The editor requires Version 1.1. What about 5.0?

Use the complete 1.1 JSON with bss:balance:view. Do not change only the version while retaining billing:balance:view. Never replace it with Action=* or an administrator policy.

My editor creates identity policies with Version 5.0.

That model uses billing:balance:view attached as an identity policy. This guide’s JSON and group steps target Roles and Policies version 1.1. Use that entry point. Existing working 5.0 authorization need not be changed.

How do I fix 403 or CBC.0151?

Check dedicated-group membership, the group’s policy, and All Resources scope. Verify Domain ID, organization restrictions, and explicit denies. Retry after authorization takes effect; report only redacted codes and times.

Which account ID is needed?

Copy My Credentials → Account ID / Domain ID, a 32-character hexadecimal value. Similar-looking IAM user or project IDs are wrong. No extra IAM listing permission is needed; accounts are not enumerated.

What if SK is lost or credentials are rejected?

Have an administrator create a matching replacement under the dedicated user. Verify Domain ID, active status, and China site, then update securely. Do not use model keys, STS, or disable unrelated keys.

What does CBC.99000049 mean?

A reseller sub-customer may lack an independent balance. Confirm the settlement relationship with the payer. Do not substitute credit, budget, null, or zero, or submit another account’s credentials without authorization.

Why does this differ from total available funds or Pangu quota?

Only the balance account amount is primary. Other categories stay separate; dedicated-use amounts are subsets and debt is not deducted again. Verify packs, vouchers, and model permissions separately. International accounts are excluded.

Huawei Cloud Balance, IAM Policy, and Domain ID Setup

Live test reported

Guide updated 2026-10-05

A user reported a successful Huawei Cloud China-site test on October 5, 2026, with the balance visible. Exact amounts, effective IAM policies, and MCP reconciliation were not independently recorded. This does not verify the international site.

Required credentials: IAM Access Key ID + Secret Access Key + Domain ID
Monitoring currency: CNY · Chinese yuan
What is monitored: Cloud balance account amount; Official amount for account_type=1. Credit, bonus, and deposit accounts are not added, and debt_amount is not subtracted again. designated_amount is a restricted part of its account, not extra funds. The shared cloud account is not a Pangu, ModelArts, or project wallet.

Connect Huawei Cloud / Pangu (China) to Quota Monitor

Confirm the China payer and administrator
Open Billing and Cost Management for the CNY account paying for Pangu or other services. An administrator creates a dedicated IAM user within this account without submitting their own credentials.
Open official Huawei Cloud / Pangu (China) page(opens in a new tab)
Copy the account Domain ID
Open the username menu → My Credentials → Account ID. Copy the 32-character hexadecimal Domain ID, not an IAM user, project, or enterprise project ID. It must match the AK/SK account and will be encrypted with them. No console login is needed for the monitoring user.
Open official Huawei Cloud / Pangu (China) page(opens in a new tab)
03
Create a version 1.1 custom policy
In IAM Permissions / Roles and Policies, choose Create Custom Policy, not Create Custom Identity Policy. Name it QuotaMonitorBalanceReadOnly, select JSON view, and paste the complete example below. Use only bss:balance:view. Do not add bss:*, payments, withdrawals, or administrator access.
If the name already exists, inspect it or choose a new one without overwriting a business policy. Confirm Version 1.1 and the single action. A saved policy still needs attachment.
Huawei Cloud / Pangu (China) read-only policy JSON
```
{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bss:balance:view"
      ]
    }
  ]
}
```
Copies the complete JSON without keys or account details.
Open official Huawei Cloud / Pangu (China) page(opens in a new tab)
Authorize a dedicated user group
Create quota-monitor-balance-readers under User Groups. Authorize only QuotaMonitorBalanceReadOnly for All Resources. Legacy BSS billing permissions must cover all regions, not a single regional or enterprise project. All Resources scopes this one read action; it does not grant all actions.
Open official Huawei Cloud / Pangu (China) page(opens in a new tab)
Create a programmatic user in that group
Create quota-monitor with Programmatic Access and Access Key credentials only, without console access. Select the dedicated group and complete verification. Save keys immediately if offered. Do not use an admin group or template. Verify membership from both user and group, including policy scope and other effective permissions.
Open official Huawei Cloud / Pangu (China) page(opens in a new tab)
Obtain a matching AK/SK pair
Use the pair saved at user creation or have an administrator open this user’s Security Settings → Access Keys → Add Access Key. Do not create keys in the administrator’s own My Credentials page. Save the matching active pair; it is not a Pangu Bearer key.
Open official Huawei Cloud / Pangu (China) page(opens in a new tab)
Check all three credential fields
SK is available only at creation. If lost, coordinate a replacement without deleting other business keys; users have at most two pairs. Confirm the same China account Domain ID, AK, and SK without copied field names, quotes, or line breaks. No STS, region, or API URL is required.
Connect Huawei Cloud in your project
Choose Huawei Cloud / Pangu China. Enter Domain ID, AK, and SK in the three masked fields and save. All three are encrypted together; only the AK’s last four characters are shown. Use the same form for MCP setup, never MCP key arguments.
Compare the matching balance category
Refresh and compare Balance in the same account’s billing overview. Review credit, bonus, deposit, debt, and designated-use portions separately; do not add them to the main balance. Missing categories are not zero, and old snapshots are not new results. Use the official platform for top-ups.
Open official Huawei Cloud / Pangu (China) page(opens in a new tab)

What Quota Monitor reads from Huawei Cloud / Pangu (China)

China bss.myhuaweicloud.com only, validating CNY and yuan units. International billing and STS credentials are unsupported. No cross-site credential attempts.
The main balance is not withdrawable cash or guaranteed model funding. Packs, free tokens, voucher lists, and subscription quotas are excluded. Zero alone does not imply service interruption.
Snapshots may lag settlement. Missing account categories remain missing. Reseller sub-customers without independent balances are not replaced with other funds or budgets.
Use Roles and Policies → Create Custom Policy: Version 1.1 with bss:balance:view. New identity policies use Version 5.0 with billing:balance:view, a different model. Do not mix versions and actions. Groups, other policies, and organizational limits affect effective access.
The dashboard shows the latest successful snapshot. Manual refresh queries the provider again but cannot eliminate upstream billing delays. An old balance is not a new result after a failed query.

Huawei Cloud / Pangu (China) FAQ and troubleshooting

The editor requires Version 1.1. What about 5.0?: Use the complete 1.1 JSON with bss:balance:view. Do not change only the version while retaining billing:balance:view. Never replace it with Action=* or an administrator policy.
My editor creates identity policies with Version 5.0.: That model uses billing:balance:view attached as an identity policy. This guide’s JSON and group steps target Roles and Policies version 1.1. Use that entry point. Existing working 5.0 authorization need not be changed.
How do I fix 403 or CBC.0151?: Check dedicated-group membership, the group’s policy, and All Resources scope. Verify Domain ID, organization restrictions, and explicit denies. Retry after authorization takes effect; report only redacted codes and times.
Which account ID is needed?: Copy My Credentials → Account ID / Domain ID, a 32-character hexadecimal value. Similar-looking IAM user or project IDs are wrong. No extra IAM listing permission is needed; accounts are not enumerated.
What if SK is lost or credentials are rejected?: Have an administrator create a matching replacement under the dedicated user. Verify Domain ID, active status, and China site, then update securely. Do not use model keys, STS, or disable unrelated keys.
What does CBC.99000049 mean?: A reseller sub-customer may lack an independent balance. Confirm the settlement relationship with the payer. Do not substitute credit, budget, null, or zero, or submit another account’s credentials without authorization.
Why does this differ from total available funds or Pangu quota?: Only the balance account amount is primary. Other categories stay separate; dedicated-use amounts are subsets and debt is not deducted again. Verify packs, vouchers, and model permissions separately. International accounts are excluded.

Official Huawei Cloud / Pangu (China) references

Prepared by Quota Monitor, not an official provider tutorial. Interfaces and permissions may change; check official pages. Verification is limited to the scope stated here.