Huawei Cloud ECS Passwordless Login

Overview

Configure passwordless SSH login to Huawei Cloud ECS using COC (Cloud Operations Center) with a 7-step automated workflow:

1. IAM Authorization — Create the ServiceAgencyForCOC agency for COC service and bind 4 required roles; skip entirely if agency already exists (HTTP 409)
2. Key Generation — Generate a local Ed25519 SSH key pair
3. Script Creation — Create or reuse a parameterized COC script that deploys the public key
4. Script Execution — Execute the script on one or many target ECS instances via COC (batch; each target's region and resource_id are resolved via the COC CLI ListResources)
5. SSH Test — Verify passwordless SSH connection to every target ECS
6. Persistent Connection — Establish SSH ControlMaster so the agent can continue SSH access after keys are cleaned up
7. Security Cleanup — After 60 seconds, automatically remove keys from remote authorized_keys, delete the local key pair, and clean up the COC script

Tool chain: hcloud CLI (KooCLI) + local SSH tools. Deployment is handled through COC script execution only.

Region model: COC is a global-level service supporting only cn-north-4 (China site) and ap-southeast-3 (International site). Target ECS instances may live in different regions (batch). Use coc_region for all COC/IAM API calls and for target resolution via COC ListResources — target resolution never needs the ECS region in advance; each target's actual region is returned by the ListResources response. See Notes for details.

Prerequisites