腾讯云/华为云安全深度对比：从 API 治理到容器防护的 20 个差异点

一、为什么要对比腾讯云 vs 华为云

企业上云时经常面临选择：腾讯云还是华为云？或者多云并用？两者的安全模型结构相似但细节差异很大，用 AWS/阿里云的经验套过来容易踩坑。

1.1 架构对比概览

┌─────────────────┬────────────────────────┬────────────────────────┐
│ 维度            │ 腾讯云 (Tencent Cloud) │ 华为云 (Huawei Cloud)  │
├─────────────────┼────────────────────────┼────────────────────────┤
│ 身份管理        │ CAM (Cloud Access Mgr)  │ IAM (Identity and Access)│
│ K8s 服务        │ TKE (Tencent K8s Engine)│ CCE (Cloud Container Engine)│
│ 密钥管理        │ KMS + SecretId/SecretKey│ KMS + AccessKey/SecretKey│
│ 审计日志        │ CLS + CloudAudit       │ LTS + CTS (Cloud Trace Service)│
│ 网络隔离        │ VPC + 安全组 + NAT     │ VPC + 安全组 + EIP     │
│ 安全态势        │ 云镜 (Cloud Mirror)    │ 态势感知 (SecMaster)    │
└─────────────────┴────────────────────────┴────────────────────────┘

二、身份管理深度对比：CAM vs IAM

2.1 核心概念差异

2.2 PoC：腾讯云 CAM 权限提升

腾讯云 CAM 的策略格式和 AWS 几乎一样，但缺少 Permission Boundary 意味着过宽的 TrustPolicy 更致命。

#!/usr/bin/env python3
"""
腾讯云 CAM 权限提升 PoC
前置: 攻击者拿到了子账号 SecretId/SecretKey 且有 cam:PassRole
"""
from tencentcloud.common import credential
from tencentcloud.cam.v20190116 import cam_client, models

def list_vulnerable_roles():
    cred = credential.Credential("AKIDxxxxxxxx", "xxxxxxxxxxxxx")
    client = cam_client.CamClient(cred, "ap-guangzhou")

    # 列出所有 Role
    req = models.ListRolesRequest()
    resp = client.ListRoles(req)
    for role in resp.RoleList:
        print(f"Role: {role.RoleName}, Arn: {role.RoleId}")
        # TrustPolicy
        policy = json.loads(role.PolicyDocument)
        principal = policy.get("statement", [{}])[0].get("principal", {})
        if principal == "*" or (isinstance(principal, dict) and principal.get("qcs") == "*"):
            print(f"  🔴 TrustPolicy=*！可以直接 AssumeRole")

# 腾讯云 AssumeRole 到高权限 Role
def escalate():
    from tencentcloud.sts.v20180813 import sts_client, models as sts_models
    cred = credential.Credential("AKIDxxxxxxxx", "xxxxxxxxxxxxx")
    sts = sts_client.StsClient(cred, "ap-guangzhou")

    req = sts_models.AssumeRoleRequest()
    req.RoleArn = "qcs::cam::uin/1234567890:roleName/admin-role"
    req.RoleSessionName = "attacker-session"
    req.DurationSeconds = 3600

    resp = sts.AssumeRole(req)
    print(f"[+] 拿到临时凭证: {resp.Credentials}")
    # SecretId: resp.Credentials.TmpSecretId
    # SecretKey: resp.Credentials.TmpSecretKey
    # Token: resp.Credentials.Token

2.3 PoC：华为云 IAM 权限提升

#!/usr/bin/env python3
"""
华为云 IAM 权限提升 PoC - 演示 SCP 和 Permission Boundary 的优势
"""
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkiam.v3 import IamClient, ListRolesRequest

def audit_huawei_iam():
    credentials = BasicCredentials(
        ak="AKIA6Q...",
        sk="xxxxxxxx",
        project_id="0469dc0d..."
    )
    client = IamClient.new_builder().with_credentials(credentials).with_endpoint("https://iam.myhuaweicloud.com").build()

    # 1. 枚举 Role
    roles = client.list_roles(ListRolesRequest()).to_dict()["roles"]
    for role in roles:
        trust = role.get("assume_role_policy_document", "")
        if '"Effect":"Allow"' in trust and '"Principal":"*"' in trust:
            print(f"🔴 Role {role['name']}: TrustPolicy=*")

    # 2. 华为云独有的: 检查 Permission Boundary
    # 华为云 2024 年开始支持 Permission Boundary
    # 如果 Role 有 Boundary，即使 TrustPolicy 被攻破，权限也会被 Boundary 卡死

2.4 多云统一 IAM 策略模板

// unified-minimal-role.json - 同时适配腾讯云 CAM 和 华为云 IAM
// 腾讯云用 qcs 作为资源标识符前缀
// 华为云用 urn 或 *cloud.cn 作为前缀
{
  "version": "2.0",
  "statement": [
    {
      "effect": "allow",
      "action": [
        // 腾讯云格式
        "cos:GetObject",
        "cos:PutObject",
        // 华为云格式（同时写，两边都只认识自己的）
        "obs:GetObject",
        "obs:PutObject"
      ],
      "resource": [
        // 腾讯云: qcs::cos::ap-guangzhou::bucket-1234567890/path/*
        "qcs::cos:ap-guangzhou:*:bucket-1234567890/path/*",
        // 华为云: obs bucket
        "urn:obs:*:*:bucket-myproject/data/*",
        "*",
        "obs:*:*:bucket-myproject/data/*"
      ],
      "condition": {
        "ip_equal": {
          "qcs:ip": ["203.0.113.0/24"]
        }
      }
    }
  ]
}

三、容器安全对比：TKE vs CCE

3.1 K8s 服务特性

3.2 关键差异：谁能访问 kubeconfig？

# 腾讯云: CAM 里有个特殊权限 "tke:DescribeClusterCredential"
# 拿到这个权限就能直接调 API 拿到 kubeconfig
tccli tke DescribeClusterCredential --cluster-id c-123456789

# 华为云: IAM 里权限名是 "cce:ListClusterCredentials"
huawei cloud CCE ListClusterCredentials --cluster-id cce-xxx

# 两边都需要: 定期审计谁有这个权限

3.3 容器运行时安全差异

# 腾讯云 TKE: 支持安全加固选项
# 在节点池级别开启
apiVersion: nodepool.tke.cloud.tencent.com/v1
kind: NodePool
metadata:
  name: secure-np
spec:
  security:
    allowPrivileged: false        # 禁止特权容器
    allowHostNetwork: false      # 禁止 HostNetwork
    allowHostDir: false          # 禁止 HostDir 挂载
    hostPID: false
    hostIPC: false
    seccompProfile: RuntimeDefault
---
# 华为云 CCE: 通过 PodSecurityPolicy + CCE Addon 配置
apiVersion: cce.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: restricted-policy
spec:
  rules:
    privilegeContainer: false
    hostNetwork: false
    hostPath: false
    hostPID: false

四、密钥管理对比

4.1 攻击场景：KMS Key 策略太宽

# 腾讯云: 检查所有 KMS Key 的策略
tccli kms ListKeys --region ap-guangzhou | jq '.KeyMetadataList[].KeyId' | while read kid; do
  policy=$(tccli kms GetKeyPolicy --key-id $kid --region ap-guangzhou --output json | jq '.Policy')
  if echo $policy | grep -q "Principal.*\*"; then
    echo "🔴 KMS Key $kid Policy = *, 任何人都能 Decrypt！"
  fi
done

# 华为云: 类似
huawei cloud kms listkeys | jq '.keys[].key_id' | while read kid; do
  policy=$(huawei cloud kms listkeypolicies --key_id $kid | jq .)
  ...
done

五、审计日志差异

5.1 关键：审计日志的"谁看了什么"

# 腾讯云: 找出谁最近调用了 IAM 敏感 API
tccli clisearch SearchLog   --topic-id your-log-topic-id   --region ap-guangzhou   --query "eventName:CreateAccessKey OR eventName:AssumeRole"   --from 24h   --output json | jq '.results[] | {eventName, operator: .user.userName, time}'

# 华为云 CTS 类似
huawei cloud cts listtraces   --resource-type "iam"   --trace-type "activity"   --time_range begin="$(date -d '24 hours ago' +%s)" end="$(date +%s)"

六、攻防对抗场景对比

6.1 场景 1：拿到子账号凭证后，横向移动到 K8s Secret

腾讯云路径：

子账号 SecretId/SecretKey → 
  tccli tke DescribeClusterCredential → 
  拿到 kubeconfig → 
  kubectl get secrets -A

华为云路径：

子账号 AK/SK → 
  huawei cloud CCE ListClusterCredentials → 
  拿到 kubeconfig → 
  kubectl get secrets -A

防御：两端都需要最小权限原则 + 审计谁调用了 DescribeClusterCredential

6.2 场景 2：OSS/COS Bucket 公开泄露

# 腾讯云: 批量检查 COS Bucket ACL
tccli cos ListBuckets --region ap-guangzhou | jq '.Buckets[].Name' | while read bucket; do
  acl=$(tccli cos GetBucketAcl --bucket $bucket --region ap-guangzhou --output json)
  if echo $acl | grep -q "Grantee.*\*"; then
    echo "🔴 COS Bucket $bucket 公开访问！"
    tccli cos PutBucketAcl --bucket $bucket --region ap-guangzhou --acl private
  fi
done

# 华为云 OBS
huawei cloud obs listbucket | jq '.buckets[].name' | while read bucket; do
  acl=$(huawei cloud obs getbucketacl --bucket $bucket)
  ...
done

七、多云统一安全治理方案

7.1 Terraform 统一检测脚本

# multi-cloud-security-audit.tf
variable "providers" {
  default = {
    tencent = {
      secret_id  = "YOUR_SECRET_ID"
      secret_key = "YOUR_SECRET_KEY"
      region     = "ap-guangzhou"
    }
    huawei = {
      ak   = "YOUR_AK"
      sk   = "YOUR_SK"
      region = "cn-north-4"
    }
  }
}

# 腾讯云安全组扫描
data "tencentcloud_security_group" "tencent_all" {
  count     = 1
  # Terraform 没有原生 scan，建议用脚本
}

# 更实用: 用 Python 写一个统一审计脚本

#!/usr/bin/env python3
"""
多云安全审计统一入口
支持: 腾讯云 / 华为云 / AWS / 阿里云
"""
import json, subprocess, sys

def run(cmd):
    return subprocess.run(cmd, capture_output=True, text=True, shell=True)

class BaseAuditor:
    def audit(self):
        raise NotImplementedError

class TencentCloudAuditor(BaseAuditor):
    def audit(self):
        print("[腾讯云] 审计中...")
        # 1. CAM 权限
        result = run("tccli cam ListRoles --region ap-guangzhou --output json")
        roles = json.loads(result.stdout).get("RoleList", [])
        for role in roles:
            policy = json.loads(role.get("PolicyDocument", "{}"))
            principal = policy.get("statement", [{}])[0].get("principal", {})
            if principal == "*":
                print(f"  🔴 Role {role['RoleName']} TrustPolicy=*")

        # 2. COS Bucket
        result = run("tccli cos ListBuckets --region ap-guangzhou --output json")
        buckets = json.loads(result.stdout).get("Buckets", [])
        for b in buckets:
            acl_result = run(f"tccli cos GetBucketAcl --bucket {b['Name']} --region ap-guangzhou --output json")
            # 检查 ACL 是否有 *

        # 3. TKE
        result = run("tccli tke DescribeClusters --region ap-guangzhou --output json")
        clusters = json.loads(result.stdout).get("ClusterSet", [])
        print(f"  集群数: {len(clusters)}")

class HuaweiCloudAuditor(BaseAuditor):
    def audit(self):
        print("[华为云] 审计中...")
        # 1. IAM
        result = run("huawei cloud iam listroles")
        # 类似检查 TrustPolicy

        # 2. OBS
        result = run("huawei cloud obs listbucket")

        # 3. CCE
        result = run("huawei cloud CCE listclusters")

if __name__ == "__main__":
    cloud = sys.argv[1] if len(sys.argv) > 1 else "all"
    if cloud in ("tencent", "all"): TencentCloudAuditor().audit()
    if cloud in ("huawei", "all"): HuaweiCloudAuditor().audit()

八、总结：多云安全 Checklist

核心结论：腾讯云和华为云的安全模型差异远小于相似点。真正的差距在于成熟度——华为云 Permission Boundary、SCP 组织控制这些 AWS 级别的功能比腾讯云更完善，但腾讯云在攻防对抗（云镜 + 安全运营）上有更丰富的国内实战经验。多云场景下，用 Terraform + Python 脚本做统一审计是成本最低的方案。