Huawei Cloud Foundations

01 What a landing zone is for

A landing zone is the boring layer everything else sits on: accounts, identity, network, logging, budgets, and the guardrails that stop one team's experiment becoming everyone's incident. Get it wrong and you spend the next three years working around it.

Most of the Huawei estates we inherit were set up by one engineer in a hurry, in one account, with one root credential and no tagging. That is survivable at ten instances. It is not survivable once GPU nodes, model weights and trace data are involved, because now the mistakes are expensive and auditable.

TYPICAL ENGAGEMENT

2–3 weeks

Delivered as Terraform in your repository, with a written handover. We do not hold the state file and there is nothing to migrate off later.

Book a call

02 What we deliver

Accounts

Multi-account structure with resource organisation, consolidated billing, and separation between production, staging and the place people experiment.

Identity

SSO or federated identity, least-privilege roles, no shared credentials, and a break-glass path that is documented rather than improvised.

Network

VPC design, subnetting, security groups, private endpoints, egress control — including the private path from your application tier to inference so prompts never traverse the public internet.

Observability

Centralised logging and metrics with retention that matches your policy rather than the provider's default, plus alerting that pages a person.

Cost control

Tagging standard, budgets, anomaly alerts, and a chargeback model — which is what makes GPU spend legible later.

Compliance

Encryption at rest and in transit, key management, audit logging, and the region and residency choices written down with the reason attached.

GPU readiness

Quota requests raised early, instance families validated as actually available in your region, and node groups ready for Ascend 910B (ModelArts)-class capacity.

As code

Terraform modules in your repository, a CI pipeline that plans on pull requests, and a README written for whoever joins next year.

03 Then what

The foundation is not the point

It is the thing that has to exist before the interesting work does. Once the Huawei landing zone is in place, the AI stack goes on top of it — model serving, the gateway, the trace store — and inherits the identity, network and cost model you just built rather than routing around them.

AI Infrastructure Setup AI on Huawei

terraform plan

# the landing zone, then the stack that sits on it
module.org              3 accounts, scp guardrails
module.identity         sso, 6 roles, no static keys
module.network          vpc, private egress, endpoints
module.observability    logs 400d, budget alarms
module.capacity         quota pending — raised day 1
module.workloads        (next engagement)

Fig. — What you are left holding. It is yours, in your repo.

Huawei Cloud Foundations

2–3 weeks

The foundation is not the point

See what your AI actually costs.