Alibabacloud Network Reachability Analysis

NIS Network Reachability Analysis / NIS 网络可达性分析

Language / 语言: Respond in the same language the user uses.

If the user speaks Chinese, use the Chinese (zh-CN) prompts below.

If the user speaks English, use the English (en) prompts below.

Guides an agent through interactive network reachability analysis using Alibaba Cloud NIS. Covers forward/reverse path analysis, topology visualization (Mermaid), and monitoring diagnostics for resources along the path.

Architecture: NIS (CreateAndAnalyzeNetworkPath + GetNetworkReachableAnalysis) + CloudMonitor (DescribeMetricData)

⚠️ CRITICAL / 关键: READ-ONLY OPERATIONS ONLY

>

This skill performs read-only network diagnostics. DO NOT create, modify, or delete any cloud resources.

>

本技能仅执行只读网络诊断操作。严禁创建、修改或删除任何云资源。

>

Allowed: CreateAndAnalyzeNetworkPath, GetNetworkReachableAnalysis, DescribeMetricData, Describe* APIs

>

允许：分析任务创建与查询、监控数据查询、Describe* 类查询 API

>

Forbidden: Create* (except CreateAndAnalyzeNetworkPath), Modify*, Delete*, Start*, Stop*, Run* APIs

>

禁止：创建类 API（除 CreateAndAnalyzeNetworkPath 外）、修改、删除、启停、执行类 API

Installation

Pre-check: Aliyun CLI >= 3.3.1 required

Run aliyun version to verify >= 3.3.1. If not installed or version too low,

see references/cli-installation-guide.md for installation instructions.

Then [MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

aliyun version
aliyun configure set --auto-plugin-install true

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list --user-agent AlibabaCloud-Agent-Skills

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

RAM Permissions

See references/ram-policies.md for the full RAM policy.

Required actions: nis:CreateAndAnalyzeNetworkPath, nis:GetNetworkReachableAnalysis, cms:DescribeMetricData.

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., RegionId, instance IDs, IP addresses,

protocol, ports, resource types, etc.) MUST be confirmed with the user.

Do NOT assume or use default values without explicit user approval.

Collect the following parameters interactively:

Interactive Collection Logic / 交互收集逻辑

Use the prompts matching the user's language:

Step 1 — Ask resource types / 询问资源类型

Step 2 — Type-specific prompts / 按类型提示

Step 3 — Protocol & ports / 协议和端口

Core Workflow

Step 1: Forward Path Analysis / 正向路径分析

aliyun nis create-and-analyze-network-path \
  --source-id <SourceId> \
  --source-type <SourceType> \
  --target-id <TargetId> \
  --target-type <TargetType> \
  --protocol <Protocol> \
  --target-port <TargetPort> \
  --source-ip-address <SourceIpAddress> \
  --target-ip-address <TargetIpAddress> \
  --region <RegionId> \
  --user-agent AlibabaCloud-Agent-Skills

Omit --source-ip-address / --target-ip-address if SourceType/TargetType is not vpn or vbr.

Omit --target-port if Protocol is icmp.

Record the returned NetworkReachableAnalysisId.

⚠️ MANDATORY / 强制: ALWAYS perform reverse path analysis after forward analysis completes.

>

MUST execute Step 3 (Reverse Path Analysis) immediately after Step 2 finishes. Do NOT skip or omit reverse path check.

>

必须在正向分析完成后立即执行 Step 3（反向路径分析）。严禁跳过或省略反向路径检查。

Step 2: Poll for Forward Result / 轮询正向结果

aliyun nis get-network-reachable-analysis \
  --network-reachable-analysis-id <ForwardAnalysisId> \
  --region <RegionId> \
  --user-agent AlibabaCloud-Agent-Skills

Repeat until NetworkReachableAnalysisStatus is finish. Extract Reachable, NetworkReachableAnalysisResult.

Step 3: Reverse Path Analysis / 反向路径分析

Swap source and target / 交换源和目的:

• Forward SourceId/Type → Reverse TargetId/Type
• Forward TargetId/Type → Reverse SourceId/Type
• Forward SourceIpAddress → Reverse TargetIpAddress
• Forward TargetIpAddress → Reverse SourceIpAddress

Port handling / 端口处理:

• Reverse --source-port = Forward TargetPort (server listening port / 服务端监听端口)
• Reverse --target-port = Random ephemeral port in range 49152 ~ 65535 (client ephemeral port / 客户端随机端口)

Since the client initiates the connection with a dynamically assigned ephemeral port, the reverse path (server → client) should use a random port in the ephemeral range (49152-65535) as the target port to simulate real return traffic.

>

由于客户端发起连接时使用动态分配的临时端口，反向路径（服务端→客户端）的目的端口应使用临时端口范围（49152-65535）内的随机值来模拟真实回程流量。

aliyun nis create-and-analyze-network-path \
  --source-id <OriginalTargetId> \
  --source-type <OriginalTargetType> \
  --target-id <OriginalSourceId> \
  --target-type <OriginalSourceType> \
  --protocol <Protocol> \
  --source-port <OriginalTargetPort> \
  --target-port <RandomPort_49152_to_65535> \
  --source-ip-address <OriginalTargetIpAddress> \
  --target-ip-address <OriginalSourceIpAddress> \
  --region <RegionId> \
  --user-agent AlibabaCloud-Agent-Skills

Omit --source-ip-address / --target-ip-address if SourceType/TargetType is not vpn or vbr.

若源/目的类型不是 vpn 或 vbr，可省略 --source-ip-address / --target-ip-address。

Step 4: Poll for Reverse Result / 轮询反向结果

Same as Step 2, using the reverse NetworkReachableAnalysisId.

Step 5: Result Interpretation / 结果解读

CRITICAL / 关键: Always use topologyData.positive from the actively initiated analysis task.

IGNORE topologyData.reverse in any response — it is unreliable.

>

始终使用主动发起的分析任务返回的 topologyData.positive。

忽略任何响应中的 topologyData.reverse——它不可靠。

For each direction (forward/reverse) / 对正向和反向分别：

1. Check Reachable field. If true, path is connected. / 检查 Reachable 字段，true 表示可达。 2. If false, analyze from NetworkReachableAnalysisResult: / 若为 false，分析以下字段定位阻断点：

• errorCode — root cause code / 根因错误码
• securityGroupData — security group rules blocking traffic / 安全组拦截规则
• routeData — route table entries causing drops / 路由表丢包条目

Step 6: Topology Visualization / 拓扑可视化 (Mermaid)

Generate a Mermaid diagram from topologyData.positive:

graph LR

• Nodes: Extract nodeType and bizInsId from nodeList
• Links: Build directional edges from linkList

Example:

graph LR
    ECS_i-src["ECS: i-bp1xxx"] --> VRouter_vrt-1["VRouter: vrt-xxx"]
    VRouter_vrt-1 --> VSW_vsw-1["VSW: vsw-xxx"]
    VSW_vsw-1 --> ENI_eni-1["ENI: eni-xxx"]
    ENI_eni-1 --> ECS_i-dst["ECS: i-bp2xxx"]

Step 7: Resource Monitoring Diagnostics / 途经资源监控诊断

For resource IDs found in topologyData, if they match the prefixes below, query monitoring data for the last 1 hour: 对 topologyData 中途经的资源 ID，若匹配以下前缀，查询最近 1 小时监控数据：

Query command (CMS uses PascalCase API-style, not plugin mode):

aliyun cms DescribeMetricData \
  --Namespace <Namespace> \
  --MetricName <MetricName> \
  --Dimensions '[{"instanceId":"<ResourceId>"}]' \
  --StartTime <1HourAgoTimestamp> \
  --EndTime <NowTimestamp> \
  --Period 60 \
  --user-agent AlibabaCloud-Agent-Skills

Rate limit: 10 calls/second per account. Batch queries across multiple metrics should be paced accordingly.

Cleanup / 清理

NIS reachability analysis is read-only — no cloud resources are created or modified. No cleanup is required. NIS 可达性分析为只读操作——不会创建或修改任何云资源，无需清理。

Constraints / 使用限制

1. IPv4 only / 仅支持 IPv4 — Only IPv4 path analysis is supported. 2. Unidirectional / 单向分析 — Each analysis is one-way; reverse path requires a separate task with swapped source/target. 3. CMS quota / CMS 配额 — DescribeMetricData shares 1,000,000 free calls/month with other CMS query APIs. 4. CMS rate limit / CMS 频控 — 10 calls/second per account (including RAM users).

Best Practices / 最佳实践

1. Always perform both forward and reverse analysis to confirm bidirectional connectivity. / 始终执行正向+反向分析以确认双向连通性。 2. When path is unreachable, check security group rules and route tables first. / 路径不可达时，优先检查安全组规则和路由表。 3. For vpn/vbr scenarios, always provide On-Premise IP. / vpn/vbr 场景务必提供云下私网 IP。 4. Use Mermaid topology diagrams to visualize traffic paths. / 使用 Mermaid 拓扑图帮助用户可视化流量路径。 5. Query monitoring data only for resources on the actual path. / 仅查询实际路径上的资源监控数据以减少 API 调用。 6. Present monitoring anomalies alongside reachability results. / 将监控异常与可达性结果一并呈现，提供完整诊断。

References / 参考文件

Acceptance Criteria: nis-reachability-analysis

Scenario: Network Reachability Analysis with NIS Purpose: Skill testing acceptance criteria

---

Correct CLI Command Patterns

1. NIS Product — verify nis exists as product

aliyun nis --help
# Must show available commands including create-and-analyze-network-path, get-network-reachable-analysis

2. create-and-analyze-network-path — verify command and parameters

CORRECT

aliyun nis create-and-analyze-network-path \
  --source-id i-bp1xxxxx \
  --source-type ecs \
  --target-id i-bp2xxxxx \
  --target-type ecs \
  --protocol tcp \
  --target-port 80 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

INCORRECT — Using API-style command name

# Wrong: API style, not plugin mode
aliyun nis CreateAndAnalyzeNetworkPath --SourceId i-bp1xxxxx ...

INCORRECT — Missing --user-agent

# Wrong: missing --user-agent AlibabaCloud-Agent-Skills
aliyun nis create-and-analyze-network-path --source-id i-bp1xxxxx --source-type ecs

3. get-network-reachable-analysis — verify command and parameters

CORRECT

aliyun nis get-network-reachable-analysis \
  --network-reachable-analysis-id nra-xxxxx \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

INCORRECT — Wrong parameter name

# Wrong: --analysis-id does not exist
aliyun nis get-network-reachable-analysis --analysis-id nra-xxxxx

4. SourceType/TargetType enum values

CORRECT values

• ecs, internetIp, vsw, vpn, vbr (for source)
• ecs, internetIp, vsw, vpn, vbr, clb (for target)

INCORRECT — non-existent types

# Wrong: "slb" is not valid, use "clb"
--target-type slb
# Wrong: "eip" is not valid, use "internetIp"
--source-type eip

5. CMS DescribeMetricData — verify parameters

CORRECT

aliyun cms DescribeMetricData \
  --Namespace acs_ecs_dashboard \
  --MetricName CPUUtilization \
  --Dimensions '[{"instanceId":"i-bp1xxxxx"}]' \
  --user-agent AlibabaCloud-Agent-Skills

INCORRECT — CMS uses PascalCase parameters (NOT plugin mode)

# Wrong: CMS does not have a plugin, so it uses API-style PascalCase parameters
aliyun cms describe-metric-data --namespace acs_ecs_dashboard

---

Workflow Logic Criteria

Reverse Path Port Swap

CORRECT

Forward: --source-port 12345 --target-port 80 Reverse: --source-port 80 --target-port 12345 (ports swapped along with source/target)

INCORRECT

Reverse: --source-port 12345 --target-port 80 (ports NOT swapped)

Result Interpretation

CORRECT

• Use only topologyData.positive from the actively initiated reverse analysis task
• Ignore topologyData.reverse in any response (unreliable)

INCORRECT

• Relying on topologyData.reverse from the forward analysis response

VPN/VBR On-Premise IP

CORRECT

When source/target is vpn or vbr, MUST also set --source-ip-address / --target-ip-address for the On-Premise IP.

INCORRECT

Only setting --source-id for vpn/vbr without the On-Premise IP.

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.1+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.1 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.1)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.1+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies

Required Permissions

The following RAM policy grants the minimum permissions needed for NIS reachability analysis and CloudMonitor metric queries.

NIS Permissions

CloudMonitor Permissions

Recommended RAM Policy

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "nis:CreateAndAnalyzeNetworkPath",
        "nis:GetNetworkReachableAnalysis"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cms:DescribeMetricData"
      ],
      "Resource": "*"
    }
  ]
}

Notes

• NIS reachability analysis is read-only and does not modify any network resources.
• DescribeMetricData shares a monthly free quota of 1,000,000 calls with other CloudMonitor query APIs.
• Per-account rate limit for DescribeMetricData: 10 calls/second.

Verification Method

Step 1: Verify Forward Path Analysis

Run a forward path analysis between two known-reachable resources (e.g., two ECS instances in the same VPC):

aliyun nis create-and-analyze-network-path \
  --source-id <SourceEcsId> \
  --source-type ecs \
  --target-id <TargetEcsId> \
  --target-type ecs \
  --protocol tcp \
  --target-port 80 \
  --region <RegionId> \
  --user-agent AlibabaCloud-Agent-Skills

Expected: Returns NetworkReachableAnalysisId.

Step 2: Poll for Result

aliyun nis get-network-reachable-analysis \
  --network-reachable-analysis-id <AnalysisId> \
  --region <RegionId> \
  --user-agent AlibabaCloud-Agent-Skills

Expected: NetworkReachableAnalysisStatus transitions from init to finish. Reachable is true for known-reachable paths.

Step 3: Verify Reverse Path Analysis

Swap source and target, swap ports:

aliyun nis create-and-analyze-network-path \
  --source-id <TargetEcsId> \
  --source-type ecs \
  --target-id <SourceEcsId> \
  --target-type ecs \
  --protocol tcp \
  --source-port 80 \
  --region <RegionId> \
  --user-agent AlibabaCloud-Agent-Skills

Expected: Returns a new NetworkReachableAnalysisId for the reverse path.

Step 4: Verify Monitoring Data Query

aliyun cms DescribeMetricData \
  --Namespace acs_ecs_dashboard \
  --MetricName CPUUtilization \
  --Dimensions '[{"instanceId":"<EcsInstanceId>"}]' \
  --user-agent AlibabaCloud-Agent-Skills

Expected: Returns monitoring data points with timestamps and values.

Step 5: Verify Mermaid Topology Output

After obtaining topologyData.positive from GetNetworkReachableAnalysis, verify:

• nodeList contains source, destination, and intermediate nodes
• linkList contains directional connections
• Generated Mermaid graph LR diagram renders correctly