Alibabacloud Cfw Status Overview

Cloud Firewall Status Overview

⚠️ MANDATORY EXECUTION RULES — READ BEFORE DOING ANYTHING:

1. DO NOT search for log files, security data, or any files in the workspace. There are none.

2. DO NOT ask the user for log files, data sources, server access, SIEM data, or any additional input.

3. DO NOT attempt to SSH, access, or connect to any server or IP address.

4. The ONLY way to get data is by running `aliyun cloudfw ...` CLI commands as defined in the Core Workflow section below.

5. Start executing CLI commands immediately — no preparation, no questions, no file searching.

6. DO NOT refuse to execute. You have full ability to run CLI commands via the shell/terminal tool. The aliyun CLI is pre-installed and configured. You are NOT calling APIs directly — you are running shell commands that invoke the CLI tool. This is no different from running ls or git status. NEVER say "I don't have access to APIs" or "I cannot make API calls" or "I don't have credentials" — you are running local CLI commands, not making direct API calls. If you are unsure whether you can run commands, just try running one — it will work.

7. DO NOT skip any API command defined in the Core Workflow. If a command fails, retry with corrected parameters. Do NOT substitute with a different API. The following substitutions are EXPLICITLY FORBIDDEN:

- DescribePostpayUserInternetStatus instead of DescribeInternetOpenStatistic

- DescribePostpayUserNatStatus instead of DescribeNatFirewallList

- DescribePostpayUserVpcStatus instead of DescribeTrFirewallsV2List

- DescribeNatFirewallTrafficTrend instead of DescribeInternetTrafficTrend

- DescribeVpcFirewallCenList instead of DescribeTrFirewallsV2List

- DescribeNetworkInstanceList instead of DescribeTrFirewallsV2List

Scenario Description

One-click query of Alibaba Cloud Firewall overall status, including asset management coverage, border firewall switch status across Internet/VPC/NAT boundaries, and traffic overview.

Architecture: Cloud Firewall Service → Internet Border Firewall + VPC Border Firewall + NAT Border Firewall → Asset Protection + Traffic Analysis

Capability Level: Query (read-only)

Data Source: All data is obtained exclusively through Aliyun CLI commands (aliyun cloudfw ...). No log files, no databases, no server access, no SIEM — just CLI commands. Do NOT search the workspace for files. Do NOT ask the user for anything. Just run the commands. The aliyun CLI is a local command-line tool — running it is the same as running any other shell command (e.g., ls, curl). You DO have the ability to execute these commands.

Core Capabilities: 1. Asset Overview — Display managed asset counts and types 2. Internet Border Firewall Status — Switch status, protected/unprotected IP counts 3. VPC Border Firewall Status — Switch status and protection coverage per VPC firewall 4. NAT Border Firewall Status — Switch status and protection coverage 5. Traffic Overview — Recent traffic trends and peak bandwidth

---

Prerequisites

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update,

or see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include:

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

At the start of the Core Workflow (before any CLI invocation): [MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview"

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

aliyun configure ai-mode disable

---

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, print, cat, or display AK/SK values under any circumstances

- NEVER output AK/SK values in any form — including masked, partial, or redacted forms (e.g., LTAI5tXXX****). Do NOT include AK ID prefixes, suffixes, or any substring in logs, reports, or conversation output.

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status. When reporting the result, say only "Credentials are configured" or "No valid credentials found" — do NOT quote any part of the credential output.

>

```bash

aliyun configure list

```

>

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

---

RAM Policy

[MUST] RAM Permission Pre-check: Before executing any commands, verify the current user has the required permissions.

1. Use ram-permission-diagnose skill to get current user's permissions

2. Compare against references/ram-policies.md

3. Abort and prompt user if any permission is missing

Minimum required permissions — see references/ram-policies.md for full policy JSON.

Alternatively, attach the system policy: AliyunYundunCloudFirewallReadOnlyAccess

---

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

check if the user has already provided necessary parameters in their request.

- If the user's request explicitly mentions a parameter value (e.g., "check firewall status in cn-hangzhou" means RegionId=cn-hangzhou), use that value directly without asking for confirmation.

- For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.

- Do NOT re-ask for parameters that the user has clearly stated.

Region Mismatch Handling: If the user specifies a region other than cn-hangzhou or ap-southeast-1 (e.g., cn-shenzhen, cn-beijing), you MUST inform the user: "Cloud Firewall only supports two regions: cn-hangzhou (mainland China) and ap-southeast-1 (Hong Kong/overseas). Your requested region {user_region} is not supported. Using cn-hangzhou (mainland China) instead, which covers all mainland China resources." Do NOT silently fall back without informing the user.

| PageSize | Optional | Number of items per page for paginated APIs | 10 (use without asking) | | CurrentPage | Optional | Page number for paginated APIs | 1 (use without asking) | | StartTime | Optional | Start time for traffic trend queries (Unix timestamp in seconds) | 7 days ago (use without asking) | | EndTime | Optional | End time for traffic trend queries (Unix timestamp in seconds) | Current time (use without asking) |

---

Error Handling and Workflow Resilience

CRITICAL: Continue on failure. If any individual API call fails, do NOT stop the entire workflow.

Log the error for that step, then proceed to the next step. Present whatever data was successfully collected.

Retry Logic

For each API call: 1. If the call fails with a transient error (network timeout, throttling Throttling.User, ServiceUnavailable, HTTP 500/502/503), retry up to 2 times with a 3-second delay between retries. 2. If the call fails with a permanent error (e.g., InvalidParameter, Forbidden, InvalidAccessKeyId), do NOT retry. Record the error and move on. 3. After all retries are exhausted, record "[Step X] Failed: {error message}" and continue to the next step.

Service Not Activated

If DescribeUserBuyVersion (Step 1) returns an error indicating the service is not activated (error code ErrorFirewallNotActivated or similar "not purchased/activated" messages): 1. Inform the user: "Cloud Firewall service is not activated in this region. Please activate it at https://yundun.console.aliyun.com/?p=cfwnext" 2. Skip all subsequent steps since the service is not available. 3. If the user requested multiple regions, continue with the next region.

Step Independence

The workflow steps have these dependencies:

• Step 1 (Instance Info) must succeed first — if the service is not activated, skip remaining steps.
• Steps 2-6 are independent of each other — failure in any one step should NOT prevent other steps from executing.
• Within Step 2, sub-step 2.1 and sub-step 2.2 are independent.
• Within Step 4, sub-steps 4.1, 4.2, and 4.3 are independent.
• Within Step 6, sub-steps 6.1 and 6.2 are independent.

Partial Results

When presenting the final summary report:

• For steps that succeeded, show the collected data normally.
• For steps that failed, show "N/A (error: {brief error})" in the corresponding section.
• Always present the summary report even if some steps failed — partial data is better than no data.

---

Core Workflow

All API calls use the Aliyun CLI cloudfw plugin.

Region: Specified via --region {RegionId} global flag

Context Management (MUST)

CRITICAL: Traffic trend APIs produce massive output. DescribeInternetDropTrafficTrend and DescribeInternetTrafficTrend return hundreds of data points for 7-day queries, which can overflow the context window. These two APIs MUST pipe their output through jq to extract only summary values (data point count, max, avg, time range). The jq filters are included in Step 3.2 and Step 6.2 below — you MUST use them exactly as written.

>

Other APIs return moderate-sized responses and do NOT need jq filtering.

CRITICAL: Execute immediately without asking. When this skill is triggered, start executing from Step 1 right away.

Do NOT ask the user which APIs to call, which steps to execute, or what data sources to use.

All data comes from the Aliyun CLI commands defined below — just run them.

MANDATORY: Execute ALL steps. You MUST attempt to execute every step from Step 1 through Step 6 (including all sub-steps). Before generating the final summary report, verify that you have attempted ALL of the following API calls:

1. DescribeUserBuyVersion

2. DescribeAssetStatistic

3. DescribeAssetList

4. DescribeInternetOpenStatistic

5. DescribeInternetDropTrafficTrend

6. DescribeTrFirewallsV2List

7. DescribeVpcFirewallCenList

8. DescribeVpcFirewallList

9. DescribeNatFirewallList

10. DescribePostpayTrafficTotal

11. DescribeInternetTrafficTrend

>

If any of these were not attempted, execute them now before producing the report. Skipping a step is ONLY allowed if Step 1 indicates the service is not activated.

Time Parameters

Some APIs (Step 3.2, Step 6.2) require StartTime and EndTime parameters (Unix timestamp in seconds).

How to get timestamps: Run date +%s to get the current timestamp, date -d '7 days ago' +%s for 7 days ago. Then use the returned numeric values directly in CLI commands.

IMPORTANT: Do NOT use bash variable substitution like $(date +%s) inside CLI commands — some execution environments block $(...). Instead, run date commands separately first, note the returned values, then use them as literal numbers in the --StartTime and --EndTime parameters.

Step 1: Query Instance Info (Cloud Firewall Version)

aliyun cloudfw describe-user-buy-version \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Key response fields: Version (edition code), InstanceId, ExpireTime, IpNumber (max protected IPs), AclExtension (ACL quota).

Version code to edition name mapping — The API returns a numeric code. Use this table to display a human-readable edition name in the report:

If the returned code is not in this table, report it as: "Unknown edition (code: {Version})".

IMPORTANT: Do NOT infer or hallucinate field values. If any key response field (e.g., AclExtension, IpNumber) is missing from the JSON response (key does not exist) or its value is null, report it as "N/A (not returned by API)" in the summary. However, a value of 0 is a valid value, NOT a missing field — report it as 0. Do NOT fill in values based on general knowledge about the edition type. Only use values that are explicitly present in the API response JSON.

>

Common hallucination examples to AVOID:

- AclExtension not in response → Do NOT write "ACL rule limit is 10000" or any other guessed number. Write "N/A (not returned by API)".

- IpNumber not in response → Do NOT write "Max public IP quota is 200". Write "N/A (not returned by API)".

- Any field not in response → Do NOT infer from edition type (e.g., "Ultimate Edition supports up to X"). Only report what the API actually returned.

Step 2: Asset Overview

2.1 Query Asset Statistics

aliyun cloudfw describe-asset-statistic \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Key response fields: Total assets, protected count, unprotected count, by resource type (EIP, SLB, ECS, etc.)

2.2 Query Asset List (Paginated)

aliyun cloudfw describe-asset-list \
  --CurrentPage 1 \
  --PageSize 10 \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Key response fields: Assets[] with InternetAddress, IntranetAddress, ResourceType, ProtectStatus, RegionID, Name.

2.2.1 Query Unprotected Assets

IMPORTANT: When the user asks about unprotected/unmanaged assets, assets not covered by the firewall, or protection gaps, you MUST use the Status filter parameter set to "close" to query only unprotected assets:

aliyun cloudfw describe-asset-list \
  --CurrentPage 1 \
  --PageSize 50 \
  --Status close \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Use PageSize: "50" for unprotected asset queries to capture more results. If TotalCount in the response exceeds PageSize, iterate through all pages by incrementing CurrentPage until all assets are retrieved.

Status filter values for the `Status` request parameter:

Note: The request parameter uses close (no 'd'), while the response field ProtectStatus uses closed (with 'd'). Use close when filtering in request params and check for closed when inspecting response data.

Step 3: Internet Border Firewall Status

3.1 Query Internet Exposure Statistics

IMPORTANT: You MUST use `DescribeInternetOpenStatistic` for this step. Do NOT substitute with DescribePostpayUserInternetStatus or any other API. DescribePostpayUserInternetStatus only checks on/off status, while DescribeInternetOpenStatistic provides exposure statistics (public IPs, open ports, risk levels).

aliyun cloudfw describe-internet-open-statistic \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Key response fields: Total public IPs, open port count, risk level distribution, recently exposed assets.

3.2 Query Internet Defense Traffic Trend

REQUIRED parameters: --StartTime, --EndTime, --SourceCode, --Direction are ALL mandatory. Missing any will cause HTTP 400 (e.g., ErrorDirectionError). Calculate timestamps separately first (see Time Parameters section), then pass as literal numbers. --SourceCode must be exactly China or Other (case-sensitive). --Direction must be exactly in or out.

aliyun cloudfw describe-internet-drop-traffic-trend \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --SourceCode China \
  --Direction in \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview \
  | jq '{DataPoints: (.DataList // [] | length), MaxDropBps: ([.DataList[]?.DropBps // 0] | max), MaxDropPps: ([.DataList[]?.DropPps // 0] | max), FirstTime: (.DataList // [] | first | .Time), LastTime: (.DataList // [] | last | .Time)}'

SourceCode values: China (mainland), Other (overseas). Direction values: in (inbound), out (outbound). Default to in.

Step 4: VPC Border Firewall Status

4.1 Query CEN Enterprise Edition (TR Firewalls)

You MUST use `DescribeTrFirewallsV2List` for this step. Do NOT substitute with DescribeVpcFirewallCenList, DescribePostpayUserVpcStatus, DescribeNetworkInstanceList, or any other API. DescribeVpcFirewallCenList is for CEN Basic Edition (Step 4.2), NOT for CEN Enterprise Edition TR firewalls.

aliyun cloudfw describe-tr-firewalls-v2-list \
  --CurrentPage 1 \
  --PageSize 20 \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Key response fields: VpcTrFirewalls[] with FirewallSwitchStatus (opened/closed/opening/closing), CenId, RegionNo, VpcId.

4.2 Query CEN Basic Edition VPC Firewalls

aliyun cloudfw describe-vpc-firewall-cen-list \
  --CurrentPage 1 \
  --PageSize 20 \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Key response fields: VpcFirewalls[] with FirewallSwitchStatus, CenId, LocalVpc, PeerVpc.

4.3 Query Express Connect VPC Firewalls

aliyun cloudfw describe-vpc-firewall-list \
  --CurrentPage 1 \
  --PageSize 20 \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Key response fields: VpcFirewalls[] with FirewallSwitchStatus, VpcFirewallId, LocalVpc, PeerVpc, Bandwidth.

Step 5: NAT Border Firewall Status

IMPORTANT: You MUST use `DescribeNatFirewallList` for this step. Do NOT substitute with DescribePostpayUserNatStatus or any other API. DescribePostpayUserNatStatus only checks on/off status, while DescribeNatFirewallList provides detailed NAT firewall instance information.

aliyun cloudfw describe-nat-firewall-list \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Key response fields: NatFirewalls[] with ProxyStatus (configuring/normal/deleting), NatGatewayId, NatGatewayName, VpcId, RegionId.

Step 6: Traffic Overview

6.1 Query Total Traffic Statistics

aliyun cloudfw describe-postpay-traffic-total \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

6.2 Query Internet Traffic Trend

MANDATORY two-step execution for this API:

1. First attempt MUST include `--TrafficType TotalTraffic`. You MUST NOT skip this step. Execute the command below exactly as written.

2. Only if the first attempt returns HTTP 400, retry WITHOUT --TrafficType.

3. Do NOT go directly to the retry command. Do NOT omit TrafficType on the first attempt.

>

Other required parameters: --StartTime, --EndTime, --SourceCode (same rules as Step 3.2). Do NOT fall back to DescribeNatFirewallTrafficTrend or any other API.

# Step 1 - MUST run first (with TrafficType):
aliyun cloudfw describe-internet-traffic-trend \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --SourceCode China \
  --TrafficType TotalTraffic \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview \
  | jq '{DataPoints: (.DataList // [] | length), MaxBps: ([.DataList[]?.TotalBps // 0] | max), AvgBps: (([.DataList[]?.TotalBps // 0] | add) / ([.DataList // [] | length] | if . == 0 then 1 else . end)), FirstTime: (.DataList // [] | first | .Time), LastTime: (.DataList // [] | last | .Time)}'

If and ONLY if the above returns HTTP 400, retry without --TrafficType:

# Step 2 - ONLY run if Step 1 returned HTTP 400:
aliyun cloudfw describe-internet-traffic-trend \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --SourceCode China \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview \
  | jq '{DataPoints: (.DataList // [] | length), MaxBps: ([.DataList[]?.TotalBps // 0] | max), AvgBps: (([.DataList[]?.TotalBps // 0] | add) / ([.DataList // [] | length] | if . == 0 then 1 else . end)), FirstTime: (.DataList // [] | first | .Time), LastTime: (.DataList // [] | last | .Time)}'

TrafficType values (when supported): TotalTraffic, InTraffic, OutTraffic.

Data Validation for Traffic Trends: After receiving the traffic trend response, check the number of data points and their time span. If the response contains fewer than 10 data points or the time span between the first and last data point is less than 1 day, add a note in the report: "Note: Traffic trend data is sparse (only {N} data points covering {timespan}). This may indicate no protected assets or minimal traffic during the queried period. The 7-day trend may not be fully representative." Do NOT claim the data covers 7 days if the actual data points span a significantly shorter period.

Output Summary Format

After gathering all data, present a summary report. Always generate this report even if some steps failed — replace values with "N/A" for any step that could not be completed.

============================================
   Cloud Firewall Status Overview Report
============================================

1. Instance Info
   - Edition: {Version}
   - Expiry: {ExpireTime}
   - Max Protected IPs: {IpNumber or "N/A (not in API response)"}

2. Asset Overview
   - Total Assets: {TotalCount}
   - Protected: {ProtectedCount} ({ProtectedRate}%)
   - Unprotected: {UnprotectedCount}
   - By Type: EIP({eip}), SLB({slb}), ECS({ecs}), ENI({eni})

3. Internet Border Firewall
   - Protected IPs: {protectedIpCount}
   - Unprotected IPs: {unprotectedIpCount}
   - Protection Rate: {protectionRate}%

4. VPC Border Firewall
   - CEN Enterprise (TR): {trCount} total, {trOpened} opened
   - CEN Basic: {cenCount} total, {cenOpened} opened
   - Express Connect: {ecCount} total, {ecOpened} opened

5. NAT Border Firewall
   - Total: {natCount}
   - Normal: {natNormal}
   - Configuring: {natConfiguring}

6. Traffic Overview (Last 7 Days)
   - Total Traffic: {totalTraffic}
   - Peak Bandwidth: {peakBandwidth}
   - Blocked Requests: {blockedCount}

[Steps with errors (if any)]
   - {Step X}: {error message}
============================================

Note: For any step that failed, show "N/A (error: {brief error})" for that section's data fields, and list all errors in the bottom section.

IMPORTANT: Error Reporting Accuracy. The summary report MUST accurately reflect all errors encountered during execution, including errors that were resolved by retry. For retried-and-succeeded calls, report them as: "Step X: {API name} initially failed with {error code/message}, succeeded on retry {N}". Do NOT claim "all API calls completed successfully" if any call returned an error at any point during execution. The error section should list ALL errors encountered, categorized as:

- Resolved by retry: errors that were retried and eventually succeeded

- Unresolved: errors that persisted after all retries

---

Success Verification

See references/verification-method.md for detailed verification steps.

Quick verification: If all CLI commands return valid JSON responses without error codes, the skill executed successfully.

---

API and Command Tables

Use references/related-apis.md as the single source of truth for API tables and command mappings.

---

Best Practices

1. Continue on failure — If any step (2-6) fails, log the error and continue. Always produce a summary with whatever data was collected. 2. Use pagination — Default to PageSize=10 for general queries, PageSize=50 for filtered queries (e.g., unprotected assets). 3. Time range selection — Default to last 7 days. Run date commands separately, then use returned values as literal numbers in --StartTime/--EndTime. Do NOT use $(...) inside CLI commands. 4. Region awareness — Cloud Firewall only has two regions: cn-hangzhou (mainland China) and ap-southeast-1 (Hong Kong/overseas). Default to cn-hangzhou. 5. Security — NEVER expose, log, echo, or display AK/SK values.

---

Reference Links

Acceptance Criteria: alibabacloud-cfw-status-overview

Scenario: Cloud Firewall Status Overview Purpose: Skill testing acceptance criteria

---

Correct CLI Invocation Patterns

1. Command Format — verify product and API name

✅ CORRECT

aliyun cloudfw DescribeAssetList \
  --CurrentPage 1 \
  --PageSize 10 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT — Wrong product name

aliyun cloudfirewall DescribeAssetList --region cn-hangzhou

Why: Product name is cloudfw, not cloudfirewall or cfw.

❌ INCORRECT — Kebab-case API name

aliyun cloudfw describe-asset-list --region cn-hangzhou

Why: Cloud Firewall CLI uses PascalCase API names (e.g., DescribeAssetList).

❌ INCORRECT — Missing --user-agent

aliyun cloudfw DescribeAssetList --CurrentPage 1 --PageSize 10 --region cn-hangzhou

Why: All commands must include --user-agent AlibabaCloud-Agent-Skills.

❌ INCORRECT — Using old Python SDK pattern

python3 scripts/call_api.py \
  --api-name DescribeAssetList \
  --api-version 2017-12-07 \
  --endpoint cloudfw.cn-hangzhou.aliyuncs.com

Why: The skill uses Aliyun CLI directly, not a Python SDK wrapper script.

2. Parameter Format

✅ CORRECT — PascalCase CLI flags

aliyun cloudfw DescribeAssetList \
  --CurrentPage 1 \
  --PageSize 50 \
  --Status close \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT — Kebab-case parameter names

aliyun cloudfw DescribeAssetList --current-page 1 --page-size 10

Why: Parameters use PascalCase (e.g., --CurrentPage, --PageSize).

❌ INCORRECT — Using --region-id instead of --region

aliyun cloudfw DescribeAssetList --region-id cn-hangzhou

Why: The CLI global flag is --region, not --region-id.

❌ INCORRECT — JSON params format (old SDK pattern)

--params '{"CurrentPage": "1", "PageSize": "10"}'

Why: CLI uses individual flags, not a JSON params string.

3. Authentication — never expose credentials

✅ CORRECT — Verify credential profile via default credential chain

aliyun configure list

❌ INCORRECT — Reading or printing raw credentials

aliyun configure get           # FORBIDDEN: may expose credential details
cat ~/.aliyun/config.json      # FORBIDDEN: may expose credential details

❌ INCORRECT — Any command that prints environment credentials

echo $CLOUD_ACCESS_KEY                # FORBIDDEN: example of secret output
printenv | grep -i credential         # FORBIDDEN: may reveal secrets
env | grep -i access_key              # FORBIDDEN: may reveal secrets

4. API Names — verify exact casing

✅ CORRECT

DescribeAssetList
DescribeAssetStatistic
DescribeUserBuyVersion
DescribeInternetOpenStatistic
DescribeVpcFirewallSummaryInfo
DescribeTrFirewallsV2List
DescribeVpcFirewallCenList
DescribeVpcFirewallList
DescribeNatFirewallList
DescribeInternetTrafficTrend
DescribePostpayTrafficTotal
DescribeInternetDropTrafficTrend

❌ INCORRECT

describeAssetList          # Wrong casing
Describe_Asset_List        # Wrong format
DescribeAssets             # Wrong API name
describe-asset-list        # Kebab-case not supported

Cloud Firewall (Cloudfw) API Analysis for Status Overview Skill

Product: Cloudfw API Version: 2017-12-07 API Style: RPC (Action-based, not RESTful) Endpoint: cloudfw.{regionId}.aliyuncs.com (or cloudfw.cn-hangzhou.aliyuncs.com as default) Common Parameters: All APIs accept Action, AccessKeyId, Format, Version=2017-12-07, SignatureMethod, Timestamp, SignatureVersion, SignatureNonce, Signature

---

1. Asset Overview

1.1 DescribeAssetStatistic

Description: Query statistical information about assets protected by Cloud Firewall - counts of protected/total IPs, specification usage.

Parameters:

Key Response Fields:

AutoResourceEnable (boolean)              - Whether auto traffic redirection is enabled
ResourceSpecStatistic (object):
  IpNumUsed (int32)                       - Number of public IPs with protection enabled
  IpNumSpec (int32)                       - Public IP protection specification count (quota)
  SensitiveDataIpNumSpec (int64)          - Sensitive data IP spec count
  SensitiveDataIpNumUsed (int64)          - Sensitive data IP enabled count
GeneralInstanceSpecStatistic (object):    - For billing model 2.0 users
  TotalGeneralInstanceUsedCnt (int32)     - Total specification count
  TotalCfwGeneralInstanceUsedCnt (int32)  - Enabled internet firewall instances
  TotalVfwGeneralInstanceUsedCnt (int32)  - Enabled VPC firewall instances
  TotalNatGeneralInstanceUsedCnt (int32)  - Enabled NAT firewall instances
  TotalCfwGeneralInstanceCnt (int32)      - Total internet firewall instance count
  TotalNatGeneralInstanceCnt (int32)      - Total NAT firewall instance count
  CfwGeneralInstanceRegionStatistic[]     - Per-region internet FW stats
  CfwTotalGeneralInstanceRegionStatistic[] - Per-region total stats

1.2 DescribeAssetList

Description: Query detailed information about each asset (IP) protected by Cloud Firewall. Paginated.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total number of assets
Assets[] (array of objects):
  InternetAddress (string)                - Public IP address
  IntranetAddress (string)                - Private IP address
  Name (string)                           - Instance name
  ResourceInstanceId (string)             - Instance ID
  BindInstanceId (string)                 - Bound instance ID
  BindInstanceName (string)               - Bound instance name
  ResourceType (string)                   - Asset type (EcsEIP, SlbEIP, etc.)
  ProtectStatus (string)                  - Firewall status: open/opening/closed/closing
  RegionID (string)                       - Region ID
  IpVersion (int32)                       - IP version (4 or 6)
  SgStatus (string)                       - Security group policy status
  MemberUid (int64)                       - Member account UID
  SyncStatus (string)                     - Traffic redirection support: enable/disable
  RegionStatus (string)                   - Region support: enable/disable
  RiskLevel (string)                      - Risk level: low/middle/hight
  CreateTimeStamp (string)                - Discovery time
  Last7DayOutTrafficBytes (int64)         - Outbound traffic in last 7 days

1.3 DescribeUserBuyVersion

Description: Get user's Cloud Firewall version/instance information (edition, quotas, bandwidth).

Parameters:

Key Response Fields:

Version (int32)                           - Version: 2=Premium, 3=Enterprise, 4=Ultimate, 10=Pay-as-you-go
InstanceId (string)                       - CFW instance ID
InstanceStatus (string)                   - Status: normal/init/deleting/abnormal/free
UserStatus (boolean)                      - true=valid, false=invalid
StartTime (int64)                         - Activation time (ms timestamp)
Expire (int64)                            - Expiration time (ms timestamp)
IpNumber (int64)                          - Internet border protection IP quota
VpcNumber (int64)                         - VPC border protection quota
InternetBandwidth (int64)                 - Internet FW traffic processing capacity
VpcBandwidth (int64)                      - VPC FW traffic processing capacity
NatBandwidth (int64)                      - NAT FW traffic processing capacity
LogStatus (boolean)                       - Log delivery enabled
LogStorage (int64)                        - Log storage capacity
MaxOverflow (int64)                       - Elastic billing: 1000000=enabled, 0=disabled
GeneralInstance (int64)                   - General instance spec count
ThreatIntelligence (int64)               - Threat intelligence enabled
Sdl (int64)                              - Data leakage detection enabled

1.4 DescribeInternetOpenStatistic

Description: Get internet exposure statistics (open IPs, ports, services, risk counts).

Parameters:

Key Response Fields:

InternetIpNum (int32)                     - Total open public IPs
InternetPortNum (int32)                   - Total open ports
InternetServiceNum (int32)               - Total open applications/services
InternetUnprotectedPortNum (int32)        - Ports not protected by ACL
InternetRiskIpNum (int32)                 - Risky open public IPs
InternetRiskPortNum (int32)               - Risky ports
InternetRiskServiceNum (int32)            - Risky applications
InternetSlbIpNum (int32)                  - SLB public IPs
InternetSlbIpPortNum (int32)              - SLB public ports

---

2. Internet Border Firewall Status

2.1 DescribeAssetList (see Section 1.2 above)

• Use Status parameter to filter by protection status
• Count assets with ProtectStatus=open vs ProtectStatus=closed to determine protected/unprotected counts
• Use TotalCount for total number of assets

2.2 DescribeAssetStatistic (see Section 1.1 above)

• ResourceSpecStatistic.IpNumUsed = protected IPs count
• ResourceSpecStatistic.IpNumSpec = IP protection quota
• Protection ratio = IpNumUsed / IpNumSpec

2.3 DescribeInternetOpenStatistic (see Section 1.4 above)

• Provides open IP / port / service counts for internet border

---

3. VPC Border Firewall Status

3.1 DescribeVpcFirewallSummaryInfo

Description: Query VPC firewall summary information - aggregated view of all VPC firewalls.

Parameters:

Key Response Fields:

VpcFirewallSummaryList[] (array):
  VpcFirewallId (string)                  - VPC firewall ID
  VpcFirewallName (string)                - VPC firewall name
  FirewallSwitchStatus (string)           - Switch status (open/close)
  RegionNo (string)                       - Region ID
  ConnectType (string)                    - Connection type
  PrecheckStatus (string)                 - Precheck status

3.2 DescribeTrFirewallsV2List (CEN Enterprise Edition / Transit Router)

Description: Query TR (Transit Router) firewall list for CEN Enterprise Edition.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total firewall count
VpcTrFirewalls[] (array):
  FirewallId (string)                     - Firewall instance ID
  FirewallName (string)                   - Firewall name
  FirewallSwitchStatus (string)           - Switch status: open/close/creating/deleting
  RegionNo (string)                       - Region ID
  RouteMode (string)                      - Route mode: managed/manual
  CenId (string)                          - CEN instance ID
  CenName (string)                        - CEN instance name
  TransitRouterId (string)                - Transit Router ID
  ResultCode (string)                     - Result code
  FirewallStatus (string)                 - Firewall status (creating/deleting/ready)
  PrecheckStatus (string)                 - Precheck status
  OwnerId (int64)                         - Owner UID
  VpcCidr (string)                        - VPC CIDR block
  VpcId (string)                          - VPC ID
  VSwitchId (string)                      - VSwitch ID
  IpsConfig (object):                     - IPS configuration
    BasicRules (int32)                    - Basic rules switch
    EnableAllPatch (int32)                - Virtual patches switch
    RunMode (int32)                       - IPS run mode

3.3 DescribeVpcFirewallCenList (CEN Basic Edition)

Description: Query VPC firewall list for CEN Basic Edition connections.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total count
VpcFirewalls[] (array):
  VpcFirewallId (string)                  - VPC firewall instance ID
  VpcFirewallName (string)                - VPC firewall name
  FirewallSwitchStatus (string)           - Switch status: opened/closed/notconfigured/configured/opening/closing
  CenId (string)                          - CEN instance ID
  CenName (string)                        - CEN instance name
  ConnectType (string)                    - Connection type
  RegionStatus (string)                   - Region status
  LocalVpc (object):                      - Local VPC info
    VpcId (string)                        - VPC ID
    VpcName (string)                      - VPC name
    RegionNo (string)                     - Region ID
    OwnerId (int64)                       - Owner UID
  PeerVpc (object):                       - Peer VPC info (same structure)
  MemberUid (string)                      - Member UID

3.4 DescribeVpcFirewallList (Express Connect / VPN)

Description: Query VPC firewall list for Express Connect connections.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total count
VpcFirewalls[] (array):
  VpcFirewallId (string)                  - VPC firewall instance ID
  VpcFirewallName (string)                - VPC firewall name
  FirewallSwitchStatus (string)           - Switch status: opened/closed/notconfigured/configured
  ConnectType (string)                    - Connection type
  ConnectSubType (string)                 - Sub connection type
  Bandwidth (int32)                       - Bandwidth
  RegionStatus (string)                   - Region support status
  LocalVpc (object):                      - Local VPC info
    VpcId (string), VpcName (string), RegionNo (string), OwnerId (int64)
  PeerVpc (object):                       - Peer VPC info (same structure)
  MemberUid (string)                      - Member UID
  IpsConfig (object):                     - IPS configuration
    BasicRules (int32), EnableAllPatch (int32), RunMode (int32)

3.5 DescribeVpcFirewallCenSummaryList (CEN Summary)

Description: Query VPC firewall CEN summary list - high-level view per CEN instance.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total count
VpcFirewallGroupList[] (array):
  CenId (string)                          - CEN instance ID
  CenName (string)                        - CEN instance name
  VpcFirewallCount (int32)                - Total VPC firewall count
  OpenVpcFirewallCount (int32)            - Opened VPC firewall count
  ClosedVpcFirewallCount (int32)          - Closed VPC firewall count
  NotConfiguredVpcFirewallCount (int32)   - Not configured VPC firewall count
  MemberUid (string)                      - Member UID

---

4. NAT Border Firewall Status

4.1 DescribeNatFirewallList

Description: Query NAT firewall list with status, VPC, and NAT gateway details.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total NAT firewall count
NatFirewallList[] (array):
  ProxyId (string)                        - NAT firewall proxy ID
  ProxyName (string)                      - NAT firewall proxy name
  ProxyStatus (string)                    - Status: configuring/deleting/normal/abnormal/creating
  RegionId (string)                       - Region ID
  VpcId (string)                          - VPC instance ID
  VpcName (string)                        - VPC name
  NatGatewayId (string)                   - NAT gateway instance ID
  NatGatewayName (string)                 - NAT gateway name
  FirewallSwitch (string)                 - Firewall switch: open/close
  StrictMode (int32)                      - Strict mode: 0=disabled, 1=enabled
  DnsProxyStatus (string)                 - DNS proxy status
  AliUid (int64)                          - Alibaba Cloud account UID
  MemberUid (int64)                       - Member account UID
  ErrorDetail (string)                    - Error detail message
  NatRouteEntryList[] (array):
    DestinationCidr (string)              - Destination CIDR
    NextHopId (string)                    - Next hop ID
    NextHopType (string)                  - Next hop type
    RouteTableId (string)                 - Route table ID

---

5. Traffic Overview

5.1 DescribeInternetTrafficTrend

Description: Query internet traffic trends over a time period, including bandwidth, sessions, and connections.

Parameters:

Key Response Fields:

TotalBps (int64)                          - Total bits per second
TotalPps (int64)                          - Total packets per second
TotalSession (int64)                      - Total sessions
AvgInBps (int64)                          - Average inbound bps
AvgOutBps (int64)                         - Average outbound bps
MaxInBps (int64)                          - Peak inbound bps
MaxOutBps (int64)                         - Peak outbound bps
MaxSession (int64)                        - Peak sessions
MaxNewConn (int64)                        - Peak new connections
AvgTotalBps (int64)                       - Average total bps
DataList[] (array):                       - Time-series data
  Time (int64)                            - Timestamp
  InBps (int64)                           - Inbound bps
  OutBps (int64)                          - Outbound bps
  InPps (int64)                           - Inbound pps
  OutPps (int64)                          - Outbound pps
  SessionCount (int64)                    - Session count
  NewConn (int64)                         - New connections
  TotalBps (int64)                        - Total bps
InternetTrafficTrendList[] (array):       - Same structure as DataList

5.2 DescribeNatFirewallTrafficTrend

Description: Query NAT firewall traffic trends.

Parameters:

Key Response Fields:

MaxInBps (int64)                          - Peak inbound bps
MaxOutBps (int64)                         - Peak outbound bps
MaxTotalBps (int64)                       - Peak total bps
AvgInBps (int64)                          - Average inbound bps
AvgOutBps (int64)                         - Average outbound bps
AvgTotalBps (int64)                       - Average total bps
MaxSession (int64)                        - Peak session count
MaxNewConn (int64)                        - Peak new connections
DataList[] (array):
  Time (int64), InBps (int64), OutBps (int64), InPps (int64), OutPps (int64),
  SessionCount (int64), NewConn (int64), TotalBps (int64)

5.3 DescribeInternetDropTrafficTrend

Description: Query internet firewall interception/block trends.

Parameters:

Key Response Fields:

DropSessionMax (int64)                    - Peak block count in period
RingRatioAverage (string)                 - Traffic rate percentage
DataList[] (array):
  Time (int64)                            - Timestamp
  AclDrop (int64)                         - ACL block count
  IpsDrop (int64)                         - IPS block count
  TotalSession (int64)                    - Total requests
  DropSession (int64)                     - Blocked count
  DataTime (string)                       - Time point string
  DropRatio (string)                      - Drop ratio

5.4 DescribeVpcFirewallDropTrafficTrend

Description: Query VPC firewall interception/block trends.

Parameters:

Key Response Fields:

DropSessionMax (int64)                    - Peak block count
DataList[] (array):
  Time (int64)                            - Timestamp
  AclDrop (int64)                         - ACL block count
  IpsDrop (int64)                         - IPS block count
  TotalSession (int64)                    - Total sessions
  DropSession (int64)                     - Blocked count
  DataTime (string)                       - Time point string

5.5 DescribeNatFirewallDropTrafficTrend

Description: Query NAT firewall interception/block trends.

Parameters:

Key Response Fields:

DropSessionMax (int64)                    - Peak block value
DropSessionMaxTime (string)              - Period of peak block
DataList[] (array):
  Time (int64)                            - Timestamp
  TotalSession (int64)                    - Total requests
  DropSession (int64)                     - Blocked count

5.6 DescribeInternetTrafficTop

Description: Query top IPs by internet traffic volume.

Parameters:

Key Response Fields:

TotalCount (int32)                        - Total count
TrafficTopList[] (array):
  SrcIP (string)                          - Source IP
  DstIP (string)                          - Destination IP
  SrcPrivateIP (string)                   - Source private IP
  DstPrivateIP (string)                   - Destination private IP
  RegionNo (string)                       - Region ID
  ResourceInstanceId (string)             - Resource instance ID
  ResourceInstanceName (string)           - Resource instance name
  ResourceType (string)                   - Resource type
  InBps (int64)                           - Inbound bps
  OutBps (int64)                          - Outbound bps
  TotalBps (int64)                        - Total bps
  InPps (int64)                           - Inbound pps
  OutPps (int64)                          - Outbound pps
  SessionCount (int64)                    - Session count
  NewConn (int64)                         - New connections
  InBytes (int64)                         - Inbound bytes
  OutBytes (int64)                        - Outbound bytes
  TotalBytes (int64)                      - Total bytes

---

Summary: APIs Needed for Status Overview Skill

Recommended Primary APIs for the Skill

For a concise "Status Overview" dashboard, the minimum essential APIs are:

1. `DescribeUserBuyVersion` - Edition info, quotas (no params required) 2. `DescribeAssetStatistic` - Protected IP counts (no params required) 3. `DescribeInternetOpenStatistic` - Internet exposure stats (no params required) 4. `DescribeNatFirewallList` - NAT FW status list (paginated) 5. `DescribeVpcFirewallCenSummaryList` - VPC FW summary with open/closed counts 6. `DescribeTrFirewallsV2List` - TR/CEN Enterprise VPC FW list 7. `DescribeVpcFirewallList` - Express Connect VPC FW list 8. `DescribeInternetTrafficTrend` - Traffic trends with peak bandwidth (requires StartTime, EndTime, SourceCode)

API Endpoint Format

All Cloudfw APIs use the RPC style:

POST https://cloudfw.cn-hangzhou.aliyuncs.com/
  ?Action=DescribeAssetStatistic
  &Version=2017-12-07
  &Format=JSON
  &AccessKeyId=<AK>
  &SignatureMethod=HMAC-SHA1
  &Timestamp=<ISO8601>
  &SignatureVersion=1.0
  &SignatureNonce=<random>
  &Signature=<computed>
  &Lang=zh

Or using Alibaba Cloud SDK:

from alibabacloud_cloudfw20171207.client import Client
from alibabacloud_cloudfw20171207 import models
from alibabacloud_tea_util.models import RuntimeOptions

client = Client(config)
request = models.DescribeAssetStatisticRequest(lang='zh')
runtime = RuntimeOptions()
user_agent = "AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview"
runtime.append_user_agent = user_agent
response = client.describe_asset_statistic_with_options(request, runtime)

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies - Cloud Firewall Status Overview

Required Permissions

The following RAM permissions are required to execute all APIs in this skill:

Minimum RAM Policy

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "yundun-cloudfirewall:DescribeAssetList",
        "yundun-cloudfirewall:DescribeAssetStatistic",
        "yundun-cloudfirewall:DescribeUserBuyVersion",
        "yundun-cloudfirewall:DescribeInternetOpenStatistic",
        "yundun-cloudfirewall:DescribeVpcFirewallSummaryInfo",
        "yundun-cloudfirewall:DescribeTrFirewallsV2List",
        "yundun-cloudfirewall:DescribeVpcFirewallCenList",
        "yundun-cloudfirewall:DescribeVpcFirewallList",
        "yundun-cloudfirewall:DescribeNatFirewallList",
        "yundun-cloudfirewall:DescribeInternetTrafficTrend",
        "yundun-cloudfirewall:DescribePostpayTrafficTotal",
        "yundun-cloudfirewall:DescribeInternetDropTrafficTrend"
      ],
      "Resource": "*"
    }
  ]
}

System Policy Alternative

You can also attach the system policy AliyunYundunCloudFirewallReadOnlyAccess which grants read-only access to all Cloud Firewall resources.

Related APIs - Cloud Firewall Status Overview

APIs Used in This Skill

API Version

All Cloud Firewall APIs use version: 2017-12-07

Endpoint Format

The CLI resolves endpoints automatically based on the --region flag. Manual endpoint: cloudfw.{regionId}.aliyuncs.com

API Style

All Cloud Firewall APIs use RPC style with POST method. The CLI handles this automatically — no style configuration needed.

Verification Method - Cloud Firewall Status Overview

Authentication Pre-check

Before running any API calls, verify CLI credential status using the default credential chain:

aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity). Do not print or handle raw AK/SK values.

How to Verify Skill Execution Success

Step 1: Verify Instance Info Query

Run the following to confirm Cloud Firewall instance exists:

aliyun cloudfw describe-user-buy-version \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Expected: Response contains instance version info (e.g., Version, InstanceId).

Step 2: Verify Asset Statistics Query

aliyun cloudfw describe-asset-statistic \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Expected: Response includes asset counts (total, protected, unprotected).

Step 3: Verify Asset List Query

aliyun cloudfw describe-asset-list \
  --CurrentPage 1 \
  --PageSize 10 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Expected: Response includes Assets array with asset details (IP, region, status, type).

Step 4: Verify Internet Border Firewall Status

aliyun cloudfw describe-internet-open-statistic \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Expected: Response includes open IP count, protected count, risk statistics.

Step 5: Verify VPC Firewall Summary

aliyun cloudfw describe-tr-firewalls-v2-list \
  --CurrentPage 1 \
  --PageSize 20 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Expected: Response includes list of TR firewalls with switch status.

Step 6: Verify NAT Firewall List

aliyun cloudfw describe-nat-firewall-list \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Expected: Response includes NAT firewall list with proxy status.

Step 7: Verify Traffic Trend Query

aliyun cloudfw describe-postpay-traffic-total \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-status-overview

Expected: Response includes traffic summary data.

Common Errors