Alibabacloud Ddos Security Monitor

DDoS Security Product Inspection & Monitoring

This skill performs security inspection on DDoS security products under an Alibaba Cloud account, entirely through Aliyun CLI direct OpenAPI calls without any scripts or SDKs.

Architecture: antiddos-public (Basic Protection) + ddosbgp (Native Protection) + ddoscoo (Anti-DDoS Pro/Premium) -> CLI OpenAPI -> Inspection Report

Product & API Overview

[MUST] Strict product routing isolation: APIs of the three products MUST NEVER be mixed. NEVER substitute ddoscoo APIs for ddosbgp queries or vice versa. If mixing is detected, abort immediately.

>

[MUST] ddosbgp endpoint routing: ddosbgp describe-instance-list default endpoint does NOT support mainland China Regions. You MUST specify --endpoint ddosbgp.cn-hangzhou.aliyuncs.com for ALL describe-instance-list calls.

>

[MUST] Easily confused API warning:

>

| Scenario | Correct Command | Wrong Command (FORBIDDEN) |

|----------|----------------|--------------------------|

| Native Protection attack events | ddosbgp describe-ddos-event (singular) | ~~ddoscoo describe-ddos-events~~ |

| Anti-DDoS Pro attack events | ddoscoo describe-ddos-events (plural) | ~~ddosbgp describe-ddos-event~~ |

Pre-checks

Aliyun CLI >= 3.3.3 required — see CLI Installation Guide.

Credentials required — see CLI Credential Setup. Run aliyun configure list to verify.

RAM permissions — see RAM Permission Policies.

>

[MUST] Permission Failure Handling: On permission errors: 1) Read references/ram-policies.md 2) Use ram-permission-diagnose skill 3) Pause until user confirms permissions granted.

>

[MUST] AI-Mode lifecycle — Enable before any CLI invocation, disable at EVERY exit point:

```bash

aliyun configure ai-mode enable

aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddos-security-monitor"

```

Parameter Confirmation

IMPORTANT: ALL user-customizable parameters MUST be confirmed with the user before execution.

Region Strategy

[MUST] ddosbgp Region traversal (dynamic + hardcoded fallback):

- Hardcoded baseline (12 Regions, MUST NOT be reduced): cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1

- Dynamic expansion: Call aliyun ddosbgp describe-regions (NOT ECS), union with baseline (only add, never subtract). If dynamic fetch fails, use baseline directly.

- Count validation: Final list >= 12 Regions. ALL must be traversed, NEVER break due to empty/error.

>

antiddos-public: Query from cn-hangzhou only (centralized).

ddoscoo: MUST query both cn-hangzhou + ap-southeast-1.

Core Inspection Workflow

Phase 1: Environment, Credential & Permission Pre-check

# 1.1 Check CLI version + enable AI-Mode
aliyun version
aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddos-security-monitor"

# 1.2 Set global timeout and enable auto plugin install
aliyun configure set --auto-plugin-install true --connect-timeout 10 --read-timeout 30
aliyun plugin update

# 1.3 Check credential configuration
aliyun configure list

# 1.4 Validate permissions (one call per product)
aliyun antiddos-public describe-instance-ip-address \
  --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 1
aliyun ddosbgp describe-instance-list --page-no 1 --page-size 1 --region cn-hangzhou --endpoint ddosbgp.cn-hangzhou.aliyuncs.com
aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region ap-southeast-1

• Normal JSON -> permission OK | Forbidden.RAM / NoPermission -> see RAM Policies

[MUST] Abort rule: If any pre-check fails 3 consecutive times, run aliyun configure ai-mode disable, output error report, and terminate.

Phase 2: Product Inventory Check (Multi-Region Mandatory Traversal)

[MUST] Loop rules: ALL Regions must be queried. On ANY error (InvalidRegionId/Empty/Throttling), log and continue — break/exit is FORBIDDEN. After loop, verify EXECUTED >= 12 (ddosbgp) or = 2 (ddoscoo). Log results immediately after each call — relying on memory is FORBIDDEN.

>

Empty result handling: Total: 0 → log "no instances", continue | Error code → log error, continue | Normal → extract instance IDs.

After traversal, compile Region -> Instance ID list mapping for Phase 4.

# 2.1 Basic Protection assets
aliyun antiddos-public describe-instance-ip-address \
  --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 50

# 2.2 Native Protection - [MUST execute full loop in single bash]
BASELINE="cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1"
DYNAMIC=$(aliyun ddosbgp describe-regions 2>/dev/null | grep -o '"RegionId":"[^"]*"' | cut -d'"' -f4 | tr '\n' ' ')
if [ -n "$DYNAMIC" ]; then
  ALL_REGIONS=$(echo "$BASELINE $DYNAMIC" | tr ' ' '\n' | sort -u | tr '\n' ' ')
else
  ALL_REGIONS="$BASELINE"
fi
EXECUTED=0
for region in $ALL_REGIONS; do
  # [MANDATORY] NEVER break/return/exit - on ANY error, MUST continue
  echo "=== ddosbgp query $region ==="
  # [CRITICAL] Must specify --endpoint for mainland China Regions
  RESULT=$(aliyun ddosbgp describe-instance-list --page-no 1 --page-size 50 --region $region --endpoint ddosbgp.cn-hangzhou.aliyuncs.com 2>&1)
  echo "$RESULT"
  if echo "$RESULT" | grep -q "InvalidRegionId\|ErrorCode"; then
    echo "[WARN] $region returned error, logged and continuing"
  fi
  EXECUTED=$((EXECUTED+1))
  continue
done
echo "=== Regions executed: $EXECUTED ==="

# 2.3 Native Protection associated IPs (per discovered instance, uses --biz-region-id)
aliyun ddosbgp describe-pack-ip-list \
  --instance-id <instance-id> --page-no 1 --page-size 50 --biz-region-id <region-id>

# 2.4 Anti-DDoS Pro instances [MUST query both Regions]
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region ap-southeast-1

# 2.5 Anti-DDoS Pro associated domains (per discovered instance)
aliyun ddoscoo describe-domains --instance-ids <instance-id> --region <region-id>

[MUST] End validation: 1) Region count: ddosbgp >= 12, ddoscoo = 2 2) Product isolation: no mixed API prefixes 3) Instance deduplication: Global instances (CoverageType=4) appear in every Region — deduplicate by InstanceId

Phase 3: Confirm Comparison Period

Ask user for comparison period, parse into second-precision Unix timestamps. [MUST] Use bash `date` command — manual calculation FORBIDDEN:

BASE_END=$(date +%s)
BASE_START=$((BASE_END - 86400))
COMPARE_END=$((BASE_START))
COMPARE_START=$((COMPARE_END - 86400))
# Week-over-week: offset 604800s | Hour-over-hour: offset 3600s
echo "Base: $BASE_START ~ $BASE_END | Compare: $COMPARE_START ~ $COMPARE_END"

Phase 4: Execute Inspection & Generate Report

[MUST] Sequential Execution Guard: Execute API chains strictly in order for EACH instance. Do NOT stop at "planning" — every API MUST have an actual aliyun command executed with visible output. After each sub-step (4.1/4.2/4.3), print echo "[Step 4.X Complete]". Proceeding to 4.4/4.5 without all calls completed is FORBIDDEN.

>

[MUST] Route by inventory: No instances in ALL Regions → execute probe calls (--instance-id dummy) on cn-hangzhou to preserve trace, report "not provisioned". Some Regions have instances → inspect those, skip empty Regions. NEVER substitute product APIs.

4.1 Basic Protection Inspection

# Has assets: real ID | No assets: probe call
aliyun antiddos-public describe-ddos-event-list \
  --ddos-region-id <region-id> --instance-type <type> --instance-id <id> \
  --current-page 1 --page-size 50
# Probe: --instance-id dummy --ddos-region-id cn-hangzhou --instance-type ecs

[MANDATORY CHECKPOINT 4.1] Confirm describe-ddos-event-list returned JSON or explicit error. If not executed, retry now. Do NOT proceed to 4.2 until confirmed.

4.2 Native Protection Inspection (ddosbgp APIs ONLY)

[MUST] ddosbgp APIs only. Attack events: describe-ddos-event (singular). L4 traffic: describe-traffic (MUST call). Region params: describe-ddos-event/describe-pack-ip-list use --biz-region-id; describe-traffic uses --region.

Has instances → all 3 APIs per instance | ALL empty → 3 probe calls on cn-hangzhou (all required)

aliyun ddosbgp describe-ddos-event \
  --instance-id <id> --start-time <ts> --end-time <ts> \
  --page-no 1 --page-size 50 --biz-region-id <region-id>
aliyun ddosbgp describe-pack-ip-list \
  --instance-id <id> --page-no 1 --page-size 50 --biz-region-id <region-id>
aliyun ddosbgp describe-traffic \
  --instance-id <id> --start-time <ts> --end-time <ts> --region <region-id>
# Probe: --instance-id dummy, --biz-region-id cn-hangzhou (describe-traffic: --region cn-hangzhou)

[MANDATORY CHECKPOINT 4.2] You MUST now verify all 3 ddosbgp APIs were actually executed by checking terminal output. If describe-ddos-event OR describe-pack-ip-list OR describe-traffic has zero terminal output, STOP and execute the missing call(s) NOW. Two consecutive failures to complete all 3 → output error log and terminate. Do NOT proceed to 4.3 until all 3 confirmed.

4.3 Anti-DDoS Pro/Premium Inspection (ddoscoo APIs ONLY)

[MUST] ddoscoo APIs only. Has instances → all APIs per instance | Both Regions empty → probe calls on cn-hangzhou

aliyun ddoscoo describe-ddos-events \
  --instance-ids <id> --start-time <ts> --end-time <ts> \
  --page-number 1 --page-size 50 --region <region-id>
aliyun ddoscoo describe-domain-qps-list \
  --start-time <ts> --end-time <ts> --interval 300 --region <region-id>
aliyun ddoscoo describe-port-flow-list \
  --instance-ids <id> --start-time <ts> --end-time <ts> \
  --interval 300 --region <region-id>
aliyun ddoscoo describe-domain-status-code-list \
  --start-time <ts> --end-time <ts> --interval 300 \
  --query-type gf --region <region-id>
aliyun ddoscoo describe-domain-status-code-list \
  --start-time <ts> --end-time <ts> --interval 300 \
  --query-type upstrem --region <region-id>
# Probe: --instance-ids dummy, --region cn-hangzhou (same 5 APIs)

[MANDATORY CHECKPOINT 4.3] Verify all 5 ddoscoo APIs have terminal output. Any missing → execute now. Do NOT proceed to 4.4.

4.4 Period-over-Period Analysis

Change rate = (Base - Compare) / Compare × 100%. Thresholds: ±30%~±100% → Attention | >±100% → Anomaly | Blackhole/scrubbing present → Anomaly.

4.5 Report Output

Mandatory: Follow Report Template, no sections omitted. Group assets by Region.

>

[MUST] Data consistency validation:

1. Aggregation: Summary numbers must exactly match detail list counts

2. Deduplication: Same instance/IP across Regions → deduplicate before counting

3. Empty value annotation (hard rule): Empty array [] → write 0 (API returned empty) or Query failed (ErrorCode: XXX). FORBIDDEN: vague phrases like "no anomaly found", "appears to be a false alarm". Key metrics with empty data MUST include [DATA MISSING] tag at section start

4. Cross-validation: Summary totals = sum of Region details

5. Call record verification: Claimed API calls and conclusions must match actual execution. Fabrication FORBIDDEN

6. Raw Data Binding: Copy-paste exact values from terminal output into report. FORBIDDEN: inferring from memory, writing "no domains" if API returned domains. Use grep/jq to verify before finalizing

>

[MUST] Pre-computation verification (hard blocker):

[STRICT MODE] Directly writing `echo "<number>"` with pre-filled values is FORBIDDEN and counts as fabrication. You MUST use `grep`/`jq`/`wc` to parse actual terminal output or saved log. The verification script must contain pipe commands that extract real data, NOT hardcoded echo statements.

```bash

# [STRICT] Count API calls from terminal history - must use grep, not hardcoded echo

echo "=== Call statistics ==="

# Example: grep -c "aliyun antiddos-public" /path/to/terminal.log (adapt to your log method)

echo "antiddos-public: $(grep -c 'antiddos-public' <<< "$TERMINAL_LOG")"

echo "ddosbgp: $(grep -c 'aliyun ddosbgp' <<< "$TERMINAL_LOG")"

echo "ddoscoo: $(grep -c 'aliyun ddoscoo' <<< "$TERMINAL_LOG")"

# [STRICT] Count assets from API responses - must use jq/grep, not hardcoded

echo "=== Asset statistics (from API JSON responses) ==="

# Parse actual JSON outputs, e.g.: jq '.InstanceList | length', jq '.DomainList | length'

```

Output must contain pipe commands (`grep`, `jq`, `wc -l`). Pure `echo "number"` without pipes = fabrication = abort.

Mismatch with report draft → abort, re-traverse log, re-run. Report MUST quote the verification output snippet.

Cleanup

[MUST] Mandatory exit safeguard: Regardless of exit reason (success, failure, cancellation, timeout), the final step MUST unconditionally execute AI-Mode disable + verification. Highest priority, cannot be overridden.

aliyun configure ai-mode disable
# Verify: try status command, if unsupported fall back to configure list
VERIFY=$(aliyun configure ai-mode status 2>&1)
if echo "$VERIFY" | grep -q "not a valid\|unknown\|error"; then
  # Fallback: check via configure list output
  aliyun configure list | grep -i "ai-mode\|agent"
fi
# If still uncertain, run disable again to be safe
aliyun configure ai-mode disable

[MUST] Only write "AI-Mode confirmed disabled" if verification succeeded. If both status and configure list fail to confirm, write "AI-Mode disable executed but verification inconclusive (CLI compatibility issue)" — do NOT claim confirmed.

References

Acceptance Criteria: alibabacloud-ddos-security-monitor

Scenario: DDoS Security Product Inspection & Monitoring Purpose: Skill testing acceptance criteria

---

Correct CLI Command Patterns

1. Product - Product Code Verification

Correct

aliyun antiddos-public describe-instance-ip-address ...
aliyun ddosbgp describe-instance-list ...
aliyun ddoscoo describe-instances ...

Incorrect

aliyun antiddospublic ...        # Error: missing hyphen
aliyun ddos-bgp ...              # Error: incorrect product code spelling
aliyun ddos-coo ...              # Error: incorrect product code spelling

2. Command - Command Format (MUST use plugin mode)

Correct (plugin mode, kebab-case)

aliyun ddosbgp describe-instance-list --page-no 1 --page-size 10 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 10 --region cn-hangzhou
aliyun ddoscoo describe-ddos-events --instance-ids <id> --start-time <ts> --end-time <ts> --page-number 1 --page-size 50 --region cn-hangzhou
aliyun ddoscoo describe-domain-qps-list --start-time <ts> --end-time <ts> --interval 300 --region cn-hangzhou
aliyun ddoscoo describe-port-flow-list --instance-ids <id> --start-time <ts> --end-time <ts> --interval 300 --region cn-hangzhou
aliyun ddoscoo describe-domain-status-code-list --start-time <ts> --interval 300 --query-type gf --region cn-hangzhou
aliyun ddosbgp describe-ddos-event --instance-id <id> --start-time <ts> --end-time <ts> --page-no 1 --page-size 50 --biz-region-id cn-hangzhou
aliyun ddosbgp describe-traffic --start-time <ts> --region cn-hangzhou
aliyun ddosbgp describe-pack-ip-list --instance-id <id> --page-no 1 --page-size 50 --biz-region-id cn-hangzhou

Incorrect (PascalCase traditional format)

aliyun ddosbgp DescribeInstanceList --PageNo 1 --PageSize 10 --RegionId cn-hangzhou
aliyun ddoscoo DescribeInstances --PageNumber 1 --PageSize 10 --RegionId cn-hangzhou
aliyun ddoscoo DescribeDDoSEvents --InstanceIds.1 <id> --StartTime <ts> --EndTime <ts>
aliyun ddoscoo DescribeDomainQPSList --StartTime <ts> --EndTime <ts> --Interval 300

Reason: The specification requires all CLI commands to use plugin mode format (lowercase with hyphens). PascalCase traditional API format is not allowed.

3. Parameters - Parameter Format Verification

Correct

# Region parameter - ddoscoo/ddosbgp most commands use --region global parameter
aliyun ddoscoo describe-instances --page-number 1 --page-size 10 --region cn-hangzhou

# ddosbgp some commands use --biz-region-id
aliyun ddosbgp describe-ddos-event --instance-id <id> --start-time <ts> --end-time <ts> --page-no 1 --page-size 50 --biz-region-id cn-hangzhou

# Instance list parameter - space-separated
aliyun ddoscoo describe-ddos-events --instance-ids id1 id2 id3 ...

Incorrect

# Error: Using PascalCase parameter names
aliyun ddosbgp describe-instance-list --PageNo 1 --PageSize 10 --RegionId cn-hangzhou

# Error: Using .N format for instance list
aliyun ddoscoo describe-ddos-events --InstanceIds.1 <id>

# Error: ddosbgp describe-ddos-event using --region instead of --biz-region-id
aliyun ddosbgp describe-ddos-event --instance-id <id> --region cn-hangzhou

4. Authentication - Security Rules

Correct

# Only check credential status
aliyun configure list

Incorrect

# Error: Printing AK/SK values
echo $ALIBABA_CLOUD_ACCESS_KEY_ID

# Error: Passing plaintext credentials in command line
aliyun configure set --mode AK --access-key-id LTAI5t... --access-key-secret ...

5. AI-Mode Lifecycle

Correct

# Enable at start
aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddos-security-monitor"

# ... execute inspection ...

# Disable at ALL exit paths
aliyun configure ai-mode disable

Incorrect

# Error: Missing AI-Mode enable/disable
# Error: Missing user-agent setting
# Error: Only disabling on success path, missing on error path

6. Non-existent Commands

Incorrect

# Error: describe-instance-flow does not exist in ddoscoo plugin mode
aliyun ddoscoo describe-instance-flow --instance-ids <id> ...

Note: describe-instance-flow does not exist in ddoscoo. Use describe-port-flow-list instead.

API Parameter Reference

Time Parameter Specification

• All time parameters use second-precision Unix timestamps
• Anti-DDoS Pro related API timestamps must be precise to the minute

Required Parameters Summary

Region Parameter Reference

• antiddos-public: Uses --ddos-region-id parameter
• ddosbgp describe-ddos-event / describe-pack-ip-list: Uses --biz-region-id parameter
• ddosbgp other commands and all ddoscoo commands: Uses --region global parameter

ddosbgp Endpoint Routing (Critical)

The CLI default endpoint ddosbgp.aliyuncs.com for ddosbgp describe-instance-list does NOT support mainland China Regions (cn-hangzhou/cn-beijing etc. return DDosBgp.CheckError.InvalidRegion). You MUST explicitly specify the endpoint:

# Must add --endpoint parameter, this endpoint covers both mainland and overseas Regions
aliyun ddosbgp describe-instance-list --page-no 1 --page-size 50 --region <region> --endpoint ddosbgp.cn-hangzhou.aliyuncs.com

Note: describe-ddos-event, describe-pack-ip-list, describe-traffic are NOT affected by this issue and do not need an explicit endpoint.

Global instances (CoverageType=4, shown as "Global" in console) will appear in every Region query and must be deduplicated by InstanceId.

To get the full list of Regions supported by ddosbgp: aliyun ddosbgp describe-regions (approximately 26 Regions, more accurate than the ECS Region list).

query-type Values (Anti-DDoS Pro Status Codes)

instance-ids Format (ddoscoo)

The --instance-ids parameter for ddoscoo uses space-separated values:

aliyun ddoscoo describe-ddos-events --instance-ids id1 id2 id3 ...

Common Region Codes

Instance Type Values (Basic Protection)

CLI Installation Guide

macOS

# Recommended: One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Or use Homebrew
brew install aliyun-cli

Linux

# One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

Windows

Download and install from GitHub Releases: https://github.com/aliyun/aliyun-cli/releases

Verify Installation

aliyun version
# Requires >= 3.3.3

Enable Auto Plugin Install & Update

# Enable auto plugin install
aliyun configure set --auto-plugin-install true

# Update all installed plugins to latest version
aliyun plugin update

Verify Credentials

# Check current configuration (view status only, never print credential values)
aliyun configure list

Security Rules:

- NEVER read, echo, or print AK/SK values

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

- Configure credentials outside of agent sessions via aliyun configure in terminal

Reference Documentation

• Alibaba Cloud CLI Official Docs: https://help.aliyun.com/zh/cli/
• Calling RPC/ROA APIs: https://help.aliyun.com/zh/cli/call-rpc-api-and-roa-api

CLI Installation & Credential Configuration

CLI Installation

# One-click install script (recommended)
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Verify version (requires >= 3.3.3)
aliyun version

# Enable auto plugin install
aliyun configure set --auto-plugin-install true

# Update all installed plugins
aliyun plugin update

Important: CLI version must be >= 3.3.3. If the version is too low, re-run the install script to update.

Credential Configuration

Security Rules:

- NEVER read, echo, or print AK/SK values

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

# Check current credential status
aliyun configure list

If no valid profile exists, STOP here. 1. Obtain credentials from Alibaba Cloud Console 2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile) 3. Return and re-run after aliyun configure list shows a valid profile

Create RAM Sub-account (Recommended)

If the user has no configured credentials, guide them to:

1. Log in to https://ram.console.aliyun.com to create a RAM sub-account (main account AK/SK has excessive permissions and high leak risk) 2. Create an AccessKey for the RAM sub-account 3. Grant permissions according to the permission list in ram-policies.md 4. Configure in terminal using aliyun configure (never pass credentials in the session)

RAM Permission Policies

Minimum Permission List

DDoS Basic Protection (antiddos-public)

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "antiddos-public:DescribeInstanceIpAddress",
        "antiddos-public:DescribeDdosEventList"
      ],
      "Resource": "*"
    }
  ]
}

DDoS Native Protection (ddosbgp)

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ddosbgp:DescribeInstanceList",
        "ddosbgp:DescribePackIpList",
        "ddosbgp:DescribeDdosEvent",
        "ddosbgp:DescribeTraffic"
      ],
      "Resource": "*"
    }
  ]
}

DDoS Anti-DDoS Pro/Premium (ddoscoo)

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ddoscoo:DescribeInstances",
        "ddoscoo:DescribeDomains",
        "ddoscoo:DescribeDDoSEvents",
        "ddoscoo:DescribeDDosAllEventList",
        "ddoscoo:DescribeDomainQPSList",
        "ddoscoo:DescribePortFlowList",
        "ddoscoo:DescribeDomainStatusCodeList"
      ],
      "Resource": "*"
    }
  ]
}

Read-Only Permission Note

All permissions listed above are read-only permissions, supporting only query (Describe/List) operations. No create, modify, or delete write operations are included.

Permission Failure Handling

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

1. Read this file (references/ram-policies.md) to get the full list of permissions required by this SKILL

2. Use ram-permission-diagnose skill to guide the user through requesting the necessary permissions

3. Pause and wait until the user confirms that the required permissions have been granted

CLI Command Table

DDoS Basic Protection (antiddos-public)

DDoS Native Protection (ddosbgp)

DDoS Anti-DDoS Pro/Premium (ddoscoo)

Parameter Format Notes

• Time parameters: All time parameters use second-precision Unix timestamps
• Region parameters: Some ddosbgp commands use --biz-region-id, others use the global --region parameter
• Instance list: ddoscoo's --instance-ids uses space-separated values, format: --instance-ids id1 id2 id3
• query-type values: gf (Anti-DDoS Pro frontend) or upstrem (origin; note: official API spelling is upstrem)

DDoS Security Inspection Report Template

Mandatory: Every inspection report output MUST strictly follow this template structure. No sections may be omitted.

---

Normal Situation Template

# DDoS Security Inspection Report

## Inspection Summary

| Item | Value |
|------|-------|
| Inspection Time | <current time> |
| Base Period | <base_start> ~ <base_end> |
| Compare Period | <compare_start> ~ <compare_end> |
| Inspection Mode | <day-over-day / hour-over-hour / 30-min-over-30-min / custom> |
| Products Covered | <Basic Protection / Native Protection / Anti-DDoS Pro> |

---

## Asset Inventory

| Product | Status | Asset Details |
|---------|--------|---------------|
| DDoS Basic Protection | OK/Warning/Error | <instance count> ECS instances, <IP count> public IPs |
| DDoS Native Protection | OK/Warning/Error | <instance count> instances, <protected IP count> protected IPs |
| DDoS Anti-DDoS Pro/Premium | OK/Warning/Error | <instance count> instances, <domain count> domains |

### Detailed Asset List

#### Basic Protection Assets
| Instance Name | Instance ID | Public IP | Protection Status |
|--------------|-------------|-----------|-------------------|
| <...> | <...> | <...> | <...> |

#### Native Protection Assets
| Instance ID | Protected IP | Product Type | Region | Status |
|-------------|-------------|-------------|--------|--------|
| <...> | <...> | <...> | <...> | <...> |

#### Anti-DDoS Pro/Premium Assets
| Instance ID | Anti-DDoS IP | Associated Domains |
|-------------|-------------|-------------------|
| <...> | <...> | <...> |

---

## Inspection Results

### 1. DDoS Attack Events

| Product | Base Period Events | Compare Period Events | Change |
|---------|-------------------|----------------------|--------|
| Basic Protection | <N> events | - | - |
| Native Protection | <N> events | <N> events | <no change/increase/decrease> |
| Anti-DDoS Pro | <N> events | <N> events | <no change/increase/decrease> |

---

### 2. L4 Traffic Analysis (Peak)

| Product | Base Period Peak | Compare Period Peak | Change Rate |
|---------|----------------|--------------------|----|
| Native Protection | <N> Mbps | <N> Mbps | <+/-X% or no data> |
| Anti-DDoS Pro | <N> Mbps | <N> Mbps | <+/-X% or no data> |

---

### 3. L7 QPS Analysis

| Product | Base Period Peak | Compare Period Peak | Change Rate |
|---------|----------------|--------------------|----|
| Anti-DDoS Pro | <N> QPS | <N> QPS | <+/-X% or no data> |

---

### 4. HTTP Status Code Analysis

| Type | Base Period | Compare Period | Change Rate |
|------|-----------|---------------|-------------|
| Frontend 4xx | <N> times | <N> times | <+/-X% or no data> |
| Frontend 5xx | <N> times | <N> times | <+/-X% or no data> |

---

## Conclusion: No anomalies found in this inspection

**All metrics normal** during the past <time range>:
- No DDoS attack events
- No abnormal traffic fluctuations
- No status code anomalies

---

## Data Notes

| Product | Data Status | Reason |
|---------|------------|--------|
| <product> | <has data/no data> | <explanation> |

---

Anomaly Template

When anomalies are found, replace the conclusion section with:

## Conclusion: <N> anomalies found

### Anomaly Summary
| Product | Metric | Anomaly Type | Details |
|---------|--------|-------------|---------|
| <product> | <metric name> | Anomaly/Attention needed | <change rate/event details> |

### Remediation Recommendations
1. <specific actionable recommendation>
2. <...>

Verification Method

Phase 1 Verification: Environment & Credentials

# Verify CLI version >= 3.3.3
aliyun version

# Verify credentials are valid (returns JSON, not error)
aliyun antiddos-public describe-instance-ip-address \
  --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 1

Success criteria: CLI version output >= 3.3.3, aliyun configure list shows a valid profile, API call returns normal JSON.

Abort criteria: If any pre-check command returns a non-zero exit code or fails 3 consecutive times, output a standardized error report and execute aliyun configure ai-mode disable, then terminate the workflow.

Phase 2 Verification: RAM Permissions

# Basic Protection permission verification
aliyun antiddos-public describe-instance-ip-address \
  --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 1

# Native Protection permission verification
aliyun ddosbgp describe-instance-list --page-no 1 --page-size 1 --region cn-hangzhou

# Anti-DDoS Pro permission verification (two Regions)
aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region ap-southeast-1

Success criteria: All commands return valid JSON responses, no Forbidden.RAM or NoPermission errors.

Phase 3 Verification: Product Inventory (Mandatory Traversal)

Success criteria: 1. Instance list queries have been executed for every Region (even empty list returns count as successful execution) 2. All provisioned instances have been discovered and logged 3. No Regions were skipped due to empty lists or InvalidRegion errors

Phase 5 Verification: Inspection Execution & Report

Mandatory call verification: 1. Native Protection's describe-ddos-event, describe-pack-ip-list, describe-traffic have all been called 2. Anti-DDoS Pro's describe-ddos-events, describe-domain-qps-list, describe-port-flow-list, describe-domain-status-code-list have all been called 3. Even if a product has no instances, the above APIs have been executed as probes

Data consistency verification: 1. Total instance count in report summary = sum of Region detail instance counts 2. Total protected IP count in report summary = sum of per-instance associated IP counts 3. No duplicate counting (same instance or IP deduplicated across multi-Region queries) 4. Empty values annotated as "0", not omitted

Report format verification: 1. Report strictly follows the prescribed template structure, no sections omitted 2. All assets grouped by Region 3. Both base period and compare period data have been retrieved 4. Period-over-period analysis calculations are correct 5. Anomaly indicators are flagged (+/-30% attention needed, +/-100% anomaly)

Overall Verification

# Confirm AI-Mode is disabled (final step for ALL exit paths)
aliyun configure ai-mode disable

Success criteria: AI-Mode has been disabled before final exit, regardless of whether the workflow completed successfully or was terminated due to an exception.