)
• scripts/list_eips.sh - List all EIPs in a region (supports filtering and summary)
• scripts/analyze_idle_eips.sh - Analyze idle EIPs and generate optimization reports (read-only)
• scripts/eip_cost_report.sh - Generate EIP cost analysis reports (text/HTML/JSON)
• scripts/monitor_idle_eips.sh - Monitor idle EIPs with webhook/email alerts and cron support
• scripts/check_env.sh - Environment check and validation (hcloud CLI + tools + API)
• scripts/eip_audit_log.sh - Operation audit logging (JSONL + CSV/JSON export)

Note: All scripts are READ-ONLY. This skill does NOT perform bandwidth adjustment, tag management, or EIP release/deletion.

2. Authentication Configuration

This skill supports one authentication path via environment variables:

Environment Variables

export HW_ACCESS_KEY=<your-ak>
export HW_SECRET_KEY=<your-sk>
export HW_REGION_NAME=cn-north-4

Note: If you have already configured hcloud configure interactively (entering credentials via prompts, not command-line arguments), the skill will also detect and use those credentials.

Environment Variables:

Security Notes:

• Never commit credentials to version control
• Never expose AK/SK values in code, conversation, or commands
• Never pass AK/SK values as command-line arguments (exposes credentials in shell history and ps aux)
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly
• Use ./scripts/check_env.sh to validate credentials before running scripts

3. Quick Start

# Step 1: Configure authentication via environment variables
export HW_ACCESS_KEY=<your-ak>
export HW_SECRET_KEY=<your-sk>
export HW_REGION_NAME=cn-north-4

# Step 2: Run environment check
bash scripts/check_env.sh

# Step 3: Run scripts
bash scripts/list_eips.sh --region cn-north-4
bash scripts/analyze_idle_eips.sh --idle-days 7
bash scripts/eip_cost_report.sh --format html

4. IAM Permission Requirements

Note: This skill is READ-ONLY for EIP resources. It does NOT perform any write operations.

Workflow

Main Steps

1. Environment Check → Verify hcloud CLI, jq, credentials
2. EIP Query → List EIPs across regions via hcloud CLI
3. Idle Analysis → Identify unbound EIPs exceeding idle threshold
4. Cost Report → Generate HTML/JSON cost analysis report
5. Monitoring Setup → Configure idle EIP alerts (webhook/email)
6. Audit Logging → Record operations for compliance

EIP Query Workflow

List EIPs across regions, filter by status, output as JSON/table.

Idle EIP Analysis Workflow

Detect unbound EIPs idle beyond threshold, calculate holding costs, generate optimization report.

Cost Report Workflow

Aggregate EIP cost data, render as HTML or JSON report with savings recommendations.

Idle EIP Monitoring Workflow

Periodically check for idle EIPs, send alerts via webhook or email when detected.

Audit Log Workflow

All EIP operations (list/analyze/report/monitor) automatically write to the audit log file for compliance. Each script records its own action on exit. Query history with --action query-log --days N.

All EIP operations use hcloud CLI commands:

Output format: All commands use --cli-output=json for machine-readable output, parsed by jq.

Core Commands

EIP Query

# List all EIPs in a region
bash scripts/list_eips.sh --region cn-north-4

# List EIPs with status filter
bash scripts/list_eips.sh --region cn-north-4 --status DOWN

# List EIPs across multiple regions
bash scripts/list_eips.sh --region cn-north-4,cn-east-3,cn-south-1

Idle EIP Analysis

# Analyze idle EIPs (default threshold: 0 days = all unbound)
bash scripts/analyze_idle_eips.sh

# Custom idle threshold (14 days)
bash scripts/analyze_idle_eips.sh --idle-days 14

# Analyze specific region with JSON output
bash scripts/analyze_idle_eips.sh --region cn-north-4 --idle-days 7 --json

Cost Report

# Generate text cost report (default)
bash scripts/eip_cost_report.sh

# Generate HTML report
bash scripts/eip_cost_report.sh --format html

# Generate JSON report
bash scripts/eip_cost_report.sh --format json

# Custom region
bash scripts/eip_cost_report.sh --region cn-east-3 --format html

Cost Model: Bandwidth-based pricing (~3 CNY/Mbps/month for cn-north-4 on-demand) + IP retain fee (~0.02 CNY/hour for unbound EIPs). API does not return charge_mode, so all estimates use bandwidth billing model.

Idle EIP Monitoring

# Monitor idle EIPs (default threshold: 7 days)
bash scripts/monitor_idle_eips.sh

# Custom threshold
bash scripts/monitor_idle_eips.sh --idle-days 14

# Monitor with webhook alert (only DingTalk/WeCom/Slack HTTPS URLs are allowed)
bash scripts/monitor_idle_eips.sh --idle-days 7 --webhook "https://oapi.dingtalk.com/robot/send?access_token=YOUR_ACCESS_TOKEN"

# Monitor with email alert
bash scripts/monitor_idle_eips.sh --idle-days 7 --email admin@example.com

# Set up daily cron job (9:00 AM) - REQUIRES webhook or email, otherwise it's rejected.
# The cron line embeds the alert parameters so scheduled runs actually notify.
bash scripts/monitor_idle_eips.sh --region cn-north-4 --idle-days 7 --setup-cron \
  --webhook "https://oapi.dingtalk.com/robot/send?access_token=YOUR_ACCESS_TOKEN"

# Remove cron job
bash scripts/monitor_idle_eips.sh --remove-cron

Environment Check

# Full environment validation (CLI + tools + API)
bash scripts/check_env.sh

# Verbose mode (show versions)
bash scripts/check_env.sh --verbose

# Auto-fix missing dependencies
bash scripts/check_env.sh --fix

Operation Audit Logging

# Log an EIP list operation
bash scripts/eip_audit_log.sh --action list --detail "Queried all EIPs"

# Log an analyze operation
bash scripts/eip_audit_log.sh --action analyze --detail "Idle EIP analysis for cn-north-4"

# Export audit logs to CSV
bash scripts/eip_audit_log.sh --action list --export csv

# Export audit logs to JSON
bash scripts/eip_audit_log.sh --action list --export json

# Custom log directory (must NOT be a system dir; will be created if missing)
bash scripts/eip_audit_log.sh --action list --log-dir ~/eip_audit_logs

# Query audit history for the last 30 days
bash scripts/eip_audit_log.sh --action query-log --days 30

# Query audit history for a specific action type
bash scripts/eip_audit_log.sh --action query-log --days 7

Audit Log Entry Format (JSONL, timezone-aware timestamps):

{
  "timestamp": "2026-07-16T10:30:00+08:00",
  "region": "cn-north-4",
  "action": "list",
  "detail": "Queried all EIPs",
  "user": "root"
}

KooCLI Command Format

# General format
hcloud <Service> <Operation> --cli-region=<region> --param1=value1 --param2=value2

# EIP list example
hcloud EIP ListPublicips/v2 --cli-region=cn-north-4

# EIP show detail
hcloud EIP ShowPublicip/v2 --cli-region=cn-north-4 --publicip_id=<id>

| Feature | Description | Example | |---------|-------------|---------|| | Service name | Uppercase PascalCase | EIP, VPC, IAM | | Operation name | PascalCase with version | ListPublicips/v2, ShowPublicip/v2 | | Region param | --cli-region=<value> | --cli-region=cn-north-4 | | Simple param | --key=value | --publicip_id=xxx | | Output format | --cli-output=json | JSON output for programmatic parsing |

Parameters

Shell Script Parameters

Environment Variables

*When hcloud configure is already set up, HW_ACCESS_KEY and HW_SECRET_KEY are not needed. Environment variables take precedence when both are configured.

Output Format

EIP List Output

========================================
Huawei Cloud EIP List (Region: cn-north-4)
========================================
EIP ID: eip-xxx1, IP: 123.45.67.89, BW: 5 Mbps, Status: BOUND (ECS: ecs-xxx)
EIP ID: eip-xxx2, IP: 98.76.54.32, BW: 10 Mbps, Status: UNBOUND ⚠️
========================================
Total: 2 EIPs, Idle: 1

Cost Report Output

Generated by scripts/eip_cost_report.sh — includes:

• Summary statistics (total EIPs, idle, active, total bandwidth, costs)
• Per-EIP detail table with cost estimates
• Available in text, HTML, and JSON formats

Pricing Model: Bandwidth-based (~3 CNY/Mbps/month + 0.02 CNY/hr IP retain fee for unbound EIPs)

Verification

Environment Compliance Check

# Run full environment check (CLI + tools + API)
bash scripts/check_env.sh

# Exit codes:
#   0 - All checks passed
#   1 - Missing dependencies or API errors

Best Practices

1. Use Shell Scripts EXCLUSIVELY: All scripts are Shell + hcloud CLI. No Python SDK dependency.
2. Regular Monitoring: Set up daily cron jobs with monitor_idle_eips.sh --setup-cron to catch idle EIPs early
3. Cost Reports: Generate weekly cost reports with eip_cost_report.sh --format html to track optimization progress
4. Audit Logging: Enable audit logging for all EIP operations using eip_audit_log.sh
5. Multi-Region List: list_eips.sh supports comma-separated regions --region cn-north-4,cn-east-3 for cross-region listing. Note: analyze_idle_eips.sh, eip_cost_report.sh, and monitor_idle_eips.sh process a single region each (run once per region for multi-region analysis).
6. Webhook Alerts: Configure webhooks for real-time idle EIP notifications
7. Environment Validation: Always run check_env.sh first to verify hcloud CLI and dependencies
8. Idle Days Consistency: Both analyze_idle_eips.sh and monitor_idle_eips.sh use --idle-days parameter with consistent timezone handling

References

Notes

• Cost estimates are for reference only — based on cn-north-4 on-demand pricing (bandwidth model: ~3 CNY/Mbps/month + 0.02 CNY/hr IP retain fee). Actual costs may vary by region and billing mode.
• API does not return charge_mode — scripts cannot distinguish bandwidth vs traffic billing; all estimates use bandwidth model.
• This skill is READ-ONLY — it analyzes and reports idle EIPs but does NOT release or delete any resources. Manual action in the console is required to release EIPs.
• EIP release is irreversible — if you choose to release idle EIPs based on the analysis report, the public IP address will be reclaimed and cannot be recovered.
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables (HW_ACCESS_KEY, HW_SECRET_KEY) or hcloud configure interactive mode (entering via prompts, not command-line arguments).
• hcloud CLI is the only supported method — all scripts use hcloud CLI (KooCLI) natively.
• Authentication: Use environment variables (HW_ACCESS_KEY, HW_SECRET_KEY) as the primary method. If hcloud configure is already set up interactively, the skill will detect and use those credentials. Never pass credentials as command-line arguments.
• Temporary Credentials Supported: This skill supports temporary AK/SK+Token obtained via IAM STS. Set HW_SECURITY_TOKEN when using temporary credentials.
• Environment Variable Standard: Uses HW_* prefix for consistency with other Huawei Cloud skills.
• jq is required for all scripts that parse hcloud CLI JSON output.
• Idle days calculation is timezone-consistent — both analyze and monitor scripts use date command for epoch calculation, eliminating UTC offset issues.
• Audit log timestamps are timezone-aware — format YYYY-MM-DDTHH:MM:SS+HH:MM (e.g., +08:00), not misleading Z suffix.

Common Pitfalls