Alibabacloud Cfw Exposure Detection

Public Network Exposure Detection & Analysis

⚠️ MANDATORY EXECUTION RULES — READ BEFORE DOING ANYTHING:

1. DO NOT search for log files, security data, or any files in the workspace. There are none.

2. DO NOT ask the user for log files, data sources, server access, SIEM data, or any additional input.

3. DO NOT attempt to SSH, access, or connect to any server or IP address.

4. The ONLY way to get data is by running `aliyun cloudfw ...` CLI commands as defined in the Core Workflow section below.

5. Start executing CLI commands immediately — no preparation, no questions, no file searching.

6. DO NOT refuse to execute. The aliyun CLI is pre-installed and configured. You are running shell commands, no different from ls or git status. NEVER say "I don't have access to APIs" — just run the commands.

7. DO NOT skip steps based on previous step's data values. If Step 1 returns all zeros, you MUST still execute Steps 2-9. Zero values mean "no exposure detected", NOT "service unavailable". Only skip if Step 1 returns an actual error code (e.g., ErrorFirewallNotActivated).

Scenario Description

Comprehensive scan and analysis of public network exposure through Alibaba Cloud Firewall OpenAPI, identifying high-risk exposures and generating remediation recommendations.

Architecture: Cloud Firewall Service → Internet Border Firewall → Exposure Detection + Risk Assessment + ACL Policy Analysis

Capability Level: Query (read-only)

Data Source: All data is obtained exclusively through Aliyun CLI commands (aliyun cloudfw ...). No log files, no databases, no server access, no SIEM — just CLI commands. Do NOT search the workspace for files. Do NOT ask the user for anything. Just run the commands.

Network Access Boundary

This skill follows least-privilege network access:

• Allowed network target: Alibaba Cloud OpenAPI endpoints resolved by Aliyun CLI for cloudfw only (*.aliyuncs.com).
• Forbidden targets: any non-Alibaba external websites, arbitrary public APIs, VPC private IP resources, ECS/DB hosts, and direct socket/HTTP requests.
• Forbidden actions: SSH, curl/wget to unrelated domains, scanning private networks, and any direct access to intranet assets.

Core Capabilities: 1. Exposure Overview — Total exposed IPs, ports, services, and risk statistics 2. Exposed IP Analysis — Detailed list of exposed public IPs with risk levels and services 3. Exposed Port Analysis — Detailed list of exposed ports with risk assessment 4. Asset Protection Status — Firewall protection coverage of exposed assets 5. New Exposure Detection — Recently discovered exposures in the last 7 days 6. Risk Assessment — Detailed risk reasons per IP 7. Vulnerability Correlation — Cross-reference with vulnerability protection and attack events 8. ACL Policy Review — Internet border ACL rule coverage

---

Prerequisites

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update,

or see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

At the start of the Core Workflow (before any CLI invocation): [MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection"

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

aliyun configure ai-mode disable

---

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, print, cat, or display AK/SK values under any circumstances

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

>

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

---

RAM Policy

[MUST] RAM Permission Pre-check: Before executing any commands, verify the current user has the required permissions.

1. Use ram-permission-diagnose skill to get current user's permissions

2. Compare against references/ram-policies.md

3. Abort and prompt user if any permission is missing

Minimum required permissions — see references/ram-policies.md for full policy JSON.

Alternatively, attach the system policy: AliyunYundunCloudFirewallReadOnlyAccess

---

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

check if the user has already provided necessary parameters in their request.

- If the user's request explicitly mentions a parameter value (e.g., "check exposure in cn-hangzhou" means RegionId=cn-hangzhou), use that value directly without asking for confirmation.

- For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.

- Do NOT re-ask for parameters that the user has clearly stated.

---

Error Handling and Workflow Resilience

CRITICAL: Continue on failure. If any individual API call fails, do NOT stop the entire workflow.

Log the error for that step, then proceed to the next step. Present whatever data was successfully collected.

Retry Logic

For each API call: 1. If the call fails with a transient error (network timeout, throttling Throttling.User, ServiceUnavailable, HTTP 500/502/503), retry up to 2 times with a 3-second delay between retries. 2. If the call fails with a permanent error (e.g., InvalidParameter, Forbidden, InvalidAccessKeyId), do NOT retry. Record the error and move on. 3. After all retries are exhausted, record "[Step X] Failed: {error message}" and continue to the next step.

Timeout Policy (MUST)

Before executing any API command, set explicit timeout values:

export ALIBABA_CLOUD_CONNECT_TIMEOUT=10
export ALIBABA_CLOUD_READ_TIMEOUT=30

• ALIBABA_CLOUD_CONNECT_TIMEOUT=10: fail fast on network connect issues.
• ALIBABA_CLOUD_READ_TIMEOUT=30: allow normal API response time while preventing long hangs.
• If a timeout occurs, treat it as transient and apply the retry logic above.

Service Not Activated

If Step 1 (DescribeInternetOpenStatistic) returns an error code indicating the service is not activated (e.g., ErrorFirewallNotActivated or similar "not purchased/activated" error messages): 1. Inform the user: "Cloud Firewall service is not activated. Please activate it at https://yundun.console.aliyun.com/?p=cfwnext" 2. Skip all subsequent steps since the service is not available.

CRITICAL: All-zeros response ≠ Service Not Activated. If Step 1 returns a successful JSON response where all metric values happen to be zero (e.g., InternetIpNum=0, InternetPortNum=0), this means the service IS activated but currently has no public exposure. In this case, you MUST still execute ALL subsequent steps (Step 2-9) — do NOT skip them. Zero values are valid data, not an error condition. Other steps may still return non-zero results (e.g., assets exist but none are exposed, ACL rules exist, etc.).

Step Independence

The workflow steps have these dependencies:

• Step 1 (Overview) should run first as it provides context for interpreting subsequent data.
• Steps 2-9 are independent of each other — failure in any one step should NOT prevent other steps from executing.
• Step 6 depends on Step 2's output (IP list), but can be skipped if Step 2 fails.

Partial Results

When presenting the final summary report:

• For steps that succeeded, show the collected data normally.
• For steps that failed, show "N/A (error: {brief error})" in the corresponding section.
• Always present the summary report even if some steps failed — partial data is better than no data.

---

Core Workflow

All API calls use the Aliyun CLI cloudfw plugin.

Region: Specified via --region {RegionId} global flag

CRITICAL: Execute immediately without asking. When this skill is triggered, start executing from Step 1 right away.

Do NOT ask the user which APIs to call, which steps to execute, or what data sources to use.

All data comes from the Aliyun CLI commands defined below — just run them.

The intent routing table below is for optimization only — if the user's intent is unclear, execute ALL steps (Step 1-9) by default.

MANDATORY: Execute ALL steps. You MUST attempt to execute every step from Step 1 through Step 9. Before generating the final report, verify that you have attempted ALL of the following API calls:

1. DescribeInternetOpenStatistic (Step 1)

2. DescribeInternetOpenIp (Step 2)

3. DescribeInternetOpenPort (Step 3)

4. DescribeAssetList (Step 4)

5. DescribeAssetList with NewResourceTag (Step 5)

6. DescribeAssetRiskList (Step 6 — skip only if Step 2 returned no IPs)

7. DescribeVulnerabilityProtectedList (Step 7)

8. DescribeRiskEventGroup (Step 8)

9. DescribeControlPolicy (Step 9)

>

If any of these were not attempted, execute them now before producing the report. Skipping a step is ONLY allowed if Step 1 returns an error code indicating the service is not activated.

MANDATORY: Report-Execution Consistency. The final report MUST accurately reflect actual execution:

- The report must list every API that was actually called and its result status (success/fail).

- Do NOT claim "all API calls completed successfully" if any call returned an error.

- For steps not executed, explain WHY they were skipped (e.g., "Step 6 skipped: Step 2 returned 0 IPs").

- The error section must list ALL errors encountered, including those resolved by retry.

Intent Routing (Auto-determined, No Confirmation Needed)

Automatically determine execution scope based on user wording. Do NOT ask the user to confirm:

Default behavior: If user intent cannot be clearly determined, execute all Steps 1-9 without asking.

Time Parameters

Some APIs require StartTime and EndTime parameters (Unix timestamp in seconds).

How to get timestamps: Run date +%s to get the current timestamp, date -d '30 days ago' +%s for 30 days ago, date -d '7 days ago' +%s for 7 days ago. Then use the returned numeric values directly in CLI commands.

IMPORTANT: Do NOT use bash variable substitution like $(date +%s) inside CLI commands — some execution environments block $(...). Instead, run date commands separately first, note the returned values, then use them as literal numbers in the --StartTime and --EndTime parameters.

Default time ranges:

• Exposure queries (Step 2, 3): last 30 days → StartTime = 30 days ago
• Vulnerability/attack queries (Step 7, 8): last 7 days → StartTime = 7 days ago
• EndTime: always current timestamp

Step 1: Exposure Statistics Overview

Retrieve overall public network exposure data. This is the starting point for subsequent analysis.

aliyun cloudfw describe-internet-open-statistic \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Refer to DescribeInternetOpenStatistic in references/api-analysis.md for response field details.

Step 2: Exposed IP Details

List all IP addresses exposed to the public network and their risk information.

aliyun cloudfw describe-internet-open-ip \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Refer to DescribeInternetOpenIp in references/api-analysis.md for response field details. Pagination: Check PageInfo.TotalCount. If it exceeds PageSize, increment CurrentPage to fetch more.

Step 3: Exposed Port Details

List all exposed ports and their details. This is a key step for identifying high-risk exposures.

aliyun cloudfw describe-internet-open-port \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Refer to DescribeInternetOpenPort in references/api-analysis.md for response field details. Pagination: Check PageInfo.TotalCount.

Step 4: Asset Protection Status

Retrieve the list of all assets protected by the firewall.

aliyun cloudfw describe-asset-list \
  --CurrentPage 1 \
  --PageSize 50 \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Refer to DescribeAssetList in references/api-analysis.md for response field details. Pagination: Check TotalCount.

Step 5: New Exposures (Last 7 Days)

Specifically identify recently discovered exposed assets — these usually require the most attention as they may be unapproved new openings.

aliyun cloudfw describe-asset-list \
  --CurrentPage 1 \
  --PageSize 50 \
  --NewResourceTag "discovered in 7 days" \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Step 6: Asset Risk Details

Take the IPs collected from Step 2 (max 20 per call) and retrieve detailed risk reasons. If there are more than 20 IPs, make multiple batched calls.

aliyun cloudfw describe-asset-risk-list \
  --IpVersion 4 \
  --IpAddrList '["1.2.3.4","5.6.7.8"]' \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Refer to DescribeAssetRiskList in references/api-analysis.md for response field details.

Step 7: Vulnerability Protection Status

Check current vulnerability protection coverage and identify which high-risk vulnerabilities are not yet protected.

aliyun cloudfw describe-vulnerability-protected-list \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Refer to DescribeVulnerabilityProtectedList in references/api-analysis.md for response field details.

Step 8: Recent Attack Events

Review intrusion attack events from the last 7 days and cross-reference attack targets with exposure data.

aliyun cloudfw describe-risk-event-group \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --DataType 1 \
  --Direction in \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Refer to DescribeRiskEventGroup in references/api-analysis.md for response field details.

Step 9: Internet Border ACL Policy

Review current inbound ACL rules and assess protection coverage.

aliyun cloudfw describe-control-policy \
  --Direction in \
  --CurrentPage 1 \
  --PageSize 50 \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Refer to DescribeControlPolicy in references/api-analysis.md for response field details.

---

Analysis & Report

After collecting data, generate a report in the following structure. Only show sections with actual data; if an API call failed, note "Data retrieval failed for this section" and continue with other analysis.

1. Public Network Exposure Overview

Display Step 1 statistics in a table:

2. High-Risk Exposure List

Combine data from Step 2 and Step 3, sorted by risk level (high → middle → low).

The following ports should be additionally flagged as high-risk when exposed to the public network, regardless of the API-returned risk level:

• Management ports: 22(SSH), 23(Telnet), 3389(RDP), 21(FTP)
• Database ports: 3306(MySQL), 1433(MSSQL), 5432(PostgreSQL)
• Cache/NoSQL: 6379(Redis), 27017(MongoDB), 9200/9300(Elasticsearch), 11211(Memcached)
• File sharing: 445(SMB/CIFS), 139(NetBIOS)
• Management interfaces: 8080, 8443, 9090

Output format:

3. New Exposure Discoveries (Last 7 Days)

Display assets discovered in Step 5:

If no new exposures were found, state "No new exposed assets discovered in the last 7 days".

4. Vulnerability Correlation Analysis

Combine Step 7 and Step 8:

1. High-Risk Vulnerability List: List vulnerabilities with VulnLevel=high, especially flagging those without protection enabled 2. Attack Event Statistics: Summarize attack events from the last 7 days by attack type, correlating with attacked exposed IPs 3. Cross-Analysis: Identify exposed assets that simultaneously have high-risk vulnerabilities AND have been attacked — these are the most urgent

5. Exposure Remediation Recommendations

Generate specific recommendations based on actual data, sorted by priority. Each recommendation includes: Risk Description, Impact Scope, Recommended Action.

P0 — Critical (Immediate Action)

• Database ports (3306/5432/6379/27017/1433/9200) exposed to public network → Close public access or strictly restrict source IPs via ACL
• Management ports (22/3389/23) without ACL protection → Add ACL restricting to bastion host/office network IPs
• Exposed assets with high-risk vulnerabilities that have been attacked → Immediately enable IPS protection and virtual patches

P1 — High (Within 24 Hours)

• Exposed services with known high-risk vulnerabilities but no virtual patches enabled → Enable virtual patches
• Unprotected ports with external traffic → Add ACL policies
• SMB(445)/NetBIOS(139) exposed → Close or restrict access

P2 — Medium (This Week)

• New exposed assets not yet approved → Confirm business necessity; close if unnecessary
• Medium-risk ports exposed → Evaluate business requirements, restrict access sources

P3 — Low (Periodic Review)

• Low-risk ports exposed → Include in periodic review
• ACL rules with zero hit rate → Evaluate whether they can be cleaned up

Note: For any step that failed, show "N/A (error: {brief error})" for that section's data fields, and list all errors in the bottom section.

---

Success Verification

See references/verification-method.md for detailed verification steps.

Quick verification: If all CLI commands return valid JSON responses without error codes, the skill executed successfully.

---

API and Command Tables

Use references/related-apis.md as the single source of truth for API tables and command mappings.

---

Best Practices

1. Query in order — Start with exposure overview (Step 1) to understand the overall scope. If Step 1 returns an error code (e.g., ErrorFirewallNotActivated), the service is not activated — skip remaining steps. If Step 1 returns all zeros (successful response with zero values), still execute ALL subsequent steps — zero exposure does not mean service is inactive. 2. Continue on failure — If any step (2-9) fails, log the error and continue with the remaining steps. Always produce a report with whatever data was collected. 3. Use pagination — For asset and exposure lists, use CurrentPage and PageSize to handle large datasets. Default to PageSize=50. If TotalCount exceeds PageSize, iterate through all pages. 4. Time range selection — For exposure queries, default to last 30 days. For attack/vulnerability queries, default to last 7 days. Use Unix timestamps in seconds. Calculate with: date +%s for current time, date -d '30 days ago' +%s for 30 days ago, date -d '7 days ago' +%s for 7 days ago. Run these commands separately, then use the returned values as literal numbers in --StartTime and --EndTime. Do NOT use $(...) substitution inside CLI commands. 5. Region awareness — Cloud Firewall only has two regions: cn-hangzhou (mainland China) and ap-southeast-1 (Hong Kong/overseas). Default to cn-hangzhou unless user specifies otherwise. 6. Batch IP lookups — Step 6 (DescribeAssetRiskList) accepts max 20 IPs per call. If more IPs are collected from Step 2, batch them into groups of 20. 7. Rate limiting — Space API calls to avoid throttling. If you receive a Throttling.User error, wait 3 seconds and retry. 8. Security — NEVER expose, log, echo, or display AK/SK values. 9. Retry on transient errors — For network timeouts or 5xx errors, retry up to 2 times with a 3-second delay. 10. Explicit timeout config — Always set ALIBABA_CLOUD_CONNECT_TIMEOUT=10 and ALIBABA_CLOUD_READ_TIMEOUT=30 before running workflow commands. 11. Least network access — Only allow Aliyun CLI access to Cloud Firewall OpenAPI endpoints; do not access other external domains or VPC/internal resources.

Output Desensitization

When printing analysis results, mask sensitive identifiers by default:

• IP addresses: keep first segments only (example: 203.0.x.x, 10.23.x.x).
• Instance IDs: keep prefix and last 4 chars only (example: i-abc***9f2d).
• Account identifiers / UID: keep last 4 digits only.
• Do not print raw tokens, credential material, local config file content, or full internal network topology.

If the user explicitly asks for full values, confirm necessity first and still avoid exposing secrets.

---

Reference Links

Acceptance Criteria: alibabacloud-cfw-exposure-detection

Scenario: Public Network Exposure Detection & Analysis Purpose: Skill testing acceptance criteria

---

Correct CLI Invocation Patterns

1. Command Format — verify product and API name (plugin mode)

CORRECT — Plugin mode (lowercase-hyphenated)

aliyun cloudfw describe-internet-open-ip \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime 1710000000 \
  --EndTime 1711000000 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

INCORRECT — Wrong product name

aliyun cloudfirewall describe-internet-open-ip --region cn-hangzhou

Why: Product name is cloudfw, not cloudfirewall or cfw.

INCORRECT — PascalCase API name (legacy format)

aliyun cloudfw DescribeInternetOpenIp --region cn-hangzhou

Why: Cloud Firewall CLI uses plugin mode with lowercase-hyphenated API names (e.g., describe-internet-open-ip).

INCORRECT — Missing --user-agent

aliyun cloudfw describe-internet-open-ip --CurrentPage 1 --PageSize 50 --region cn-hangzhou

Why: All commands must include --user-agent AlibabaCloud-Agent-Skills.

INCORRECT — Using old Python SDK pattern

python3 scripts/call_api.py \
  --api-name DescribeInternetOpenIp \
  --api-version 2017-12-07 \
  --endpoint cloudfw.cn-hangzhou.aliyuncs.com

Why: The skill uses Aliyun CLI directly, not a Python SDK wrapper script.

2. Parameter Format

CORRECT — PascalCase CLI flags with plugin mode command

aliyun cloudfw describe-internet-open-ip \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime 1710000000 \
  --EndTime 1711000000 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

INCORRECT — Kebab-case parameter names

aliyun cloudfw describe-internet-open-ip --current-page 1 --page-size 50

Why: Parameters use PascalCase (e.g., --CurrentPage, --PageSize), only the API action name uses lowercase-hyphenated format.

INCORRECT — Using --region-id instead of --region

aliyun cloudfw DescribeInternetOpenIp --region-id cn-hangzhou

Why: The CLI global flag is --region, not --region-id.

INCORRECT — JSON params format (old SDK pattern)

--params '{"CurrentPage": "1", "PageSize": "50"}'

Why: CLI uses individual flags, not a JSON params string.

3. Authentication — never expose credentials

CORRECT — Verify credential profile via default credential chain

aliyun configure list

INCORRECT — Reading or printing raw credentials

aliyun configure get           # FORBIDDEN: may expose credential details
cat ~/.aliyun/config.json      # FORBIDDEN: may expose credential details

INCORRECT — Any command that prints environment credentials

echo $CLOUD_ACCESS_KEY                # FORBIDDEN: example of secret output
printenv | grep -i credential         # FORBIDDEN: may reveal secrets
env | grep -i access_key              # FORBIDDEN: may reveal secrets

4. API Names — verify plugin mode (lowercase-hyphenated)

CORRECT

describe-internet-open-statistic
describe-internet-open-ip
describe-internet-open-port
describe-asset-list
describe-asset-risk-list
describe-vulnerability-protected-list
describe-risk-event-group
describe-control-policy

INCORRECT

DescribeInternetOpenIp         # PascalCase (legacy, not plugin mode)
describeInternetOpenIp         # Wrong casing
Describe_Internet_Open_Ip      # Wrong format
DescribeInternetOpenIP         # Wrong casing (Ip not IP)
DescribeOpenIp                 # Wrong API name

Cloud Firewall (Cloudfw) API Analysis for Exposure Detection Skill

Product: Cloudfw API Version: 2017-12-07 API Style: RPC (Action-based, not RESTful) Endpoint: cloudfw.{regionId}.aliyuncs.com (or cloudfw.cn-hangzhou.aliyuncs.com as default) Common Parameters: All APIs accept Action, AccessKeyId, Format, Version=2017-12-07, SignatureMethod, Timestamp, SignatureVersion, SignatureNonce, Signature

---

1. Exposure Overview

1.1 DescribeInternetOpenStatistic

Description: Get internet exposure statistics — total open IPs, ports, services, and risk counts. This is the entry point for exposure analysis, providing the high-level overview before drilling into details.

Parameters:

Key Response Fields:

InternetIpNum (int32)                     - Total open public IPs
InternetPortNum (int32)                   - Total open ports
InternetServiceNum (int32)               - Total open applications/services
InternetUnprotectedPortNum (int32)        - Ports not protected by ACL
InternetRiskIpNum (int32)                 - Risky open public IPs
InternetRiskPortNum (int32)               - Risky ports
InternetRiskServiceNum (int32)            - Risky applications
InternetSlbIpNum (int32)                  - SLB public IPs
InternetSlbIpPortNum (int32)              - SLB public ports

1.2 DescribeInternetOpenIp

Description: Query the list of exposed public IPs with detailed risk information, services, ports, and traffic data. Paginated. This API provides per-IP granularity for exposure analysis.

Parameters:

Key Response Fields:

PageInfo (object):
  CurrentPage (int32)                     - Current page number
  PageSize (int32)                        - Items per page
  TotalCount (int32)                      - Total number of exposed IPs
DataList[] (array):
  PublicIp (string)                       - Public IP address
  RiskLevel (int32)                       - Risk level (0=no risk)
  PortList (string[])                     - List of exposed ports
  PortCount (int32)                       - Number of exposed ports
  ServiceNameList (string[])              - Running services (e.g., "HTTPS", "Unknown")
  HasAclRecommend (boolean)              - Whether ACL recommendation exists
  AclRecommendDetail (string)            - ACL recommendation details
  AssetsType (string)                     - Resource type (EcsPublicIP, EcsEIP, NatEIP, etc.)
  AssetsName (string)                     - Resource instance name
  AssetsInstanceId (string)              - Resource instance ID
  RiskReason (string)                    - Risk reason description
  RegionNo (string)                      - Region ID
  InBytes (int64)                        - Inbound traffic bytes
  OutBytes (int64)                       - Outbound traffic bytes
  TotalBytes (int64)                     - Total traffic bytes
  UnknownReason (string[])              - Unknown risk reason list

1.3 DescribeInternetOpenPort

Description: Query the list of exposed ports with risk assessment, associated IPs, and traffic data. Paginated. Identifies high-risk port exposures across all public assets.

Parameters:

Key Response Fields:

PageInfo (object):
  CurrentPage (int32)                     - Current page number
  PageSize (int32)                        - Items per page
  TotalCount (int32)                      - Total number of exposed ports
DataList[] (array):
  Port (int32)                           - Port number
  Protocol (string)                      - Protocol (e.g., tcp)
  RiskLevel (int32)                      - Risk level (0=no risk)
  ServiceNameList (string[])             - Services running on this port
  PublicIpNum (int32)                    - Number of public IPs using this port
  HasAclRecommend (boolean)             - Whether ACL recommendation exists
  RiskReason (string)                   - Risk reason description
  SuggestLevel (string)                 - Suggested action level
  InBytes (int64)                       - Inbound traffic bytes
  OutBytes (int64)                      - Outbound traffic bytes
  TotalBytes (int64)                    - Total traffic bytes

---

2. Asset Protection

2.1 DescribeAssetList

Description: Query detailed information about each asset (IP) protected by Cloud Firewall, including firewall status, risk level, resource type, and discovery time. Paginated.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total number of assets
Assets[] (array of objects):
  InternetAddress (string)                - Public IP address
  IntranetAddress (string)                - Private IP address
  Name (string)                           - Instance name
  ResourceInstanceId (string)             - Instance ID
  BindInstanceId (string)                 - Bound instance ID
  BindInstanceName (string)               - Bound instance name
  ResourceType (string)                   - Asset type (EcsEIP, SlbEIP, etc.)
  ProtectStatus (string)                  - Firewall status: open/opening/closed/closing
  RegionID (string)                       - Region ID
  IpVersion (int32)                       - IP version (4 or 6)
  SgStatus (string)                       - Security group policy status
  MemberUid (int64)                       - Member account UID
  SyncStatus (string)                     - Traffic redirection support: enable/disable
  RegionStatus (string)                   - Region support: enable/disable
  RiskLevel (string)                      - Risk level: low/middle/hight
  CreateTimeStamp (string)                - Discovery time (format: "2026-03-17 11:18:52")
  NewResourceTag (string)                 - New discovery tag
  Last7DayOutTrafficBytes (int64)         - Outbound traffic in last 7 days

2.2 DescribeAssetRiskList

Description: Query detailed risk reasons for specific IP addresses. Accepts a list of IPs (max 20 per call) and returns per-IP risk assessment.

Parameters:

Key Response Fields:

AssetList[] (array of objects):
  Ip (string)                             - IP address
  RiskLevel (string)                      - Risk level: high/middle/low
  Reason (string)                         - Risk reason description

---

3. Vulnerability & Attack

3.1 DescribeVulnerabilityProtectedList

Description: Query vulnerability protection coverage — lists vulnerabilities with their protection status, attack counts, and whether rules/patches need to be enabled. Paginated.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total vulnerability count
VulnList[] (array of objects):
  VulnName (string)                       - Vulnerability name
  VulnLevel (string)                      - Vulnerability level: high/medium/low
  VulnStatus (string)                     - Protection status
  CveId (string)                          - CVE identifier
  AttackCnt (int32)                       - Number of attack attempts
  ResourceCnt (int32)                     - Number of affected resources
  NeedOpenBasicRule (boolean)            - Whether basic rules need to be enabled
  NeedOpenVirtualPatche (boolean)        - Whether virtual patches need to be enabled
  NeedOpenRunMode (int32)                - Required IPS run mode
  NeedRuleClass (int32)                  - Required rule class
  HighlightTag (int32)                   - Highlight tag

3.2 DescribeRiskEventGroup

Description: Query intrusion detection event groups — aggregated attack events with source/destination, attack type, and geographic information. Paginated.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total event group count
DataList[] (array of objects):
  EventName (string)                      - Event name (e.g., "Trin00 password attempt")
  EventCount (int32)                      - Number of events in group
  SrcIP (string)                          - Source IP address
  DstIP (string)                          - Destination IP address
  AttackType (int32)                      - Attack type code
  AttackApp (string)                      - Attack application (e.g., "Host")
  VulLevel (int32)                        - Vulnerability level: 1=low, 2=medium, 3=high
  RuleResult (int32)                      - Action result: 1=observe, 2=block
  Direction (string)                      - Direction: in/out
  Description (string)                    - Event description
  ResourcePrivateIPList[] (array):        - Attacked private resources
    ResourcePrivateIP (string)            - Private IP
    ResourceInstanceId (string)           - Instance ID
    ResourceInstanceName (string)         - Instance name
    ResourceType (string)                 - Resource type
  IPLocationInfo (object):                - Source geographic location
    CountryName (string)                  - Country name
    CityName (string)                     - City name
    CountryId (string)                    - Country ID
    CityId (string)                       - City ID
  FirstEventTime (int64)                  - First event timestamp (seconds)
  LastEventTime (int64)                   - Last event timestamp (seconds)
  ResourceType (string)                   - Attacked resource type
  Tag (string)                            - Event tag
  RuleSource (int32)                      - Rule source
  SrcPrivateIPList[] (string[])           - Source private IP list

---

4. ACL Policy

4.1 DescribeControlPolicy

Description: Query internet border access control (ACL) policies — lists firewall rules with source/destination, ports, actions, and hit counts. Paginated.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total policy count
Policys[] (array of objects):
  AclUuid (string)                        - ACL rule UUID
  Source (string)                         - Source address/CIDR
  SourceType (string)                    - Source type: net/group/location
  Destination (string)                   - Destination address/CIDR
  DestinationType (string)              - Destination type: net/group/domain/location
  DestPort (string)                      - Destination port or port range
  DestPortType (string)                 - Port type: port/group
  Proto (string)                         - Protocol: TCP/UDP/ICMP/ANY
  AclAction (string)                     - Action: accept/drop/log
  HitTimes (int64)                       - Number of times rule was hit
  HitLastTime (int64)                    - Last hit timestamp (seconds)
  Release (string)                       - Whether rule is enabled: true/false
  Order (int32)                          - Rule priority order
  Direction (string)                     - Direction: in/out
  Description (string)                   - Rule description
  ApplicationNameList[] (string[])       - Application name list
  CreateTime (int64)                     - Rule creation timestamp
  ModifyTime (int64)                     - Last modification timestamp
  MemberUid (string)                     - Member account UID

---

Summary: APIs Needed for Exposure Detection Skill

API Endpoint Format

All Cloudfw APIs use the RPC style:

POST https://cloudfw.cn-hangzhou.aliyuncs.com/
  ?Action=DescribeInternetOpenStatistic
  &Version=2017-12-07
  &Format=JSON
  &AccessKeyId=<AK>
  &SignatureMethod=HMAC-SHA1
  &Timestamp=<ISO8601>
  &SignatureVersion=1.0
  &SignatureNonce=<random>
  &Signature=<computed>
  &Lang=zh

Or using Aliyun CLI (recommended):

aliyun cloudfw describe-internet-open-statistic \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

Security Warning (MUST READ):

- Never paste real AK/SK values into chat logs, tickets, screenshots, or shared docs.

- Never run credential-setting commands in monitored/shared terminals.

- Configure credentials only in a trusted local shell session.

- Placeholder values below are examples only; do not expose real secrets.

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies - Exposure Detection & Analysis

Required Permissions

The following RAM permissions are required to execute all APIs in this skill:

Minimum RAM Policy

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "yundun-cloudfirewall:DescribeInternetOpenStatistic",
        "yundun-cloudfirewall:DescribeInternetOpenIp",
        "yundun-cloudfirewall:DescribeInternetOpenPort",
        "yundun-cloudfirewall:DescribeAssetList",
        "yundun-cloudfirewall:DescribeAssetRiskList",
        "yundun-cloudfirewall:DescribeVulnerabilityProtectedList",
        "yundun-cloudfirewall:DescribeRiskEventGroup",
        "yundun-cloudfirewall:DescribeControlPolicy"
      ],
      "Resource": "*"
    }
  ]
}

System Policy Alternative

You can also attach the system policy AliyunYundunCloudFirewallReadOnlyAccess which grants read-only access to all Cloud Firewall resources.

Related APIs - Exposure Detection & Analysis

APIs Used in This Skill

API Version

All Cloud Firewall APIs use version: 2017-12-07

Endpoint Format

The CLI resolves endpoints automatically based on the --region flag. Manual endpoint: cloudfw.{regionId}.aliyuncs.com

API Style

All Cloud Firewall APIs use RPC style with POST method. The CLI handles this automatically — no style configuration needed.

Verification Method - Exposure Detection & Analysis

Authentication Pre-check

Before running any API calls, verify CLI credential status using the default credential chain:

aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity). Do not print or handle raw AK/SK values.

How to Verify Skill Execution Success

Step 1: Verify Exposure Statistics Query

Run the following to confirm internet exposure data is available:

aliyun cloudfw describe-internet-open-statistic \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Expected: Response contains exposure statistics including InternetIpNum, InternetPortNum, InternetRiskIpNum, InternetServiceNum. If all values are zero, the service may not be activated or there are no public assets.

Step 2: Verify Exposed IP Query

NOW_TS=$(date +%s)
THIRTY_DAYS_AGO_TS=$(date -d "30 days ago" +%s)

aliyun cloudfw describe-internet-open-ip \
  --CurrentPage 1 \
  --PageSize 10 \
  --StartTime ${THIRTY_DAYS_AGO_TS} \
  --EndTime ${NOW_TS} \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Expected: Response includes DataList array with exposed IP details (PublicIp, RiskLevel, PortList, ServiceNameList) and PageInfo with TotalCount.

Step 3: Verify Asset List Query

aliyun cloudfw describe-asset-list \
  --CurrentPage 1 \
  --PageSize 10 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Expected: Response includes Assets array with asset details (InternetAddress, ProtectStatus, ResourceType, RiskLevel) and TotalCount.

Step 4: Verify Default IPS Config Query

aliyun cloudfw describe-default-ips-config \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Expected: Response contains IPS configuration status including BasicRules, EnableAllPatch, RunMode fields.

Step 5: Verify Vulnerability Protection Query

SEVEN_DAYS_AGO_TS=$(date -d "7 days ago" +%s)
NOW_TS=$(date +%s)

aliyun cloudfw describe-vulnerability-protected-list \
  --CurrentPage 1 \
  --PageSize 10 \
  --StartTime ${SEVEN_DAYS_AGO_TS} \
  --EndTime ${NOW_TS} \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Expected: Response includes VulnList array with vulnerability details (VulnName, VulnLevel, VulnStatus, CveId, AttackCnt).

Step 6: Verify Control Policy Query

aliyun cloudfw describe-control-policy \
  --Direction in \
  --CurrentPage 1 \
  --PageSize 10 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-exposure-detection

Expected: Response includes Policys array with ACL rules (Source, Destination, DestPort, Proto, AclAction, HitTimes).

Common Errors