
Alicloud Security Cloudfw
- 262 installs
- 396 repo stars
- Updated July 18, 2026
- cinience/alicloud-skills
alicloud-security-cloudfw is an agent skill that deploys and tunes Alibaba Cloud Firewall policies to control north-south traffic, segment workloads, and enforce allow-deny rules.
About
alicloud-security-cloudfw is a cinience/alicloud-skills skill for Alibaba Cloud Firewall. It helps developers deploy firewall policies, control north-south traffic, segment workloads, and enforce allow-deny rules ahead of production exposure or compliance reviews. Use it when moving Alibaba Cloud services toward production rather than relying on default wide-open security groups. Combine skill guidance with your network topology diagrams and Alibaba Cloud Firewall console or API documentation for rule specificity and audit evidence.
- Cloud Firewall policy design
- North-south traffic control
- Workload segmentation rules
- Audit-ready allow-deny lists
- Pre-launch perimeter hardening
Alicloud Security Cloudfw by the numbers
- 262 all-time installs (skills.sh)
- Ranked #664 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/cinience/alicloud-skills --skill alicloud-security-cloudfwAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 262 |
|---|---|
| repo stars | ★ 396 |
| Last updated | July 18, 2026 |
| Repository | cinience/alicloud-skills ↗ |
How do you configure Alibaba Cloud Firewall policies?
Deploy and tune Alibaba Cloud Firewall policies to control north-south traffic, segment workloads, and enforce allow-deny rules before production exposure or compliance audits.
Who is it for?
Security-minded platform engineers preparing Alibaba Cloud workloads for production or compliance audits.
Skip if: Local-only prototypes without Alibaba Cloud networking or teams that only need application unit test coverage.
When should I use this skill?
User asks to deploy, tune, or audit Alibaba Cloud Firewall policies and north-south traffic rules.
What you get
Cloud Firewall policy sets, segmented workload rules, and north-south traffic control configurations.
- Firewall policy configurations
- Segmented network rule sets
Files
Category: service
Cloud Firewall
Use Alibaba Cloud OpenAPI (RPC) with official SDKs or OpenAPI Explorer to manage resources for Cloud Firewall.
Workflow
1) Confirm region, resource identifiers, and desired action. 2) Discover API list and required parameters (see references). 3) Call API with SDK or OpenAPI Explorer. 4) Verify results with describe/list APIs.
AccessKey priority (must follow)
1) Environment variables: ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET / ALICLOUD_REGION_ID Region policy: ALICLOUD_REGION_ID is an optional default. If unset, decide the most reasonable region for the task; if unclear, ask the user. 2) Shared config file: ~/.alibabacloud/credentials
API discovery
- Product code:
Cloudfw - Default API version:
2017-12-07 - Use OpenAPI metadata endpoints to list APIs and get schemas (see references).
High-frequency operation patterns
1) Inventory/list: prefer List* / Describe* APIs to get current resources. 2) Change/configure: prefer Create* / Update* / Modify* / Set* APIs for mutations. 3) Status/troubleshoot: prefer Get* / Query* / Describe*Status APIs for diagnosis.
Minimal executable quickstart
Use metadata-first discovery before calling business APIs:
python scripts/list_openapi_meta_apis.pyOptional overrides:
python scripts/list_openapi_meta_apis.py --product-code <ProductCode> --version <Version>The script writes API inventory artifacts under the skill output directory.
Output policy
If you need to save responses or generated artifacts, write them under: output/alicloud-security-cloudfw/
Validation
mkdir -p output/alicloud-security-cloudfw
for f in skills/security/firewall/alicloud-security-cloudfw/scripts/*.py; do
python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/alicloud-security-cloudfw/validate.txtPass criteria: command exits 0 and output/alicloud-security-cloudfw/validate.txt is generated.
Output And Evidence
- Save artifacts, command outputs, and API response summaries under
output/alicloud-security-cloudfw/. - Include key parameters (region/resource id/time range) in evidence files for reproducibility.
Prerequisites
- Configure least-privilege Alibaba Cloud credentials before execution.
- Prefer environment variables:
ALICLOUD_ACCESS_KEY_ID,ALICLOUD_ACCESS_KEY_SECRET, optionalALICLOUD_REGION_ID. - If region is unclear, ask the user before running mutating operations.
References
- Sources:
references/sources.md
interface:
display_name: "Alibaba Cloud Security CloudFW"
short_description: "Cloud firewall policy workflows"
default_prompt: "Use $alicloud-security-cloudfw to complete this security/firewall task on Alibaba Cloud."
Sources
- OpenAPI product page:
https://api.aliyun.com/product/Cloudfw - API list (metadata):
https://api.aliyun.com/meta/v1/products/Cloudfw/versions/2017-12-07/api-docs.json - API definition (single API):
https://api.aliyun.com/meta/v1/products/Cloudfw/versions/2017-12-07/apis/{ApiName}/api.json
#!/usr/bin/env python3
"""Fetch OpenAPI metadata API list for one product/version and save to output/.
Env:
- OPENAPI_META_TIMEOUT (seconds, default: 20)
"""
from __future__ import annotations
import argparse
import json
import os
import pathlib
import urllib.request
DEFAULT_PRODUCT_CODE = "Cloudfw"
DEFAULT_VERSION = "2017-12-07"
OUTPUT_DIR = pathlib.Path("output/alicloud-security-cloudfw")
def fetch_json(url: str, timeout: int) -> dict:
req = urllib.request.Request(url, headers={"User-Agent": "codex-skill"})
with urllib.request.urlopen(req, timeout=timeout) as resp:
return json.loads(resp.read().decode("utf-8"))
def main() -> None:
parser = argparse.ArgumentParser()
parser.add_argument("--product-code", default=DEFAULT_PRODUCT_CODE)
parser.add_argument("--version", default=DEFAULT_VERSION)
parser.add_argument("--output-dir", default=str(OUTPUT_DIR))
args = parser.parse_args()
timeout = int(os.getenv("OPENAPI_META_TIMEOUT", "20"))
output_dir = pathlib.Path(args.output_dir)
output_dir.mkdir(parents=True, exist_ok=True)
url = (
f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
f"/versions/{args.version}/api-docs.json"
)
payload = fetch_json(url, timeout)
raw_apis = payload.get("apis", {})
if isinstance(raw_apis, dict):
api_names = sorted(raw_apis.keys())
elif isinstance(raw_apis, list):
names = []
for item in raw_apis:
if isinstance(item, dict):
name = item.get("name") or item.get("apiName")
if name:
names.append(name)
elif isinstance(item, str):
names.append(item)
api_names = sorted(set(names))
else:
api_names = []
json_file = output_dir / f"{args.product_code}_{args.version}_api_docs.json"
md_file = output_dir / f"{args.product_code}_{args.version}_api_list.md"
json_file.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8")
md_lines = [
f"# {args.product_code} {args.version} API List",
"",
f"- Source: {url}",
f"- API count: {len(api_names)}",
"",
]
md_lines.extend([f"- `{name}`" for name in api_names])
md_file.write_text("\n".join(md_lines) + "\n", encoding="utf-8")
print(f"Saved: {json_file}")
print(f"Saved: {md_file}")
if __name__ == "__main__":
main()
Related skills
FAQ
What does alicloud-security-cloudfw help deploy?
alicloud-security-cloudfw deploys and tunes Alibaba Cloud Firewall policies for north-south traffic control, workload segmentation, and allow-deny enforcement before production or compliance audits.
When should developers use Cloud Firewall skill?
Use alicloud-security-cloudfw when hardening Alibaba Cloud networks for production or audits, not for local dev environments without cloud firewall resources.