Docs / Clouds
Huawei Cloud
Connect a Huawei Cloud account with an OIDC identity provider and an account-scoped trust agency.
Pangea reaches Huawei Cloud through OIDC federation. You register Pangea as an IAM identity provider and create a trust agency for it. Pangea mints a short-lived token for your team and calls STS AssumeAgencyWithOIDC. No long-lived access key is needed.
Pangea stores the account ID, the identity provider name and the trust agency name.
Connect
Open Connectors → Connect → Huawei Cloud as an Administrator. If the hcloud CLI is installed on your Mac, the dialog also offers a guided setup where the agent runs it for you.
1. Create the identity provider
In the Huawei Cloud console, open IAM → Create Identity Provider:
| Field | Value |
|---|---|
| Type | OIDC |
| Name | Any name you will recognize, for example pangea |
| Identity provider URL | https://api.pangea.build |
| Audience | iam.myhuaweicloud.com |
Save. Huawei Cloud fetches the signing keys from the identity provider URL itself, so there is nothing to upload.
Note two values for the last step:
- The provider's name, as you typed it. This is not the separate hexadecimal ID Huawei also shows.
- Your Account ID (32 hex characters), from My Credentials.
2. Create the trust agency
Open IAM → Create Trust Agency:
- Set Agency Type to Identity Provider and Identity Provider Type to OIDC, then pick the provider from step 1.
- Set Audience to
iam.myhuaweicloud.com. - Grant only the permissions the work needs. Read-only is enough for browsing. Scope them to All resources: Pangea requests an account-scoped credential, which a project-only agency cannot supply.
- Under Condition, click Add and add
oidc:sub/ StringEquals equal to your team's subject. Copy the subject from the dialog in Pangea. Keep theoidc:isscondition that is already there.
The oidc:sub condition is required. Pangea's identity provider is shared by every customer, so without it anyone who registers the same audience could assume this agency. Pangea checks the agency's trust policy when you connect and refuses an agency that is not pinned to your team's subject alone. Keep the condition when you later narrow the agency's permissions.
Note the agency's name. The agency is exactly what Pangea can do in your account.
3. Save and verify
Enter in Pangea:
| Field | Notes |
|---|---|
| Label | A friendly name, for example "Acme Huawei Cloud" |
| Account ID | The 32-character ID from My Credentials |
| Identity provider name | The name from step 1, not the hex ID |
| Trust agency name | The name from step 2 |
After connecting, check a bounded account or region read before broader work.
In the Pangea app
CCE clusters and ECS instances have resource pages. CCE clusters appear in the shared cluster browser. The agent's API access can cover other resources within the agency's policy. In-cluster RBAC is a separate requirement.
Permissions and authorization
Team Administrators connect and remove this binding and can restrict it with a member allow-list. The agency's policy stays the outer limit, whatever the prompt or permission mode. Individual actions follow Auto Mode and Full Access, and significant cloud work uses plans.
Troubleshoot and retire
If federation fails, check the identity provider URL, the audience, the team subject, the agency name and the agency's All resources scope.
To end access, remove the connection in Pangea, then delete the trust agency (and the identity provider, if nothing else uses it) in Huawei Cloud.