Alibabacloud Ddoscoo Intercept Query

DDoS Pro (Anti-DDoS Pro) Intercept Query

Scenario Description

Query and analyze DDoS Pro (ddoscoo) block/intercept events using SLS full logs and ddoscoo CLI commands. When a user reports being blocked by DDoS Pro or encounters a block page, this skill discovers DDoS instances, checks full log configuration, queries SLS logs by Request ID, retrieves rule details, and outputs a structured analysis report with recommendations.

Architecture: DDoS Pro Instance → Full Log (SLS) → Log Query → Rule Analysis → Report

Installation

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.

Pre-check: AI-Mode Lifecycle

At the start of the Core Workflow (before any CLI invocation):

[MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution.

Run the following commands before any CLI invocation:

```bash

aliyun configure ai-mode enable

aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query"

```

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason (workflow success, failure, error, user cancellation, or session end), always disable AI-mode first. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

```bash

aliyun configure ai-mode disable

```

Pre-check: SLS CLI plugin required

[MUST] Install the SLS CLI plugin before any log query operations:

```bash

aliyun component install sls

```

Verify the plugin is available:

```bash

aliyun sls --help

```

If aliyun component install is not available, use the legacy command:

```bash

aliyun plugin install --names aliyun-cli-sls

```

Environment Variables

No additional environment variables required. Authentication is handled via the Aliyun CLI credential chain.

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

>

Note on 401 Unauthorized errors: A 401 The security token has expired error means the STS temporary credential has expired — this is not a RAM permission issue. Ask the user to refresh credentials outside this session via aliyun configure, then retry.

RAM Policy

See references/ram-policies.md for the full list of required permissions.

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

1. Read references/ram-policies.md to get the full list of permissions required by this SKILL

2. Use ram-permission-diagnose skill to guide the user through requesting the necessary permissions

3. Pause and wait until the user confirms that the required permissions have been granted

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks,

passwords, domain names, resource specifications, etc.) MUST be confirmed with the

user. Do NOT assume or use default values without explicit user approval.

Core Workflow

[MUST] Required API Call Sequence — The following API calls MUST be executed in order for every invocation of this skill. Do NOT skip any step, even if you believe the result is known in advance:

1. Step 2a → ddoscoo DescribeInstances (both regions) + if domain unknown: DescribeWebAccessLogDispatchStatus for domain discovery only

2. Step 2b → ddoscoo DescribeSlsOpenStatus + DescribeLogStoreExistStatus + DescribeSlsLogstoreInfo

3. Step 2c → ddoscoo DescribeWebAccessLogStatus only (domain must be known from user or Step 2a; DescribeWebAccessLogDispatchStatus is NOT permitted here)

4. Step 3 → sls GetLogs (query block log by Request ID)

5. Step 5 → Output analysis report

[MUST] User-Agent Header — Every aliyun CLI command in this skill MUST include --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query to identify the caller.

[MUST] 敏感数据脱敏 — 全局规则，贯穿所有输出 — 以下规则适用于整个工作流的所有输出，包括最终报告、中间分析、日志引用、补充说明的任何段落，不得在任何位置还原已脱敏的数据：

- Client IP：仅保留第一段，其余用 * 替代。适用于所有输出格式（JSON 字段、纯文本段落均须脱敏）：

- 纯文本段落：140.205.11.30 → 140.*.*.*；"来自 IP 140.205.11.30 的请求" → "来自 IP 140...* 的请求"

- JSON 字段引用："real_client_ip": "140.205.11.30" → "real_client_ip": "140.*.*.*"

- Cookie / Authorization / Token：整个值替换为 [MASKED]，包括在引用原始日志字段时

- Query Parameters：所有参数值替换为 ***。示例：?token=abc&name=test → ?token=***&name=***

- User-Agent 字符串：截取前 32 个字符

Step 1: Information Collection

Confirm the Request ID (traceid) with the user. Guide them to obtain it from: 1. The block page displayed in the browser (shows Request ID directly) 2. The HTML body of DDoS Pro's block (intercept) response (contains traceid)

Optionally collect the domain name if the user knows which website was blocked.

Step 2: Discover DDoS Pro Instances and Verify Full Log Service

Step 2a: Discover DDoS Pro Instances and Protected Domains

# Query DDoS Pro instances (API endpoint region: cn-hangzhou for China, ap-southeast-1 for International)
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region ap-southeast-1 --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

[MUST] Instance Discovery Validation — After calling describe-instances, inspect the response:

- If Instances is a non-empty array → record the instance(s) and proceed to Step 2b.

- If Instances is empty ([]) for one region → retry with the other region before proceeding.

- If both regions return empty → stop and inform the user: "No DDoS Pro instances were found under this account. Please verify your credentials and region."

- Do NOT proceed to Step 2b or beyond if `describe-instances` returns no results. An empty instance list means subsequent SLS and log queries will also fail — continuing will produce an empty or incorrect report.

[MUST] Domain Discovery — Step 2c requires a known domain name to call describe-web-access-log-status. If the user did NOT provide the domain in their message, discover it HERE in Step 2a before proceeding:

```bash

# Discover all protected domains (domain discovery only — do NOT use the log status from this response)

aliyun ddoscoo describe-web-access-log-dispatch-status --page-number 1 --page-size 10 --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

```

Extract the domain name(s) from the response and record them. This API is used only for domain name discovery, not for checking log status. The actual log status check happens in Step 2c using describe-web-access-log-status.

[MUST] International Region API Error Recovery: If any ap-southeast-1 API call returns InvalidRosettaRegionId, 400 Bad Request, or similar region-level errors:

1. Do NOT abandon the workflow — continue with available data

2. For SLS-related operations: International DDoS Pro SLS projects are typically hosted in cn-hangzhou (not ap-southeast-1), with project names like ddosdip-project-<uid>-ap-southeast-1. Always try cn-hangzhou as the SLS region.

3. For rule query APIs (e.g., describe-web-precise-access-rule, describe-l7-global-rule): If ap-southeast-1 fails, retry the same API call using cn-hangzhou endpoint

4. [MUST] Never skip a user-requested query step due to region API errors — always attempt recovery via the alternative region before reporting failure

Step 2b: Check SLS and Full Log Status

First check if SLS is opened and log store exists:

aliyun ddoscoo describe-sls-open-status --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
aliyun ddoscoo describe-log-store-exist-status --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Then get the SLS logstore info (project, logstore, capacity, TTL):

aliyun ddoscoo describe-sls-logstore-info --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

[IMPORTANT] Fallback for SLS Info Retrieval: If describe-sls-logstore-info returns an error (e.g., 400 InvalidRosettaRegionId in ap-southeast-1), use the following fallback methods in order:

>

Fallback 1 — Get SLS info from domain log status (requires knowing a domain):

```bash

aliyun ddoscoo describe-web-access-log-status --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

```

Extract SlsProject and SlsLogstore from the response.

>

Fallback 2 — List all SLS projects and find the ddoscoo one:

```bash

aliyun sls list-project --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

```

Look for project names containing ddoscoo or ddosdip. Note: International DDoS Pro SLS projects may also be hosted in cn-hangzhou.

Step 2c: Check Domain Full Log Status

⛔ FORBIDDEN: `describe-web-access-log-dispatch-status` is NOT used in this step.

Domain discovery was completed in Step 2a. This step has exactly ONE permitted API call.

By this point the domain name MUST be known (provided by the user, or discovered in Step 2a). Call:

aliyun ddoscoo describe-web-access-log-status --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

• 若返回 SlsConfigStatus=true，说明已开启，直接进入 Step 3。
• 若未开启，告知用户并征得同意后开启：

aliyun ddoscoo enable-web-access-log-config --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Constraint: This skill only supports enabling full log (enable-web-access-log-config). Disabling is not permitted via this skill. Never call disable-web-access-log-config.

[IMPORTANT] Error Handling for Enable: If enable-web-access-log-config returns an error:

- DomainDoNotBelongToYou — Domain is not configured in this DDoS Pro instance. Verify the domain belongs to this instance, or try the other region (cn-hangzhou ↔ ap-southeast-1).

- 403 Forbidden / RAM permission error — See references/ram-policies.md.

>

[IMPORTANT] Historical Logs: Enabling full log only records future requests. If the block event occurred before enabling, no SLS log will exist for that Request ID. Inform the user: "Full log has been enabled, but the historical block event cannot be queried via SLS. Please reproduce the block and retry with the new Request ID."

Step 3: Query SLS Logs

[MUST] Use the SLS CLI plugin (aliyun sls get-logs) for all log queries.

Use the SLS project/logstore obtained from Step 2 to query block logs:

# Query SLS logs via plugin-mode call
TO_TIME=$(python3 -c "import time; print(int(time.time()))")
FROM_TIME=$((TO_TIME - 86400))
aliyun sls get-logs \
  --project <project-name> \
  --logstore <logstore-name> \
  --from $FROM_TIME \
  --to $TO_TIME \
  --query "<request-id>" \
  --reverse true \
  --lines 100 \
  --region <sls-region> \
  --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

If no results found in the last 24 hours, progressively expand the time range:

• Last 3 days: FROM_TIME=$((TO_TIME - 86400 * 3))
• Last 7 days: FROM_TIME=$((TO_TIME - 86400 * 7))
• Last 30 days: FROM_TIME=$((TO_TIME - 86400 * 30))
• Maximum (based on TTL): FROM_TIME=$((TO_TIME - 86400 * <ttl_days>))

Fallback method — If the SLS plugin command above fails (e.g., plugin not installed), use the Python script:

```bash

python3 scripts/get_ddos_logs.py \

--project <project-name> \

--logstore <logstore-name> \

--request-id <request-id> \

--region <sls-region>

```

Note: DDoS Pro full log SLS region mapping:

• China Mainland instances (cn-hangzhou): SLS project is in cn-hangzhou
• International instances (ap-southeast-1): SLS project is also typically in `cn-hangzhou` (not ap-southeast-1), with project names like ddosdip-project-<uid>-ap-southeast-1

[MUST] Do NOT guess SLS project names. Always use the exact project/logstore values obtained from Step 2b (describe-sls-logstore-info or its fallback). If both APIs failed, use aliyun sls list-project --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query to discover projects containing ddoscoo or ddosdip.

Step 4: Query Rule Details

After obtaining the SLS log, extract key fields to determine the block type and query the specific rule configuration.

Step 4a: Identify Block Type from Log Fields

The two most important log fields for identifying the block type are:

• `cc_phase` — Identifies which protection module triggered the block
• `last_owner` — Format is <rule_name>|<source>, where source is manual (user-created) or clover (auto-generated)

`cc_phase` → Block Type → Query API Mapping:

Other useful log fields:

Step 4b: Query Strategy Switch Status (策略预检)

[MUST] Before querying specific rules, first check which protection modules are enabled:

aliyun ddoscoo describe-web-cc-protect-switch --domains.1 '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

This returns all switch states. Key fields:

Step 4c: Query Specific Rule Details

Based on cc_phase, call the corresponding API to fetch the rule configuration.

If `cc_phase` = `cc` → CC Protection Rules:

# Query all CC rules for the domain; use --owner manual for user rules, clover for auto rules
aliyun ddoscoo describe-web-cc-rules-v2 --domain '<domain>' --offset 0 --page-size 30 --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Then find the specific rule by matching last_owner's rule name (the part before |) against the rule's name field in the response.

If `cc_phase` = `gfacl` → Precise Access Control (ACL) Rules:

aliyun ddoscoo describe-web-precise-access-rule --domains.1 '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Then find the specific rule by matching last_owner's rule name against the rule's Name field in the response.

If `cc_phase` = `ai` → AI Smart Protection:

# AI protection has no individual rules; check mode and level from switch status
aliyun ddoscoo describe-web-cc-protect-switch --domains.1 '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Report the AiMode (watch/defense), AiTemplate (level30/60/90), and AiRuleEnable status.

If `cc_phase` = `global` or `gf_rule` → Global Defense Policy:

# Get global rule list with RuleId, Action, Enabled, Description
aliyun ddoscoo describe-l7-global-rule --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

If `cc_phase` = `blacklist` → IP Blacklist/Whitelist:

# Get blacklist and whitelist IPs from domain web rules
aliyun ddoscoo describe-web-rules --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Extract BlackList and WhiteList arrays from the response.

If `cc_phase` = `region` or `geo` → Region Blocking:

aliyun ddoscoo describe-web-area-block-configs --domains.1 '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Check which regions have Block = 1.

[IMPORTANT] Domain Not Found: If the domain query returns DomainNotExist, the domain may have been removed from DDoS Pro after the block event. Report this to the user — the log is still valid but rule details cannot be retrieved.

See references/domain-security-policy.md for the complete domain security policy management reference including rule creation, modification, deletion, and field reference tables.

Step 5: Output Analysis Report

[MUST] Sensitive Data Masking — Apply the global masking rules defined in Core Workflow to all fields in this report, including any supplementary paragraphs. Never restore masked data in any section.

## DDoS Pro Intercept Analysis Report

### Request Information
- Request ID: {request_traceid}
- Block Time: {time}
- Client IP: {masked_real_client_ip, e.g. 192.***.***.***}
- ISP Line: {isp_line}（DDoS Pro 接入线路，非客户端实际位置）
- Domain: {matched_host}
- Request URL: {host}{request_path}?{masked_query_params}

### Block Details
- Rule ID: {final_rule_id 或 cc_rule_id；若日志中两个字段均不存在，输出 "N/A - 日志中未记录规则 ID"，不可省略此行}
- Block Type: {final_plugin / cc_phase}
- Action: {final_action or cc_action}

### Recommendations
{Based on block type, refer to references/common-block-reasons.md}

Troubleshooting

No Logs Found

1. Re-check SLS and log store status (Step 2b) 2. Check domain full log switch:

   aliyun ddoscoo describe-web-access-log-status --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

3. Enable if disabled (check-then-act):

   aliyun ddoscoo enable-web-access-log-config --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

4. Check all domain log dispatch status:

   aliyun ddoscoo describe-web-access-log-dispatch-status --page-number 1 --page-size 50 --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Request ID Not Found

1. Verify Request ID format (typically 30+ hex characters) 2. Script auto-expands search up to 90 days 3. Try both regions (cn-hangzhou and ap-southeast-1) 4. Check log retention (TTL) via describe-sls-logstore-info

Multi-Instance Scenarios

DDoS Pro instances may span both regions. Query logs across all discovered SLS projects until the Request ID is found.

Rule Operation Constraints

See references/rule-operations.md for detailed instructions.

When user requests to disable a rule: 1. Check current status first (idempotent check-then-act) 2. Only disable operations are permitted; never delete rules 3. Confirm with user before executing

Disable CC Rule:

aliyun ddoscoo disable-web-cc-rule --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Disable Precise Access Control:

aliyun ddoscoo modify-web-precise-access-switch --domain '<domain>' --config '{"PreciseRuleEnable": 0}' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Success Verification Method

See references/verification-method.md for detailed verification steps.

Expected Outcome: Intercept analysis report generated with complete request information, rule details, and actionable recommendations.

Verification: After querying with a known Request ID, the output should contain all fields in the report template.

Cleanup

This skill is read-only by default and does not create persistent resources. No cleanup required unless:

• Full log was enabled for a domain during execution (inform user; this skill only enables, never disables)
• CC rules were disabled (can be re-enabled via enable-web-cc-rule)

Best Practices

1. Always query both regions (cn-hangzhou and ap-southeast-1) for instance discovery 2. [MUST] Use aliyun sls get-logs (plugin mode, kebab-case) for SLS log queries 3. Do NOT guess SLS project/logstore names — always obtain them from describe-sls-logstore-info or describe-web-access-log-status 4. Check domain full log status before querying to avoid empty results 5. [MUST] Mask sensitive data in output reports: Client IP → first_octet.*.*.*, query parameters → ***, cookies/tokens → [MASKED] 6. Use idempotent check-then-act pattern before any write operations 7. Never delete rules — only disable/enable operations are permitted

Reference Links

Acceptance Criteria: alibabacloud-ddoscoo-intercept-query

Scenario: DDoS Pro (Anti-DDoS Pro) Intercept Query Purpose: Skill testing acceptance criteria

---

Correct CLI Command Patterns

1. Product — verify product name exists

✅ CORRECT

aliyun ddoscoo describe-instances ...
aliyun sls get-logs ...

❌ INCORRECT

# Wrong product name (should be ddoscoo):
#   aliyun ddos describe-instances ...
# Wrong case:
#   aliyun DDosCoo describe-instances ...
# Traditional API format (PascalCase), not plugin mode:
#   Must use kebab-case like describe-instances, NOT PascalCase like DescribeInstances

2. Command — verify action exists under the product (plugin mode)

✅ CORRECT

aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou
aliyun ddoscoo describe-web-access-log-status --domain 'example.com' --region cn-hangzhou
aliyun ddoscoo describe-web-cc-rules-v2 --domain 'example.com' --region cn-hangzhou
aliyun ddoscoo describe-web-precise-access-rule --domains 'example.com' --region cn-hangzhou

❌ INCORRECT

# Traditional API format (PascalCase), not plugin mode:
#   Must use kebab-case like describe-instances, NOT PascalCase
#   Must use kebab-case like describe-web-access-log-status, NOT PascalCase
#   Must use kebab-case like describe-web-cc-rules-v2, NOT PascalCase

3. Parameters — verify each parameter name exists for the command

✅ CORRECT

aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou
aliyun ddoscoo disable-web-cc-rule --domain 'example.com' --region cn-hangzhou

❌ INCORRECT

# Wrong parameter format (PascalCase vs kebab-case):
#   Must use --page-number, NOT --PageNumber
#   Must use --domain, NOT --Domain

4. AI-Mode Lifecycle + User-Agent Header

✅ CORRECT

# At skill start: enable AI-Mode and set User-Agent
aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query"

# Every aliyun command must also include --header with full skill name
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
aliyun sls get-logs --project <p> --logstore <l> --from <ts> --to <ts> --query <q> --region <r> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

# At skill exit (every exit point): disable AI-Mode
aliyun configure ai-mode disable

❌ INCORRECT

# Missing --header on any command
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou

# Missing skill name suffix in User-Agent
aliyun ddoscoo describe-instances ... --header User-Agent=AlibabaCloud-Agent-Skills

# Not disabling AI-mode at exit
# (AI-mode must be disabled before final response)

5. Security — never expose credentials

✅ CORRECT

aliyun configure list    # Only check status

❌ INCORRECT

echo $ALIBABA_CLOUD_ACCESS_KEY_ID       # FORBIDDEN: printing AK
aliyun configure set --access-key-id xxx # FORBIDDEN: literal credential values

---

Correct Script Patterns

1. SLS Log Query Script

✅ CORRECT

python3 scripts/get_ddos_logs.py \
  --project ddoscoo-project-xxx \
  --logstore ddoscoo-logstore \
  --request-id 2f6fc15517769105850466500e008c \
  --region cn-hangzhou

❌ INCORRECT

python3 get_ddos_logs.py ...                     # Script not in scripts/ directory
python3 scripts/get_ddos_logs.py --request_id    # Wrong parameter format (underscore vs hyphen)

---

Workflow Patterns

1. Idempotent Check-Then-Act

✅ CORRECT

1. Query current state (describe-web-cc-rules-v2 / describe-web-precise-access-rule)
2. If already in target state -> skip, inform user
3. If not -> confirm with user -> execute change

❌ INCORRECT

1. Directly execute change without checking current state
2. Execute change without user confirmation

2. Full Log Enable Flow

✅ CORRECT

1. Check SLS status (describe-sls-open-status)
2. Check log store exists (describe-log-store-exist-status)
3. Check domain log status (describe-web-access-log-status)
4. If enabled -> proceed to query
5. If not -> inform user -> get consent -> enable (enable-web-access-log-config)

❌ INCORRECT

1. Skip status check, directly enable
2. Disable full log (disable-web-access-log-config) — FORBIDDEN via this skill

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

Common DDoS Pro Block Reasons and Recommendations

Block Reason Reference Table

DDoS Pro SLS Full Log Key Fields

Domain Naming in DDoS Pro

DDoS Pro website forwarding rules are domain-based. The domain configured in DDoS Pro forwarding rules is directly used as the identifier (e.g., www.example.com).

域名安全策略管理

目录

• 域名预检
• 策略预检
• CC防护
• 精确访问控制（ACL）
• AI智能防护
• 全局防护策略
• IP黑白名单
• 区域封禁
• 匹配字段与匹配方法参考表

域名预检

若提供了域名信息，则提前获取域名配置信息。若未提供域名，使用 AskUserQuestion 收集域名。

aliyun ddoscoo describe-domain-resource --domain '<域名>' --region cn-hangzhou #获取国内高防实例的域名配置信息
aliyun ddoscoo describe-domain-resource --domain '<域名>' --region ap-southeast-1 #获取国际高防实例的域名配置信息

策略预检

# 获取策略开关状态
aliyun ddoscoo describe-web-cc-protect-switch --domains.1 '<域名>' --region '<REGION>'

# 获取CC防护策略，其中manual代表手动策略｜clover代表智能策略
aliyun ddoscoo describe-web-cc-rules-v2 --domain '<域名>' --offset 0 --page-size 30 --region '<REGION>'

# 获取ACL防护策略
aliyun ddoscoo describe-web-precise-access-rule --domains.1 '<域名>' --region '<REGION>'

# 获取全局防护策略的规则列表（含RuleId、Action、Enabled、Description）
aliyun ddoscoo describe-l7-global-rule --domain '<域名>' --region '<REGION>'

# 获取黑白名单IP列表
aliyun ddoscoo describe-web-rules --domain '<域名>' --region '<REGION>' | python3 -c "import sys,json;d=json.load(sys.stdin)['WebRules'][0];print('BlackList:',d.get('BlackList',[]));print('WhiteList:',d.get('WhiteList',[]))"

# 获取区域封禁配置（返回每个Region的Block状态 0/1）
aliyun ddoscoo describe-web-area-block-configs --domains.1 '<域名>' --region '<REGION>'

describe-web-cc-protect-switch 返回字段说明：

说明： 其中 CcEnable、CcCustomRuleEnable、CcGlobalSwitch、PreciseRuleEnable 属于 CC 防护大类，由同一个开关接口控制。CcTemplate 和 Domain 可忽略。

CC防护

创建或编辑CC防护的自定义规则

单次最多支持10条策略下发，即RuleList内最多可包含10个完整的策略。

aliyun ddoscoo config-web-cc-rule-v2 --domain '<域名>' --rule-list '[{"action":"<block|challenge|watch>","name":"<规则名称>","ratelimit":{"interval":<统计时长>,"ttl":<处置时长>,"threshold":<阈值次数>,"target":"<统计源>","subkey":"<字段名称>"},"statistics":{"mode":"<count|distinct>","field":"<ip|header|uri>"},"condition":[{"field":"<匹配字段>","match_method":"<匹配方法>","content":"<匹配内容>","header_name":"<字段名称>"}],"status_code":{"enabled":<true|false>,"code":<状态码>,"use_ratio":<true|false>,"count_threshold":<数量阈值>}}]' --expires '<有效期秒数>' --region '<REGION>'

参数填写指南

删除CC防护规则

单次最多支持10条策略下发，即RuleNames列表内最多可包含10个规则名称。

aliyun ddoscoo delete-web-cc-rule-v2 --domain '<域名>' --rule-names '["<规则名称1>","<规则名称2>"]' --region '<REGION>'

关闭/开启CC防护

aliyun ddoscoo modify-web-cc-global-switch --domain '<域名>' --cc-global-switch '<close|open>' --region '<REGION>'

精确访问控制（ACL）

创建或编辑ACL防护规则

单次最多支持10条策略下发，即Rules内最多可包含10个完整的策略。

aliyun ddoscoo modify-web-precise-access-rule --domain '<域名>' --rules '[{"action":"<accept|block|challenge|watch>","name":"<规则名称>","condition":[{"field":"<匹配字段>","match_method":"<匹配方法>","content":"<匹配内容>","header_name":"<字段名称>"}]}]' --expires '<有效期秒数>' --region '<REGION>'

参数填写指南

与CC防护的差异： ACL的action多了accept（放行），没有频率限制相关参数（ratelimit、statistics、status_code），是纯条件匹配型规则。

删除ACL防护规则

aliyun ddoscoo delete-web-precise-access-rule --domain '<域名>' --rule-names.1 '<规则名称1>' --rule-names.2 '<规则名称2>' --region '<REGION>'

关闭/开启ACL防护

aliyun ddoscoo modify-web-precise-access-switch --domain '<域名>' --config '{"PreciseRuleEnable":<0|1>}' --region '<REGION>'

AI智能防护

关闭/开启AI智能防护

aliyun ddoscoo modify-web-ai-protect-switch --domain '<域名>' --config '{"AiRuleEnable":<0|1>}' --region '<REGION>'

设置AI智能防护模式和等级

aliyun ddoscoo modify-web-ai-protect-mode --domain '<域名>' --config '{"AiTemplate":"<level30|level60|level90>","AiMode":"<watch|defense>"}' --region '<REGION>'

参数填写指南

说明： 开关和模式/等级是两个独立接口。开关通过modify-web-ai-protect-switch控制，模式和等级通过modify-web-ai-protect-mode同时设置。查询当前状态通过策略预检中的describe-web-cc-protect-switch返回的AiRuleEnable、AiMode、AiTemplate字段获取。

全局防护策略

设置全局防护策略的开关和等级

aliyun ddoscoo config-domain-security-profile --domain '<域名>' --config '{"global_rule_enable":<0|1>,"global_rule_mode":"<weak|default|hard>"}' --region '<REGION>'

参数填写指南

说明： Config中只需包含要修改的字段，未包含的字段保持不变。查询全局防护开关状态通过策略预检中的describe-web-cc-protect-switch返回的CcGlobalSwitch字段获取。全局防护等级无独立查询接口。

修改全局防护策略的规则动作和开关

单次最多支持10条策略下发，即RuleAttr内最多可包含10个完整的策略。

aliyun ddoscoo config-l7-global-rule --domain '<域名>' --rule-attr '[{"RuleId":"<规则ID>","Action":"<block|watch|challenge>","Enabled":<0|1>}]' --region '<REGION>'

参数填写指南

IP黑白名单

配置黑白名单IP

支持IP和IP/掩码格式，黑名单和白名单各最多2000个。白名单不支持配置/0网段到/8网段。该接口为全量覆盖，需传入完整的黑白名单列表。

aliyun ddoscoo config-web-ip-set --domain '<域名>' --black-list.1 '<IP或IP/掩码>' --black-list.2 '<IP或IP/掩码>' --white-list.1 '<IP或IP/掩码>' --white-list.2 '<IP或IP/掩码>' --region '<REGION>'

注意： 该接口为全量覆盖模式，每次调用需传入完整的黑白名单列表。如需新增IP，应先通过策略预检中的describe-web-rules获取当前列表，追加后再调用本接口。

关闭/开启黑白名单

aliyun ddoscoo modify-web-ip-set-switch --domain '<域名>' --config '{"bwlist_enable":<0|1>}' --region '<REGION>'

区域封禁

设置封禁地域

该接口为全量覆盖模式，需传入完整的封禁地域列表。不传Regions参数表示清空所有封禁地域。

aliyun ddoscoo modify-web-area-block --domain '<域名>' --regions.1 '<地域代码1>' --regions.2 '<地域代码2>' --region '<REGION>'

注意： 该接口为全量覆盖模式，每次调用需传入完整的封禁地域列表。如需新增地域，应先通过策略预检中的describe-web-area-block-configs获取当前已封禁列表（Block为1的Region），追加后再调用本接口。

常用地域代码说明

关闭/开启区域封禁

aliyun ddoscoo modify-web-area-block-switch --domain '<域名>' --config '{"RegionblockEnable":<0|1>}' --region '<REGION>'

匹配字段与匹配方法参考表

CC防护和精确访问控制（ACL）共用以下匹配字段和匹配方法。

匹配字段与匹配方法对应关系

match_method 逻辑符说明

RAM Policy Requirements

This skill requires the following RAM permissions to operate correctly.

Minimum Required Permissions

DDoS Pro (ddoscoo) Permissions

SLS Permissions

Optional Permissions (Log Service Management)

These permissions are only needed when enabling full log for a domain:

Optional Permissions (Rule Operations)

These permissions are only needed when the user requests to disable a rule:

Sample RAM Policy (JSON)

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "yundun-ddoscoo:DescribeInstances",
        "yundun-ddoscoo:DescribeInstanceIds",
        "yundun-ddoscoo:DescribeSlsOpenStatus",
        "yundun-ddoscoo:DescribeLogStoreExistStatus",
        "yundun-ddoscoo:DescribeSlsLogstoreInfo",
        "yundun-ddoscoo:DescribeWebAccessLogStatus",
        "yundun-ddoscoo:DescribeWebAccessLogDispatchStatus",
        "yundun-ddoscoo:DescribeWebRules",
        "yundun-ddoscoo:DescribeWebCcRulesV2",
        "yundun-ddoscoo:DescribeWebPreciseAccessRule",
        "yundun-ddoscoo:DescribeWebAreaBlockConfigs",
        "yundun-ddoscoo:DescribeAutoCcBlacklist",
        "yundun-ddoscoo:DescribeL7GlobalRule"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "log:GetLogStoreLogs"
      ],
      "Resource": "acs:log:*:*:project/*/logstore/*"
    }
  ]
}

Notes

• DDoS Pro resources use * because instance IDs and domains are dynamically discovered during execution.
• SLS resource can be narrowed to specific projects/logstores if known in advance.
• Rule disable permissions are intentionally excluded from the base policy. Only grant when rule disable operations are needed.
• This skill never calls delete APIs for rules — deletion is explicitly prohibited.

Related CLI Commands

All CLI commands used in this skill. Commands use plugin mode format (lowercase + hyphens). Every command includes --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query.

DDoS Pro (ddoscoo) Commands

SLS Commands

Utility Commands

DDoS Pro Rule Configuration Details

Rule Types Overview

CC Protection Rule Fields

Precise Access Control Rule Fields

Condition Structure

Region Blocking Config Fields

SLS Log Field Mapping to Rule Type

DDoS Pro Rule Operation Policy

Warning: Rule Disabling Policy (Important!)

When the user requests to disable a rule, the following constraints must be followed:

1. Only Perform Disable Operations

Only call disable/switch APIs to turn off the rule. Never delete rules.

2. Never Delete Rules

Even if the disable operation fails, you must not call any delete API (e.g., delete-web-cc-rule, delete-web-cc-rule-v2, delete-web-precise-access-rule).

3. Never Modify Rule Content

Do not modify rule matching conditions, thresholds, or other configurations.

4. Failure Handling

• If the disable operation fails, inform the user of the failure reason
• Do not attempt to delete the rule or use other workarounds
• Wait for the user's new instructions before performing any other operations

5. Idempotent Check-Then-Act (Required)

Before executing any write operation, always query the current state first and skip the operation if the resource is already in the target state.

6. Pre-Operation Confirmation

Confirm operation: Disable rule {rule_name} (Domain: {domain})
- Operation type: Disable
- Will not delete the rule
- Will not modify rule content
- Can be re-enabled at any time

Continue? Reply "yes" to confirm

---

Disable Commands by Rule Type

CC Protection Rule

Check current status:

aliyun ddoscoo describe-web-cc-rules-v2 --domain '<domain>' --region <region-id>

Disable CC custom rule:

aliyun ddoscoo disable-web-cc-rule --domain '<domain>' --region <region-id>

Re-enable CC custom rule:

aliyun ddoscoo enable-web-cc-rule --domain '<domain>' --region <region-id>

Precise Access Control

Check current status:

aliyun ddoscoo describe-web-precise-access-rule --domains '<domain>' --region <region-id>

Toggle precise access control switch:

aliyun ddoscoo modify-web-precise-access-switch --domain '<domain>' --config '{"PreciseRuleEnable": 0}' --region <region-id>

Re-enable precise access control:

aliyun ddoscoo modify-web-precise-access-switch --domain '<domain>' --config '{"PreciseRuleEnable": 1}' --region <region-id>

Region Blocking

Check current status:

aliyun ddoscoo describe-web-area-block-configs --domains '<domain>' --region <region-id>

Toggle region blocking switch:

aliyun ddoscoo modify-web-area-block-switch --domain '<domain>' --config '{"RegionBlockSwitch": 0}' --region <region-id>

Forbidden Operations

aliyun ddoscoo delete-web-cc-rule ...              # FORBIDDEN
aliyun ddoscoo delete-web-cc-rule-v2 ...           # FORBIDDEN
aliyun ddoscoo delete-web-precise-access-rule ...  # FORBIDDEN

---

Operation Flowchart

User requests to disable/enable a rule
       |
Identify rule type (CC / Precise ACL / Region Block / etc.)
       |
Query current rule status (check-then-act)
       |
  +---------------------+
  | Already in target   |
  | state?              |
  +------+--------------+
     Yes | No
         |        |
   Inform user    Confirm operation with user
   (no action     (disable only, no deletion)
    needed)              |
                  Execute disable command
                         |
                    +-------------+
                    |   Success?  |
                    +------+------+
                       Yes | No
                           |        |
                           |   Report failure reason
                           |   Wait for user instructions
                           |   (Do NOT attempt to delete)
                           v
                      Operation complete

Success Verification Method

Scenario Goal Verification

Expected Outcome: Given a Request ID from a DDoS Pro block/intercept event, the skill produces a complete analysis report identifying the blocking rule, its configuration, and actionable recommendations.

Verification Steps

1. Instance Discovery Verification

Command:

aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Success Indicator: Response contains Instances array with at least one valid DDoS Pro instance.

2. SLS and Log Store Status Verification

Command:

aliyun ddoscoo describe-sls-open-status --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
aliyun ddoscoo describe-log-store-exist-status --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Success Indicator: SLS is opened and log store exists.

3. SLS Logstore Info Verification

Command:

aliyun ddoscoo describe-sls-logstore-info --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Success Indicator: Response contains valid LogStore, ProjectName (or equivalent fields) with storage capacity and TTL info.

4. Domain Full Log Status Verification

Command:

aliyun ddoscoo describe-web-access-log-status --domain '<domain>' --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Success Indicator: Full log is enabled for the target domain.

5. Log Query Verification

Command:

python3 scripts/get_ddos_logs.py \
  --project <project-name> \
  --logstore <logstore-name> \
  --request-id <known-request-id> \
  --region <sls-region>

Success Indicator: Returns at least one log record containing request_traceid, block-related fields (cc_action, final_action, final_plugin, final_rule_id).

6. Rule Detail Verification

CC Rules:

aliyun ddoscoo describe-web-cc-rules-v2 --domain '<domain>' --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Precise Access Control:

aliyun ddoscoo describe-web-precise-access-rule --domains.1 '<domain>' --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Success Indicator: Response contains rule details (Name, Action/Act, Conditions).

7. End-to-End Verification

Process: Run the complete workflow with a known Request ID.

Success Indicator: Output report contains all required fields:

• Request ID, Block Time, Client IP (masked)
• Rule ID / Rule Type, Block Action
• Recommendations based on block type