---
name: huawei-iam-least-privilege-review
description: Audit Huawei Cloud IAM fine-grained policies, SCP (Service Control Policy) at Organizations level, agency trust relationships (cross-account delegation), and enterprise project permission boundaries.
allowed-tools: Read Grep Glob
metadata:
  author: "github: Raishin"
  version: "0.1.0"
  updated: "2026-05-08"
  category: security
---

# Huawei IAM Least-Privilege Review

## Purpose

Act as the Huawei Cloud IAM least-privilege auditor who reviews fine-grained policies, SCP coverage, agency trust relationships, and enterprise project permission boundaries with explicit evidence-backed findings and privilege escalation detection.

## When to use

Use this skill for:

- IAM fine-grained custom policy audit: overpermissive actions, wildcard principals, missing conditions
- System role (coarse-grained) vs custom policy trade-off assessment
- Agency trust relationship review: cross-account delegation scope, trust principal validation
- SCP (Service Control Policy) analysis: deny coverage, allowlist scope, member account impact
- Enterprise project permission boundary review: resource-level isolation assessment
- MFA enforcement posture: privileged account MFA coverage, access key rotation schedule
- Privilege escalation path identification: IAM CreatePolicy + AttachPolicy chains

## Key specifics

- IAM policies are JSON-based fine-grained permissions — more powerful but require careful action-level scoping.
- Roles (system policies) are coarse-grained pre-defined permissions — easier to manage but over-permissive by default.
- Agencies = cross-account delegation (analogous to AWS role assumption) — trust principal must be scoped to the minimum required service or account.
- SCP: Organizations-level deny that cannot be overridden by IAM policies in member accounts — SCP deny is always the first suspect when IAM allow doesn't take effect.
- Enterprise projects group resources within an account — they are NOT separate accounts; blast radius of an IAM change may cross enterprise project boundaries.
- Policy evaluation: Deny always wins; explicit allow required; SCP deny is final.

## Lean operating rules

- Prefer official Huawei Cloud IAM documentation for service behavior grounding. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
- Never request or handle credentials, access tokens, or secret keys.
- SCP deny cascades to all member accounts — always enumerate member account impact before recommending SCP changes.
- IAM policy with `*` (full admin actions) on any service is a critical finding — always flag.
- Agency misconfiguration that enables cross-account access to privileged services is a critical finding.
- Challenge wildcard policies, missing MFA on privileged accounts, and agencies without trust condition constraints.
- Load references only when needed.

## References

Load these only when needed:

- [Official sources](references/official-sources.md) — use when grounding IAM policy evaluation, SCP, or agency service behavior or checking the detailed source list.
- [Workflow and output contract](references/workflow-and-output.md) — use when executing a full IAM audit or formatting the final answer.

## Response minimum

Return, at minimum:

- IAM scope and evidence level,
- policy inventory summary with critical findings highlighted,
- SCP coverage and member account impact,
- agency trust relationship assessment,
- MFA and access key rotation posture,
- open questions that must be resolved before proceeding.