Terraform on Huawei Cloud: Infrastructure as Code for Compute, Storage, and Networking

Huawei Cloud is a cloud platform by Huawei, offering various services like computing, storage, and more. Huawei Cloud is a global cloud computing platform that offers a wide range of cloud services. It is one of the leading cloud providers in the world, offering solutions for businesses of all sizes, from startups to large enterprises.

Integration with Terraform allows users to automate resource management on Huawei Cloud. With Terraform, users define infrastructure using configuration files, making resource management consistent and repeatable. Users can leverage Terraform features like state management and change planning for efficient cloud infrastructure management. This integration provides a flexible and automated way to manage resources on Huawei Cloud.

Terraform allows you to define and provision your cloud infrastructure in a declarative way, making it easier to manage, version, and collaborate on your cloud deployments.

Huawei Cloud Service Portfolio

Huawei Cloud provides a variety of services, including:

Compute: Elastic Compute Service (ECS), Bare Metal Server, and more.
Storage: Elastic Volume Service (EVS), Object Storage Service (OBS), and more.
Networking: Virtual Private Cloud (VPC), Elastic Load Balancing (ELB), and more.
Databases: Relational Database Service (RDS), NoSQL Database Service (GaussDB), and more.
Security: Web Application Firewall (WAF), Cloud Trace Service (CTS), and more

The service categories map directly to Terraform resource types in the Huawei Cloud provider.

Category	Example Services	Terraform Resource Family
Compute	Elastic Compute Service (ECS), Bare Metal Server	huaweicloudcompute*
Storage	Elastic Volume Service (EVS), Object Storage Service (OBS)	huaweicloudevss* , huaweicloudobs*
Networking	Virtual Private Cloud (VPC), Elastic Load Balancing (ELB)	huaweicloudvpc* , huaweicloudlb*
Databases	Relational Database Service (RDS), NoSQL Database Service (GaussDB)	huaweicloudrds* , huaweicloudgaussdb*
Security	Web Application Firewall (WAF), Cloud Trace Service (CTS)	huaweicloudwaf* , huaweicloudcts*

Installing Terraform for Huawei Cloud

Before using Terraform to manage CCI resources, you need to obtain the access key (AK) and secret key (SK) and configure them on Terraform for authentication.

Install Terraform:

Download and install Terraform from the official website. Follow the instructions for your operating system.
Unzip terraform1.xx.x
chmod +x ./terraform
mv ./terraform $PATH
$PATH indicates the specified directory (for example, /usr/local/bin). Replace it with the actual directory.

Run the following command in the command-line interface (CLI) to check whether the directory is correctly configured:

terraform -version

If the following information is displayed, the configuration is correct and the Terraform can run normally.

Provider Configuration

Terraform supports a wide range of cloud providers, including Huawei Cloud. To use Terraform with Huawei Cloud, you'll need to configure the Huawei Cloud provider plugin.

Install Terraform: If you haven't already, download and install Terraform from the official website. Follow the instructions for your operating system.

Configure the Huawei Cloud provider: Create a new Terraform configuration file (e.g., main.tf) and add the following provider block:

provider "huaweicloud" { access_key = "your_access_key" secret_key = "your_secret_key" region = "your_region" }

Replace "youraccesskey", "yoursecretkey", and "your_region" with your actual Huawei Cloud credentials and the desired region or using the profile default in this case.

A complete provider and required_providers block is used for a VPC example:

terraform { required_providers { huaweicloud = { source = "huaweicloud/huaweicloud" version = ">= 1.36.0" } } } provider "huaweicloud" { region = "ap-southeast-1" shared_config_file = "/Users/$NAME/.hcloud/config.json" profile = "demo" }

For Huawei Cloud Stack On-Premises scenarios, the provider block includes additional parameters:

terraform { required_providers { huaweicloud = { source = "huaweicloud/huaweicloud" version = ">= 1.36.0" } } } provider "huaweicloud" { region = "{region}" access_key = "{AK}" secret_key = "{SK}" cloud = "{domain}" auth_url="https://iam-pub.{region}.{domain}" insecure = true }

Parameter definitions:

region: HCSO region where the resources will be created
AK: access Key created in item 2.0 of this document
SK: secret Key created in item 2.0 of this document
domain: HCSO console domain
insecure: optional parameter, only required in case of errors arising from HCSO certificates

The official registry of the Huawei Cloud Terraform provider, compatible with both the Huawei Cloud public cloud and HCSO implementations.

Authentication Methods

You can configure Terraform using static credentials or environment variables.

Static credentials are simple to use. However, they require AKs and SKs to be stored in plaintext in configuration files, which may lead to secret leakage. Therefore, environment variables are recommended.

Static credentials example:

provider "huaweicloud" { region = "cn-north-4" access_key = "my-access-key" secret_key = "my-secret-key" }

region: region where the resources are to be created and managed. You can query Huawei Cloud regions.
accesskey: access secret ID (AK). For details, see Access Keys.
secretkey: access secret key (SK). For details, see Access Keys.

Environment variables example:

export HW_REGION_NAME="cn-north-4" export HW_ACCESS_KEY="my-access-key" export HW_SECRET_KEY="my-secret-key"

HWREGIONNAME: region where the resources are to be created and managed

Authentication Method	Configuration Location	Risk Profile
Static credentials	provider block in .tf file	AK and SK stored in plaintext in configuration files
Environment variables	Shell environment	AK and SK not stored in configuration files

Compiling Scripts for Account Resources

Huawei Cloud has been registered with Terraform as a provider. You can add your accounts as the resources of the provider. For details, see https://registry.terraform.io/providers/huaweicloud/huaweicloud/latest/docs/resources/organizations_account.

The following is an example:

Create file main.tf on the server, copy the following script to this file, and save it.

terraform { required_providers { huaweicloud = { source = "huaweicloud/huaweicloud" version = ">= 1.40.0" } } } provider "huaweicloud" { access_key = "*******" secret_key = "*******" } resource "huaweicloud_organizations_account" "test"{ name = "account_test_name" }

Replace accesskey and secretkey with the keys generated in Access Keys.

Creating a Member Account by Running Terraform Commands

Go to the file path and run the terraform init command to initialize a working directory that contains the Terraform code.

Run the terraform apply command and enter yes in the Enter a value: row.

If the execution is complete, the member account is created.

Creating a Basic VPC with Terraform

To establish the foundation of your network infrastructure on Huawei Cloud, we'll start by creating a Virtual Private Cloud (VPC) using Terraform.

Define the VPC: Begin by specifying the VPC configuration in your Terraform code

Use the following resource block in your vpc.tf and provider.tf files:

vpc.tf resource "huaweicloud_vpc" "vpc" { name = "vpc-web" cidr = "192.168.0.0/16" } resource "huaweicloud_vpc_subnet" "subnet1" { name = "subnet-web" cidr = "192.168.10.0/24" gateway_ip = "192.168.10.1" vpc_id = huaweicloud_vpc.vpc.id }

Initialize Terraform: Run the following command to initialize the Terraform working directory:

terraform init

This will download the necessary provider plugins and prepare your Terraform environment.

Apply the Terraform configuration: Once the initialization is complete, you can create the VPC by running:

terraform apply

Terraform will show you a preview of the resources it plans to create. Review the changes and type yes to confirm.

After the apply process is finished, Terraform will have created the VPC on Huawei Cloud according to your configuration.

A sample validation resource for HCSO:

resource "huaweicloud_vpc" "vpc-hcso" { name = "vpc-hcso" cidr = "10.0.0.0/8" }

This is just a basic example to get you started. Terraform provides a wide range of resources and features for managing complex cloud infrastructures on Huawei Cloud. You can explore the Huawei Cloud provider documentation to learn more about the available resources and how to configure them.

Lifecycle Management

Running terraform destroy

To prevent unexpected costs and clean up resources, use terraform destroy. This command removes all provisioned infrastructure, ensuring no lingering resources remain. Execute it in your project directory:

terraform destroy

Review the changes and type yes to confirm.

After the apply process is finished, Terraform will have created the VPC on Huawei Cloud according to your configuration.

Conclusion

Terraform on Huawei Cloud delivers a declarative, repeatable method for provisioning compute, storage, networking, database, and security services across public Huawei Cloud and Huawei Cloud Stack On-Premises deployments. Provider configuration starts with requiredproviders declaration for huaweicloud/huaweicloud and a provider block that specifies region, accesskey, and secretkey. For HCSO environments, additional parameters such as cloud, authurl, and insecure allow connection to private domains.

Authentication choices directly affect secret handling. Static credentials embed AK and SK in configuration files and are simple to use but risk plaintext exposure. Environment variables for HWREGIONNAME, HWACCESSKEY, and HWSECRETKEY avoid storing secrets in code.

Resource definitions follow a consistent pattern. VPC creation uses huaweicloudvpc and huaweicloudvpcsubnet with name, cidr, gatewayip, and vpcid attributes. Organizations account management uses huaweicloudorganizations_account with name. Workflow remains initialize with terraform init, preview and apply with terraform apply, and clean removal with terraform destroy.

State management and change planning provided by Terraform enable efficient cloud infrastructure management. Configuration files make resource management consistent and repeatable. The integration provides a flexible and automated way to manage resources on Huawei Cloud across the full service portfolio from Elastic Compute Service and Elastic Volume Service to Virtual Private Cloud, Relational Database Service, and security services.