Skill: sdk-team/alibabacloud-ddos-security-monitor (version 0.0.1)

--- name: alibabacloud-ddos-security-monitor description: | [user] Perform security inspection and monitoring for Alibaba Cloud DDoS security products, covering DDoS Basic Protection, DDoS Native Protection, and DDoS Anti-DDoS Pro/Premium. Supports querying blackhole/scrubbing events, QPS spikes/drops, L4 traffic anomalies, HTTP status code (4xx/5xx) period-over-period surges, origin status code anomalies, and instance asset inventory. Use this Skill when users need security inspection, DDoS protection status checks, attack event queries, traffic anomaly investigation, or to confirm whether DDoS security products are provisioned. Triggers: "DDoS inspection", "security check", "DDoS protection check", "attack event query", "traffic anomaly" --- # DDoS Security Product Inspection & Monitoring This skill performs security inspection on DDoS security products under an Alibaba Cloud account, entirely through Aliyun CLI direct OpenAPI calls without any scripts or SDKs. **Architecture**: `antiddos-public (Basic Protection) + ddosbgp (Native Protection) + ddoscoo (Anti-DDoS Pro/Premium) -> CLI OpenAPI -> Inspection Report` ## Product & API Overview | Product | CLI Code | Use Case | |---------|----------|----------| | DDoS Basic Protection | `antiddos-public` | Default free protection for ECS/SLB, Region param: `--ddos-region-id` | | DDoS Native Protection | `ddosbgp` | Paid upgrade, native IP-level protection, Region param: `--biz-region-id` or `--region` | | DDoS Anti-DDoS Pro/Premium | `ddoscoo` | Dedicated Anti-DDoS IP, L4/L7 protection, Region param: `--region` | > **[MUST] Strict product routing isolation**: APIs of the three products MUST NEVER be mixed. NEVER substitute `ddoscoo` APIs for `ddosbgp` queries or vice versa. If mixing is detected, abort immediately. > > **[MUST] ddosbgp endpoint routing**: `ddosbgp describe-instance-list` default endpoint does NOT support mainland China Regions. You MUST specify `--endpoint ddosbgp.cn-hangzhou.aliyuncs.com` for ALL `describe-instance-list` calls. > > **[MUST] Easily confused API warning**: > > | Scenario | Correct Command | Wrong Command (FORBIDDEN) | > |----------|----------------|--------------------------| > | **Native Protection** attack events | `ddosbgp describe-ddos-event` (singular) | ~~`ddoscoo describe-ddos-events`~~ | > | **Anti-DDoS Pro** attack events | `ddoscoo describe-ddos-events` (plural) | ~~`ddosbgp describe-ddos-event`~~ | ## Pre-checks > **Aliyun CLI >= 3.3.3 required** — see [CLI Installation Guide](references/cli-installation-guide.md). > **Credentials required** — see [CLI Credential Setup](references/cli-setup.md). Run `aliyun configure list` to verify. > **RAM permissions** — see [RAM Permission Policies](references/ram-policies.md). > > **[MUST] Permission Failure Handling:** On permission errors: 1) Read `references/ram-policies.md` 2) Use `ram-permission-diagnose` skill 3) Pause until user confirms permissions granted. > > **[MUST] AI-Mode lifecycle** — Enable before any CLI invocation, disable at EVERY exit point: > ```bash > aliyun configure ai-mode enable > aliyun configure ai-mode set-user-agent --user-agent [REDACTED_SECRET] > ``` ## Parameter Confirmation > **IMPORTANT**: ALL user-customizable parameters MUST be confirmed with the user before execution. | Parameter | Required/Optional | Description | Default | |-----------|-------------------|-------------|---------| | Inspection product scope | Optional | Basic/Native/Anti-DDoS Pro, default all | All | | Time range | Optional | Inspection time window | Last 24 hours | | Comparison mode | Optional | Day-over-day / week-over-week / custom | Day-over-day | | Basic Protection instance-type | Optional | ecs/slb/eip/ipv6/swas/waf/ga_basic | ecs | ## Region Strategy > **[MUST] ddosbgp Region traversal (dynamic + hardcoded fallback)**: > - **Hardcoded baseline** (12 Regions, MUST NOT be reduced): `cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1` > - **Dynamic expansion**: Call `aliyun ddosbgp describe-regions` (NOT ECS), **union** with baseline (only add, never subtract). If dynamic fetch fails, use baseline directly. > - **Count validation**: Final list >= 12 Regions. ALL must be traversed, NEVER break due to empty/error. > > **antiddos-public**: Query from `cn-hangzhou` only (centralized). > **ddoscoo**: MUST query both `cn-hangzhou` + `ap-southeast-1`. ## Core Inspection Workflow ### Phase 1: Environment, Credential & Permission Pre-check ```bash # 1.1 Check CLI version + enable AI-Mode aliyun version aliyun configure ai-mode enable aliyun configure ai-mode set-user-agent --user-agent [REDACTED_SECRET] # 1.2 Set global timeout and enable auto plugin install aliyun configure set --auto-plugin-install true --connect-timeout 10 --read-timeout 30 aliyun plugin update # 1.3 Check credential configuration aliyun configure list # 1.4 Validate permissions (one call per product) aliyun antiddos-public describe-instance-ip-address \ --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 1 aliyun ddosbgp describe-instance-list --page-no 1 --page-size 1 --region cn-hangzhou --endpoint ddosbgp.cn-hangzhou.aliyuncs.com aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region cn-hangzhou aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region ap-southeast-1 ``` - Normal JSON -> permission OK | `Forbidden.RAM` / `NoPermission` -> see [RAM Policies](references/ram-policies.md) > **[MUST] Abort rule**: If any pre-check fails 3 consecutive times, run `aliyun configure ai-mode disable`, output error report, and terminate. ### Phase 2: Product Inventory Check (Multi-Region Mandatory Traversal) > **[MUST] Loop rules**: ALL Regions must be queried. On ANY error (InvalidRegionId/Empty/Throttling), log and `continue` — break/exit is FORBIDDEN. After loop, verify EXECUTED >= 12 (ddosbgp) or = 2 (ddoscoo). Log results immediately after each call — relying on memory is FORBIDDEN. > > **Empty result handling**: `Total: 0` → log "no instances", continue | Error code → log error, continue | Normal → extract instance IDs. > After traversal, compile **Region -> Instance ID list** mapping for Phase 4. ```bash # 2.1 Basic Protection assets aliyun antiddos-public describe-instance-ip-address \ --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 50 # 2.2 Native Protection - [MUST execute full loop in single bash] BASELINE="cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1" DYNAMIC=$(aliyun ddosbgp describe-regions 2>/dev/null | grep -o '"RegionId":"[^"]*"' | cut -d'"' -f4 | tr '\n' ' ') if [ -n "$DYNAMIC" ]; then ALL_REGIONS=$(echo "$BASELINE $DYNAMIC" | tr ' ' '\n' | sort -u | tr '\n' ' ') else ALL_REGIONS="$BASELINE" fi EXECUTED=0 for region in $ALL_REGIONS; do # [MANDATORY] NEVER break/return/exit - on ANY error, MUST continue echo "=== ddosbgp query $region ===" # [CRITICAL] Must specify --endpoint for mainland China Regions RESULT=$(aliyun ddosbgp describe-instance-list --page-no 1 --page-size 50 --region $region --endpoint ddosbgp.cn-hangzhou.aliyuncs.com 2>&1) echo "$RESULT" if echo "$RESULT" | grep -q "InvalidRegionId\|ErrorCode"; then echo "[WARN] $region returned error, logged and continuing" fi EXECUTED=$((EXECUTED+1)) continue done echo "=== Regions executed: $EXECUTED ===" # 2.3 Native Protection associated IPs (per discovered instance, uses --biz-region-id) aliyun ddosbgp describe-pack-ip-list \ --instance-id <instance-id> --page-no 1 --page-size 50 --biz-region-id <region-id> # 2.4 Anti-DDoS Pro instances [MUST query both Regions] aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region ap-southeast-1 # 2.5 Anti-DDoS Pro associated domains (per discovered instance) aliyun ddoscoo describe-domains --instance-ids <instance-id> --region <region-id> ``` > **[MUST] End validation**: 1) Region count: ddosbgp >= 12, ddoscoo = 2 2) Product isolation: no mixed API prefixes 3) Instance deduplication: Global instances (CoverageType=4) appear in every Region — deduplicate by InstanceId ### Phase 3: Confirm Comparison Period Ask user for comparison period, parse into second-precision Unix timestamps. **[MUST] Use bash `date` command — manual calculation FORBIDDEN:** ```bash BASE_END=$(date +%s) BASE_START=$((BASE_END - 86400)) COMPARE_END=$((BASE_START)) COMPARE_START=$((COMPARE_END - 86400)) # Week-over-week: offset 604800s | Hour-over-hour: offset 3600s echo "Base: $BASE_START ~ $BASE_END | Compare: $COMPARE_START ~ $COMPARE_END" ``` ### Phase 4: Execute Inspection & Generate Report > **[MUST] Sequential Execution Guard**: Execute API chains **strictly in order** for EACH instance. Do NOT stop at "planning" — every API MUST have an actual `aliyun` command executed with visible output. After each sub-step (4.1/4.2/4.3), print `echo "[Step 4.X Complete]"`. Proceeding to 4.4/4.5 without all calls completed is FORBIDDEN. > > **[MUST] Route by inventory**: No instances in ALL Regions → execute probe calls (`--instance-id dummy`) on cn-hangzhou to preserve trace, report "not provisioned". Some Regions have instances → inspect those, skip empty Regions. **NEVER** substitute product APIs. #### 4.1 Basic Protection Inspection ```bash # Has assets: real ID | No assets: probe call aliyun antiddos-public describe-ddos-event-list \ --ddos-region-id <region-id> --instance-type <type> --instance-id <id> \ --current-page 1 --page-size 50 # Probe: --instance-id dummy --ddos-region-id cn-hangzhou --instance-type ecs ``` > **[MANDATORY CHECKPOINT 4.1]** Confirm describe-ddos-event-list returned JSON or explicit error. If not executed, retry now. Do NOT proceed to 4.2 until confirmed. #### 4.2 Native Protection Inspection (ddosbgp APIs ONLY) > **[MUST]** `ddosbgp` APIs only. Attack events: `describe-ddos-event` (**singular**). L4 traffic: `describe-traffic` (MUST call). Region params: describe-ddos-event/describe-pack-ip-list use `--biz-region-id`; describe-traffic uses `--region`. > Has instances → all 3 APIs per instance | ALL empty → 3 probe calls on cn-hangzhou (all required) ```bash aliyun ddosbgp describe-ddos-event \ --instance-id <id> --start-time <ts> --end-time <ts> \ --page-no 1 --page-size 50 --biz-region-id <region-id> aliyun ddosbgp describe-pack-ip-list \ --instance-id <id> --page-no 1 --page-size 50 --biz-region-id <region-id> aliyun ddosbgp describe-traffic \ --instance-id <id> --start-time <ts> --end-time <ts> --region <region-id> # Probe: --instance-id dummy, --biz-region-id cn-hangzhou (describe-traffic: --region cn-hangzhou) ``` > **[MANDATORY CHECKPOINT 4.2]** You MUST now verify all 3 ddosbgp APIs were actually executed by checking terminal output. If describe-ddos-event OR describe-pack-ip-list OR describe-traffic has zero terminal output, STOP and execute the missing call(s) NOW. Two consecutive failures to complete all 3 → output error log and terminate. Do NOT proceed to 4.3 until all 3 confirmed. #### 4.3 Anti-DDoS Pro/Premium Inspection (ddoscoo APIs ONLY) > **[MUST]** `ddoscoo` APIs only. Has instances → all APIs per instance | Both Regions empty → probe calls on cn-hangzhou ```bash aliyun ddoscoo describe-ddos-events \ --instance-ids <id> --start-time <ts> --end-time <ts> \ --page-number 1 --page-size 50 --region <region-id> aliyun ddoscoo describe-domain-qps-list \ --start-time <ts> --end-time <ts> --interval 300 --region <region-id> aliyun ddoscoo describe-port-flow-list \ --instance-ids <id> --start-time <ts> --end-time <ts> \ --interval 300 --region <region-id> aliyun ddoscoo describe-domain-status-code-list \ --start-time <ts> --end-time <ts> --interval 300 \ --query-type gf --region <region-id> aliyun ddoscoo describe-domain-status-code-list \ --start-time <ts> --end-time <ts> --interval 300 \ --query-type upstrem --region <region-id> # Probe: --instance-ids dummy, --region cn-hangzhou (same 5 APIs) ``` > **[MANDATORY CHECKPOINT 4.3]** Verify all 5 ddoscoo APIs have terminal output. Any missing → execute now. Do NOT proceed to 4.4. #### 4.4 Period-over-Period Analysis Change rate = (Base - Compare) / Compare × 100%. Thresholds: ±30%~±100% → Attention | >±100% → Anomaly | Blackhole/scrubbing present → Anomaly. #### 4.5 Report Output > **Mandatory**: Follow [Report Template](references/report-template.md), no sections omitted. Group assets by Region. > > **[MUST] Data consistency validation**: > 1. **Aggregation**: Summary numbers must exactly match detail list counts > 2. **Deduplication**: Same instance/IP across Regions → deduplicate before counting > 3. **Empty value annotation (hard rule)**: Empty array `[]` → write `0 (API returned empty)` or `Query failed (ErrorCode: XXX)`. FORBIDDEN: vague phrases like "no anomaly found", "appears to be a false alarm". Key metrics with empty data MUST include `[DATA MISSING]` tag at section start > 4. **Cross-validation**: Summary totals = sum of Region details > 5. **Call record verification**: Claimed API calls and conclusions must match actual execution. Fabrication FORBIDDEN > 6. **Raw Data Binding**: Copy-paste exact values from terminal output into report. FORBIDDEN: inferring from memory, writing "no domains" if API returned domains. Use `grep`/`jq` to verify before finalizing > > **[MUST] Pre-computation verification (hard blocker)**: > **[STRICT MODE] Directly writing `echo "<number>"` with pre-filled values is FORBIDDEN and counts as fabrication. You MUST use `grep`/`jq`/`wc` to parse actual terminal output or saved log. The verification script must contain pipe commands that extract real data, NOT hardcoded echo statements.** > ```bash > # [STRICT] Count API calls from terminal history - must use grep, not hardcoded echo > echo "=== Call statistics ===" > # Example: grep -c "aliyun antiddos-public" /path/to/terminal.log (adapt to your log method) > echo "antiddos-public: $(grep -c 'antiddos-public' <<< "$TERMINAL_LOG")" > echo "ddosbgp: $(grep -c 'aliyun ddosbgp' <<< "$TERMINAL_LOG")" > echo "ddoscoo: $(grep -c 'aliyun ddoscoo' <<< "$TERMINAL_LOG")" > # [STRICT] Count assets from API responses - must use jq/grep, not hardcoded > echo "=== Asset statistics (from API JSON responses) ===" > # Parse actual JSON outputs, e.g.: jq '.InstanceList | length', jq '.DomainList | length' > ``` > **Output must contain pipe commands (`grep`, `jq`, `wc -l`). Pure `echo "number"` without pipes = fabrication = abort.** > **Mismatch with report draft → abort, re-traverse log, re-run. Report MUST quote the verification output snippet.** ## Cleanup > **[MUST] Mandatory exit safeguard**: Regardless of exit reason (success, failure, cancellation, timeout), the final step MUST unconditionally execute AI-Mode disable + verification. Highest priority, cannot be overridden. ```bash aliyun configure ai-mode disable # Verify: try status command, if unsupported fall back to configure list VERIFY=$(aliyun configure ai-mode status 2>&1) if echo "$VERIFY" | grep -q "not a valid\|unknown\|error"; then # Fallback: check via configure list output aliyun configure list | grep -i "ai-mode\|agent" fi # If still uncertain, run disable again to be safe aliyun configure ai-mode disable ``` > **[MUST]** Only write "AI-Mode confirmed disabled" if verification succeeded. If both `status` and `configure list` fail to confirm, write "AI-Mode disable executed but verification inconclusive (CLI compatibility issue)" — do NOT claim confirmed. ## References | Resource | Path | |----------|------| | CLI Installation Guide | [references/cli-installation-guide.md](references/cli-installation-guide.md) | | RAM Permission Policies | [references/ram-policies.md](references/ram-policies.md) | | API Parameter Reference | [references/api-reference.md](references/api-reference.md) | | CLI Command Table | [references/related-commands.md](references/related-commands.md) | | Inspection Report Template | [references/report-template.md](references/report-template.md) | | Verification Method | [references/verification-method.md](references/verification-method.md) | | Acceptance Criteria | [references/acceptance-criteria.md](references/acceptance-criteria.md) |

path: references/acceptance-criteria.md
content: # Acceptance Criteria: alibabacloud-ddos-security-monitor

**Scenario**: DDoS Security Product Inspection & Monitoring
**Purpose**: Skill testing acceptance criteria

---

# Correct CLI Command Patterns

## 1. Product - Product Code Verification

#### Correct
```bash
aliyun antiddos-public describe-instance-ip-address ...
aliyun ddosbgp describe-instance-list ...
aliyun ddoscoo describe-instances ...
```

#### Incorrect
```bash
aliyun antiddospublic ...        # Error: missing hyphen
aliyun ddos-bgp ...              # Error: incorrect product code spelling
aliyun ddos-coo ...              # Error: incorrect product code spelling
```

## 2. Command - Command Format (MUST use plugin mode)

#### Correct (plugin mode, kebab-case)
```bash
aliyun ddosbgp describe-instance-list --page-no 1 --page-size 10 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 10 --region cn-hangzhou
aliyun ddoscoo describe-ddos-events --instance-ids <id> --start-time <ts> --end-time <ts> --page-number 1 --page-size 50 --region cn-hangzhou
aliyun ddoscoo describe-domain-qps-list --start-time <ts> --end-time <ts> --interval 300 --region cn-hangzhou
aliyun ddoscoo describe-port-flow-list --instance-ids <id> --start-time <ts> --end-time <ts> --interval 300 --region cn-hangzhou
aliyun ddoscoo describe-domain-status-code-list --start-time <ts> --interval 300 --query-type gf --region cn-hangzhou
aliyun ddosbgp describe-ddos-event --instance-id <id> --start-time <ts> --end-time <ts> --page-no 1 --page-size 50 --biz-region-id cn-hangzhou
aliyun ddosbgp describe-traffic --start-time <ts> --region cn-hangzhou
aliyun ddosbgp describe-pack-ip-list --instance-id <id> --page-no 1 --page-size 50 --biz-region-id cn-hangzhou
```

#### Incorrect (PascalCase traditional format)
```bash
aliyun ddosbgp DescribeInstanceList --PageNo 1 --PageSize 10 --RegionId cn-hangzhou
aliyun ddoscoo DescribeInstances --PageNumber 1 --PageSize 10 --RegionId cn-hangzhou
aliyun ddoscoo DescribeDDoSEvents --InstanceIds.1 <id> --StartTime <ts> --EndTime <ts>
aliyun ddoscoo DescribeDomainQPSList --StartTime <ts> --EndTime <ts> --Interval 300
```
**Reason**: The specification requires all CLI commands to use plugin mode format (lowercase with hyphens). PascalCase traditional API format is not allowed.

## 3. Parameters - Parameter Format Verification

#### Correct
```bash
# Region parameter - ddoscoo/ddosbgp most commands use --region global parameter
aliyun ddoscoo describe-instances --page-number 1 --page-size 10 --region cn-hangzhou

# ddosbgp some commands use --biz-region-id
aliyun ddosbgp describe-ddos-event --instance-id <id> --start-time <ts> --end-time <ts> --page-no 1 --page-size 50 --biz-region-id cn-hangzhou

# Instance list parameter - space-separated
aliyun ddoscoo describe-ddos-events --instance-ids id1 id2 id3 ...
```

#### Incorrect
```bash
# Error: Using PascalCase parameter names
aliyun ddosbgp describe-instance-list --PageNo 1 --PageSize 10 --RegionId cn-hangzhou

# Error: Using .N format for instance list
aliyun ddoscoo describe-ddos-events --InstanceIds.1 <id>

# Error: ddosbgp describe-ddos-event using --region instead of --biz-region-id
aliyun ddosbgp describe-ddos-event --instance-id <id> --region cn-hangzhou
```

## 4. Authentication - Security Rules

#### Correct
```bash
# Only check credential status
aliyun configure list
```

#### Incorrect
```bash
# Error: Printing AK/SK values
echo $ALIBABA_CLOUD_ACCESS_KEY_ID

# Error: Passing plaintext credentials in command line
aliyun configure set --mode AK --access-key-id LTAI5t... --access-key-secret ...
```

## 5. AI-Mode Lifecycle

#### Correct
```bash
# Enable at start
aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddos-security-monitor"

# ... execute inspection ...

# Disable at ALL exit paths
aliyun configure ai-mode disable
```

#### Incorrect
```bash
# Error: Missing AI-Mode enable/disable
# Error: Missing user-agent setting
# Error: Only disabling on success path, missing on error path
```

## 6. Non-existent Commands

#### Incorrect
```bash
# Error: describe-instance-flow does not exist in ddoscoo plugin mode
aliyun ddoscoo describe-instance-flow --instance-ids <id> ...
```
**Note**: `describe-instance-flow` does not exist in ddoscoo. Use `describe-port-flow-list` instead.


path: references/api-reference.md
content: # API Parameter Reference

## Time Parameter Specification

- All time parameters use **second-precision Unix timestamps**
- Anti-DDoS Pro related API timestamps must be **precise to the minute**

## Required Parameters Summary

| API Command | Required Parameters | Description |
|-------------|-------------------|-------------|
| `antiddos-public describe-instance-ip-address` | `--ddos-region-id`, `--instance-type` | Query Basic Protection assets |
| `antiddos-public describe-ddos-event-list` | `--ddos-region-id`, `--instance-type`, `--instance-id` | Query Basic Protection events |
| `ddosbgp describe-ddos-event` | `--end-time`, `--instance-id`, `--page-no`, `--page-size`, `--start-time` | Query Native Protection events |
| `ddosbgp describe-traffic` | `--start-time` | Query Native Protection traffic |
| `ddosbgp describe-instance-list` | `--page-no`, `--page-size` | Query Native Protection instances |
| `ddosbgp describe-pack-ip-list` | `--instance-id`, `--page-no`, `--page-size` | Query Native Protection associated IPs |
| `ddoscoo describe-ddos-events` | `--instance-ids`, `--start-time`, `--page-number`, `--page-size` | Query Anti-DDoS Pro events |
| `ddoscoo describe-domain-qps-list` | `--end-time`, `--interval`, `--start-time` | Query Anti-DDoS Pro QPS |
| `ddoscoo describe-port-flow-list` | `--end-time`, `--instance-ids`, `--interval`, `--start-time` | Query Anti-DDoS Pro port traffic |
| `ddoscoo describe-domain-status-code-list` | `--interval`, `--query-type`, `--start-time` | Query Anti-DDoS Pro status codes |

## Region Parameter Reference

- `antiddos-public`: Uses `--ddos-region-id` parameter
- `ddosbgp describe-ddos-event` / `describe-pack-ip-list`: Uses `--biz-region-id` parameter
- `ddosbgp` other commands and all `ddoscoo` commands: Uses `--region` global parameter

## ddosbgp Endpoint Routing (Critical)

The CLI default endpoint `ddosbgp.aliyuncs.com` for `ddosbgp describe-instance-list` does NOT support mainland China Regions (cn-hangzhou/cn-beijing etc. return `DDosBgp.CheckError.InvalidRegion`). You MUST explicitly specify the endpoint:

```bash
# Must add --endpoint parameter, this endpoint covers both mainland and overseas Regions
aliyun ddosbgp describe-instance-list --page-no 1 --page-size 50 --region <region> --endpoint ddosbgp.cn-hangzhou.aliyuncs.com
```

Note: `describe-ddos-event`, `describe-pack-ip-list`, `describe-traffic` are NOT affected by this issue and do not need an explicit endpoint.

Global instances (CoverageType=4, shown as "Global" in console) will appear in every Region query and must be deduplicated by InstanceId.

To get the full list of Regions supported by ddosbgp: `aliyun ddosbgp describe-regions` (approximately 26 Regions, more accurate than the ECS Region list).

## query-type Values (Anti-DDoS Pro Status Codes)

| Value | Description |
|-------|-------------|
| `gf` | Anti-DDoS Pro frontend (WAF response to client) |
| `upstrem` | Origin (origin server response to WAF; note: official API spelling is `upstrem`) |

## instance-ids Format (ddoscoo)

The `--instance-ids` parameter for ddoscoo uses space-separated values:

```bash
aliyun ddoscoo describe-ddos-events --instance-ids id1 id2 id3 ...
```

## Common Region Codes

| Region | Code |
|--------|------|
| China East 1 (Hangzhou) | `cn-hangzhou` |
| China East 2 (Shanghai) | `cn-shanghai` |
| China North 2 (Beijing) | `cn-beijing` |
| China South 1 (Shenzhen) | `cn-shenzhen` |
| China (Hong Kong) | `cn-hongkong` |
| Singapore | `ap-southeast-1` |

## Instance Type Values (Basic Protection)

| Type | Value |
|------|-------|
| ECS | `ecs` |
| SLB | `slb` |
| EIP | `eip` |
| IPv6 | `ipv6` |
| Simple Application Server | `swas` |
| WAF | `waf` |
| GA Basic | `ga_basic` |


path: references/cli-installation-guide.md
content: # CLI Installation Guide

## macOS

```bash
# Recommended: One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Or use Homebrew
brew install aliyun-cli
```

## Linux

```bash
# One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
```

## Windows

Download and install from GitHub Releases: https://github.com/aliyun/aliyun-cli/releases

## Verify Installation

```bash
aliyun version
# Requires >= 3.3.3
```

## Enable Auto Plugin Install & Update

```bash
# Enable auto plugin install
aliyun configure set --auto-plugin-install true

# Update all installed plugins to latest version
aliyun plugin update
```

## Verify Credentials

```bash
# Check current configuration (view status only, never print credential values)
aliyun configure list
```

> **Security Rules:**
> - **NEVER** read, echo, or print AK/SK values
> - **NEVER** use `aliyun configure set` with literal credential values
> - **ONLY** use `aliyun configure list` to check credential status
> - Configure credentials **outside of agent sessions** via `aliyun configure` in terminal

## Reference Documentation

- Alibaba Cloud CLI Official Docs: https://help.aliyun.com/zh/cli/
- Calling RPC/ROA APIs: https://help.aliyun.com/zh/cli/call-rpc-api-and-roa-api


path: references/cli-setup.md
content: # CLI Installation & Credential Configuration

## CLI Installation

```bash
# One-click install script (recommended)
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Verify version (requires >= 3.3.3)
aliyun version

# Enable auto plugin install
aliyun configure set --auto-plugin-install true

# Update all installed plugins
aliyun plugin update
```

> **Important**: CLI version must be >= 3.3.3. If the version is too low, re-run the install script to update.

## Credential Configuration

> **Security Rules:**
> - **NEVER** read, echo, or print AK/SK values
> - **NEVER** ask the user to input AK/SK directly in the conversation or command line
> - **NEVER** use `aliyun configure set` with literal credential values
> - **ONLY** use `aliyun configure list` to check credential status

```bash
# Check current credential status
aliyun configure list
```

**If no valid profile exists, STOP here.**
1. Obtain credentials from [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak)
2. Configure credentials **outside of this session** (via `aliyun configure` in terminal or environment variables in shell profile)
3. Return and re-run after `aliyun configure list` shows a valid profile

### Create RAM Sub-account (Recommended)

If the user has no configured credentials, guide them to:

1. Log in to https://ram.console.aliyun.com to create a RAM sub-account (main account AK/SK has excessive permissions and high leak risk)
2. Create an AccessKey for the RAM sub-account
3. Grant permissions according to the permission list in [ram-policies.md](ram-policies.md)
4. Configure in terminal using `aliyun configure` (**never pass credentials in the session**)


path: references/ram-policies.md
content: # RAM Permission Policies

## Minimum Permission List

### DDoS Basic Protection (antiddos-public)

```json
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "antiddos-public:DescribeInstanceIpAddress",
        "antiddos-public:DescribeDdosEventList"
      ],
      "Resource": "*"
    }
  ]
}
```

### DDoS Native Protection (ddosbgp)

```json
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ddosbgp:DescribeInstanceList",
        "ddosbgp:DescribePackIpList",
        "ddosbgp:DescribeDdosEvent",
        "ddosbgp:DescribeTraffic"
      ],
      "Resource": "*"
    }
  ]
}
```

### DDoS Anti-DDoS Pro/Premium (ddoscoo)

```json
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ddoscoo:DescribeInstances",
        "ddoscoo:DescribeDomains",
        "ddoscoo:DescribeDDoSEvents",
        "ddoscoo:DescribeDDosAllEventList",
        "ddoscoo:DescribeDomainQPSList",
        "ddoscoo:DescribePortFlowList",
        "ddoscoo:DescribeDomainStatusCodeList"
      ],
      "Resource": "*"
    }
  ]
}
```

## Read-Only Permission Note

All permissions listed above are **read-only permissions**, supporting only query (Describe/List) operations. No create, modify, or delete write operations are included.

## Permission Failure Handling

> **[MUST] Permission Failure Handling:** When any command or API call fails due to permission errors at any point during execution, follow this process:
> 1. Read this file (`references/ram-policies.md`) to get the full list of permissions required by this SKILL
> 2. Use `ram-permission-diagnose` skill to guide the user through requesting the necessary permissions
> 3. Pause and wait until the user confirms that the required permissions have been granted


path: references/related-commands.md
content: # CLI Command Table

## DDoS Basic Protection (antiddos-public)

| CLI Command | Description | Required Parameters |
|-------------|-------------|-------------------|
| `aliyun antiddos-public describe-instance-ip-address` | Query Basic Protection assets | `--ddos-region-id`, `--instance-type` |
| `aliyun antiddos-public describe-ddos-event-list` | Query Basic Protection events | `--ddos-region-id`, `--instance-type`, `--instance-id` |

## DDoS Native Protection (ddosbgp)

| CLI Command | Description | Required Parameters |
|-------------|-------------|-------------------|
| `aliyun ddosbgp describe-instance-list` | Query Native Protection instances | `--page-no`, `--page-size`, `--region` |
| `aliyun ddosbgp describe-pack-ip-list` | Query Native Protection associated IPs | `--instance-id`, `--page-no`, `--page-size`, `--biz-region-id` |
| `aliyun ddosbgp describe-ddos-event` | Query Native Protection attack events | `--end-time`, `--instance-id`, `--page-no`, `--page-size`, `--start-time` (`--biz-region-id` optional) |
| `aliyun ddosbgp describe-traffic` | Query Native Protection L4 traffic | `--start-time`, `--region` |

## DDoS Anti-DDoS Pro/Premium (ddoscoo)

| CLI Command | Description | Required Parameters |
|-------------|-------------|-------------------|
| `aliyun ddoscoo describe-instances` | Query Anti-DDoS Pro instances | `--page-number`, `--page-size`, `--region` |
| `aliyun ddoscoo describe-domains` | Query Anti-DDoS Pro domains | `--region` (`--instance-ids` optional) |
| `aliyun ddoscoo describe-ddos-events` | Query Anti-DDoS Pro attack events | `--instance-ids`, `--start-time`, `--end-time`, `--page-number`, `--page-size`, `--region` |
| `aliyun ddoscoo describe-ddos-all-event-list` | Query Anti-DDoS Pro all events | `--start-time`, `--end-time`, `--page-number`, `--page-size`, `--region` |
| `aliyun ddoscoo describe-domain-qps-list` | Query Anti-DDoS Pro QPS | `--start-time`, `--end-time`, `--interval`, `--region` |
| `aliyun ddoscoo describe-port-flow-list` | Query Anti-DDoS Pro port traffic | `--instance-ids`, `--start-time`, `--end-time`, `--interval`, `--region` |
| `aliyun ddoscoo describe-domain-status-code-list` | Query Anti-DDoS Pro HTTP status codes | `--interval`, `--query-type`, `--start-time`, `--region` |

## Parameter Format Notes

- **Time parameters**: All time parameters use **second-precision Unix timestamps**
- **Region parameters**: Some ddosbgp commands use `--biz-region-id`, others use the global `--region` parameter
- **Instance list**: ddoscoo's `--instance-ids` uses space-separated values, format: `--instance-ids id1 id2 id3`
- **query-type values**: `gf` (Anti-DDoS Pro frontend) or `upstrem` (origin; note: official API spelling is `upstrem`)


path: references/report-template.md
content: # DDoS Security Inspection Report Template

> **Mandatory**: Every inspection report output MUST strictly follow this template structure. No sections may be omitted.

---

## Normal Situation Template

```markdown
# DDoS Security Inspection Report

## Inspection Summary

| Item | Value |
|------|-------|
| Inspection Time | <current time> |
| Base Period | <base_start> ~ <base_end> |
| Compare Period | <compare_start> ~ <compare_end> |
| Inspection Mode | <day-over-day / hour-over-hour / 30-min-over-30-min / custom> |
| Products Covered | <Basic Protection / Native Protection / Anti-DDoS Pro> |

---

## Asset Inventory

| Product | Status | Asset Details |
|---------|--------|---------------|
| DDoS Basic Protection | OK/Warning/Error | <instance count> ECS instances, <IP count> public IPs |
| DDoS Native Protection | OK/Warning/Error | <instance count> instances, <protected IP count> protected IPs |
| DDoS Anti-DDoS Pro/Premium | OK/Warning/Error | <instance count> instances, <domain count> domains |

### Detailed Asset List

#### Basic Protection Assets
| Instance Name | Instance ID | Public IP | Protection Status |
|--------------|-------------|-----------|-------------------|
| <...> | <...> | <...> | <...> |

#### Native Protection Assets
| Instance ID | Protected IP | Product Type | Region | Status |
|-------------|-------------|-------------|--------|--------|
| <...> | <...> | <...> | <...> | <...> |

#### Anti-DDoS Pro/Premium Assets
| Instance ID | Anti-DDoS IP | Associated Domains |
|-------------|-------------|-------------------|
| <...> | <...> | <...> |

---

## Inspection Results

### 1. DDoS Attack Events

| Product | Base Period Events | Compare Period Events | Change |
|---------|-------------------|----------------------|--------|
| Basic Protection | <N> events | - | - |
| Native Protection | <N> events | <N> events | <no change/increase/decrease> |
| Anti-DDoS Pro | <N> events | <N> events | <no change/increase/decrease> |

---

### 2. L4 Traffic Analysis (Peak)

| Product | Base Period Peak | Compare Period Peak | Change Rate |
|---------|----------------|--------------------|----|
| Native Protection | <N> Mbps | <N> Mbps | <+/-X% or no data> |
| Anti-DDoS Pro | <N> Mbps | <N> Mbps | <+/-X% or no data> |

---

### 3. L7 QPS Analysis

| Product | Base Period Peak | Compare Period Peak | Change Rate |
|---------|----------------|--------------------|----|
| Anti-DDoS Pro | <N> QPS | <N> QPS | <+/-X% or no data> |

---

### 4. HTTP Status Code Analysis

| Type | Base Period | Compare Period | Change Rate |
|------|-----------|---------------|-------------|
| Frontend 4xx | <N> times | <N> times | <+/-X% or no data> |
| Frontend 5xx | <N> times | <N> times | <+/-X% or no data> |

---

## Conclusion: No anomalies found in this inspection

**All metrics normal** during the past <time range>:
- No DDoS attack events
- No abnormal traffic fluctuations
- No status code anomalies

---

## Data Notes

| Product | Data Status | Reason |
|---------|------------|--------|
| <product> | <has data/no data> | <explanation> |
```

---

## Anomaly Template

When anomalies are found, replace the conclusion section with:

```markdown
## Conclusion: <N> anomalies found

### Anomaly Summary
| Product | Metric | Anomaly Type | Details |
|---------|--------|-------------|---------|
| <product> | <metric name> | Anomaly/Attention needed | <change rate/event details> |

### Remediation Recommendations
1. <specific actionable recommendation>
2. <...>
```


path: references/verification-method.md
content: # Verification Method

## Phase 1 Verification: Environment & Credentials

```bash
# Verify CLI version >= 3.3.3
aliyun version

# Verify credentials are valid (returns JSON, not error)
aliyun antiddos-public describe-instance-ip-address \
  --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 1
```

**Success criteria**: CLI version output >= 3.3.3, `aliyun configure list` shows a valid profile, API call returns normal JSON.

**Abort criteria**: If any pre-check command returns a non-zero exit code or fails 3 consecutive times, output a standardized error report and execute `aliyun configure ai-mode disable`, then terminate the workflow.

## Phase 2 Verification: RAM Permissions

```bash
# Basic Protection permission verification
aliyun antiddos-public describe-instance-ip-address \
  --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 1

# Native Protection permission verification
aliyun ddosbgp describe-instance-list --page-no 1 --page-size 1 --region cn-hangzhou

# Anti-DDoS Pro permission verification (two Regions)
aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region ap-southeast-1
```

**Success criteria**: All commands return valid JSON responses, no `Forbidden.RAM` or `NoPermission` errors.

## Phase 3 Verification: Product Inventory (Mandatory Traversal)

**Success criteria**:
1. Instance list queries have been executed for every Region (even empty list returns count as successful execution)
2. All provisioned instances have been discovered and logged
3. No Regions were skipped due to empty lists or InvalidRegion errors

## Phase 5 Verification: Inspection Execution & Report

**Mandatory call verification**:
1. Native Protection's describe-ddos-event, describe-pack-ip-list, describe-traffic have all been called
2. Anti-DDoS Pro's describe-ddos-events, describe-domain-qps-list, describe-port-flow-list, describe-domain-status-code-list have all been called
3. Even if a product has no instances, the above APIs have been executed as probes

**Data consistency verification**:
1. Total instance count in report summary = sum of Region detail instance counts
2. Total protected IP count in report summary = sum of per-instance associated IP counts
3. No duplicate counting (same instance or IP deduplicated across multi-Region queries)
4. Empty values annotated as "0", not omitted

**Report format verification**:
1. Report strictly follows the prescribed template structure, no sections omitted
2. All assets grouped by Region
3. Both base period and compare period data have been retrieved
4. Period-over-period analysis calculations are correct
5. Anomaly indicators are flagged (+/-30% attention needed, +/-100% anomaly)

## Overall Verification

```bash
# Confirm AI-Mode is disabled (final step for ALL exit paths)
aliyun configure ai-mode disable
```

**Success criteria**: AI-Mode has been disabled before final exit, regardless of whether the workflow completed successfully or was terminated due to an exception.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)