Huawei Cloud DNS
Huawei Cloud signing key setup: create an IAM user and AK/SK pair, then grant every DNS read or write action that DNSMigrator actually calls.
On this page
Huawei Cloud signing key permissions
- Credential type
- IAM access key
- Preview access
- DNS ReadOnlyAccess
- Apply access
- The 10 actions in the DNSMigrator DNS custom policy
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "HUAWEICLOUD"
}Create credentials
Create an IAM user and AK/SK pair, then grant every DNS read or write action that DNSMigrator actually calls.
Access you'll grant
DNS ReadOnlyAccess
The 10 actions in the DNSMigrator DNS custom policy
DNS FullAccess is the broader system-policy alternative. The custom policy includes zone and record-set access plus the name-server and DNSSEC operations used during apply and cutover preparation.Before you start
- A Huawei Cloud account with public DNS zones.
- An IAM administrator who can manage users, user groups, and policies.
Setup steps
0 of 6 done
Create a dedicated IAM user group
In Identity and Access Management, create a user group for DNSMigrator, then create a dedicated IAM user and add it to that group. New IAM users have no permissions until a policy is attached to their group.
Choose preview or apply access
For preview only, attach the system policy
DNS ReadOnlyAccessto the group. For apply, open Permissions → Policies/Roles → Create Custom Policy, enter a name, set Policy View to JSON, and paste the policy below.DNS FullAccessalso works but grants more DNS operations.Preview system policyDNS ReadOnlyAccessApply custom policy{ "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "dns:zone:list", "dns:zone:create", "dns:recordset:list", "dns:recordset:create", "dns:recordset:update", "dns:recordset:delete", "dns:nameserver:getZoneNameServer", "dns:zone:getDnssecConfig", "dns:zone:enableDnssecConfig", "dns:zone:disableDnssecConfig" ] } ] }Broader apply alternativeDNS FullAccessAttach the policy to the group
Finish the custom policy with OK, then authorize the DNSMigrator user group with that policy. The dedicated user inherits the group's DNS permissions.
Create and download the access key
Open Users, select the dedicated user, then Security Settings → Access Keys → Create Access Key. Complete the verification, select OK, and download the key file immediately; Huawei Cloud does not show the SK again after the dialog closes.
Choose the API region
Public zones are global, but requests still use a regional DNS endpoint. Use the region where DNS API Explorer can run ListPublicZones;
ap-southeast-1is the connection default for the international site.International defaultap-southeast-1Paste the AK and SK
Paste the downloaded AK into Access key ID (AK) and the matching SK into Secret access key (SK). Enter API region only if your working endpoint differs from
ap-southeast-1.
Troubleshooting
APIGW.0301 or APIGW.0101
Huawei Cloud rejected the AK/SK signature. Use both values from the same active IAM-user access key and check the API region.
Preview works but nameservers, DNSSEC, or apply is forbidden
Use the complete custom policy. In addition to zone and record-set actions, DNSMigrator calls the name-server and get/enable/disable DNSSEC operations listed in it.
APIGW.0302 or APIGW.0303
A source-IP access rule is blocking the request. Allow our egress IP rather than your workstation's address.
No public zones appear
Confirm the user is in the authorized group, the zones are public rather than private, and the selected endpoint region accepts ListPublicZones.
Official documentation
- Manage IAM user access keys
- Create a custom IAM policy
- Huawei Cloud DNS API
- Huawei DNS permissions and supported actions
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| Access key ID (AK)accessKey | Required | The AK in the access-key file downloaded when the IAM user's key was created. |
| Secret access key (SK)secretKey | Required | The matching SK from the same downloaded file. If the file was not saved, delete the key and create another one. |
| API regionregion | Optional | The region identifier for the DNS API endpoint, such as ap-southeast-1. Leave empty to use ap-southeast-1. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Managed through the API
- Minimum TTL
- Automatic
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
Caveats
- Only public zones are migrated; private zones and alias records pointing at Huawei Cloud resources are skipped.
- Record sets on ISP or regional resolution lines are kept separately; weighted duplicates on the default line are merged into one record set.
- Changes are accepted asynchronously and can show as pending for a few seconds.
Troubleshooting
- APIGW.0301 or APIGW.0101
- Huawei Cloud rejected the AK/SK signature. Use both values from the same active IAM-user access key and check the API region.
- Preview works but nameservers, DNSSEC, or apply is forbidden
- Use the complete custom policy. In addition to zone and record-set actions, DNSMigrator calls the name-server and get/enable/disable DNSSEC operations listed in it.
- APIGW.0302 or APIGW.0303
- A source-IP access rule is blocking the request. Allow `{egressIp}` rather than your workstation's address.
- No public zones appear
- Confirm the user is in the authorized group, the zones are public rather than private, and the selected endpoint region accepts ListPublicZones.