This skill performs security inspection on DDoS security products under an Alibaba Cloud account, entirely through Aliyun CLI direct OpenAPI calls without any scripts or SDKs.
Default free protection for ECS/SLB, Region param: --ddos-region-id
DDoS Native Protection
ddosbgp
Paid upgrade, native IP-level protection, Region param: --biz-region-id or --region
DDoS Anti-DDoS Pro/Premium
ddoscoo
Dedicated Anti-DDoS IP, L4/L7 protection, Region param: --region
[MUST] Strict product routing isolation: APIs of the three products MUST NEVER be mixed. NEVER substitute ddoscoo APIs for ddosbgp queries or vice versa. If mixing is detected, abort immediately.
[MUST] ddosbgp endpoint routing: ddosbgp describe-instance-list default endpoint does NOT support mainland China Regions. You MUST specify --endpoint ddosbgp.cn-hangzhou.aliyuncs.com for ALL describe-instance-list calls.
IMPORTANT: ALL user-customizable parameters MUST be confirmed with the user before execution.
Parameter
Required/Optional
Description
Default
Inspection product scope
Optional
Basic/Native/Anti-DDoS Pro, default all
All
Time range
Optional
Inspection time window
Last 24 hours
Comparison mode
Optional
Day-over-day / week-over-week / custom
Day-over-day
Basic Protection instance-type
Optional
ecs/slb/eip/ipv6/swas/waf/ga_basic
ecs
Region Strategy
[MUST] ddosbgp Region traversal (dynamic + hardcoded fallback):
Hardcoded baseline (12 Regions, MUST NOT be reduced): cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1
Dynamic expansion: Call aliyun ddosbgp describe-regions (NOT ECS), union with baseline (only add, never subtract). If dynamic fetch fails, use baseline directly.
Count validation: Final list >= 12 Regions. ALL must be traversed, NEVER break due to empty/error.
antiddos-public: Query from cn-hangzhou only (centralized).
ddoscoo: MUST query both cn-hangzhou + ap-southeast-1.
[MUST] Loop rules: ALL Regions must be queried. On ANY error (InvalidRegionId/Empty/Throttling), log and continue — break/exit is FORBIDDEN. After loop, verify EXECUTED >= 12 (ddosbgp) or = 2 (ddoscoo). Log results immediately after each call — relying on memory is FORBIDDEN.
Empty result handling: Total: 0 → log "no instances", continue | Error code → log error, continue | Normal → extract instance IDs.
After traversal, compile Region -> Instance ID list mapping for Phase 4.
bash
# 2.1 Basic Protection assets
aliyun antiddos-public describe-instance-ip-address \
--ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 50
# 2.2 Native Protection - [MUST execute full loop in single bash]
BASELINE="cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1"
DYNAMIC=$(aliyun ddosbgp describe-regions 2>/dev/null | grep -o '"RegionId":"[^"]*"' | cut -d'"' -f4 | tr '\n' ' ')
if [ -n "$DYNAMIC" ]; then
ALL_REGIONS=$(echo "$BASELINE $DYNAMIC" | tr ' ' '\n' | sort -u | tr '\n' ' ')
else
ALL_REGIONS="$BASELINE"
fi
EXECUTED=0
for region in $ALL_REGIONS; do
# [MANDATORY] NEVER break/return/exit - on ANY error, MUST continue
echo "=== ddosbgp query $region ==="
# [CRITICAL] Must specify --endpoint for mainland China Regions
RESULT=$(aliyun ddosbgp describe-instance-list --page-no 1 --page-size 50 --region $region --endpoint ddosbgp.cn-hangzhou.aliyuncs.com 2>&1)
echo "$RESULT"
if echo "$RESULT" | grep -q "InvalidRegionId\|ErrorCode"; then
echo "[WARN] $region returned error, logged and continuing"
fi
EXECUTED=$((EXECUTED+1))
continue
done
echo "=== Regions executed: $EXECUTED ==="
# 2.3 Native Protection associated IPs (per discovered instance, uses --biz-region-id)
aliyun ddosbgp describe-pack-ip-list \
--instance-id <instance-id> --page-no 1 --page-size 50 --biz-region-id <region-id>
# 2.4 Anti-DDoS Pro instances [MUST query both Regions]
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region ap-southeast-1
# 2.5 Anti-DDoS Pro associated domains (per discovered instance)
aliyun ddoscoo describe-domains --instance-ids <instance-id> --region <region-id>
[MUST] End validation: 1) Region count: ddosbgp >= 12, ddoscoo = 2 2) Product isolation: no mixed API prefixes 3) Instance deduplication: Global instances (CoverageType=4) appear in every Region — deduplicate by InstanceId
Phase 3: Confirm Comparison Period
Ask user for comparison period, parse into second-precision Unix timestamps. [MUST] Use bash date command — manual calculation FORBIDDEN:
[MUST] Sequential Execution Guard: Execute API chains strictly in order for EACH instance. Do NOT stop at "planning" — every API MUST have an actual aliyun command executed with visible output. After each sub-step (4.1/4.2/4.3), print echo "[Step 4.X Complete]". Proceeding to 4.4/4.5 without all calls completed is FORBIDDEN.
[MUST] Route by inventory: No instances in ALL Regions → execute probe calls (--instance-id dummy) on cn-hangzhou to preserve trace, report "not provisioned". Some Regions have instances → inspect those, skip empty Regions. NEVER substitute product APIs.
4.1 Basic Protection Inspection
bash
# Has assets: real ID | No assets: probe call
aliyun antiddos-public describe-ddos-event-list \
--ddos-region-id <region-id> --instance-type <type> --instance-id <id> \
--current-page 1 --page-size 50
# Probe: --instance-id dummy --ddos-region-id cn-hangzhou --instance-type ecs
[MANDATORY CHECKPOINT 4.1] Confirm describe-ddos-event-list returned JSON or explicit error. If not executed, retry now. Do NOT proceed to 4.2 until confirmed.
[MANDATORY CHECKPOINT 4.2] You MUST now verify all 3 ddosbgp APIs were actually executed by checking terminal output. If describe-ddos-event OR describe-pack-ip-list OR describe-traffic has zero terminal output, STOP and execute the missing call(s) NOW. Two consecutive failures to complete all 3 → output error log and terminate. Do NOT proceed to 4.3 until all 3 confirmed.
Mandatory: Follow Report Template, no sections omitted. Group assets by Region.
[MUST] Data consistency validation:
Aggregation: Summary numbers must exactly match detail list counts
Deduplication: Same instance/IP across Regions → deduplicate before counting
Empty value annotation (hard rule): Empty array [] → write 0 (API returned empty) or Query failed (ErrorCode: XXX). FORBIDDEN: vague phrases like "no anomaly found", "appears to be a false alarm". Key metrics with empty data MUST include [DATA MISSING] tag at section start
Cross-validation: Summary totals = sum of Region details
Call record verification: Claimed API calls and conclusions must match actual execution. Fabrication FORBIDDEN
Raw Data Binding: Copy-paste exact values from terminal output into report. FORBIDDEN: inferring from memory, writing "no domains" if API returned domains. Use grep/jq to verify before finalizing
[MUST] Pre-computation verification (hard blocker):
[STRICT MODE] Directly writing echo "<number>" with pre-filled values is FORBIDDEN and counts as fabrication. You MUST use grep/jq/wc to parse actual terminal output or saved log. The verification script must contain pipe commands that extract real data, NOT hardcoded echo statements.
bash
# [STRICT] Count API calls from terminal history - must use grep, not hardcoded echo
echo "=== Call statistics ==="
# Example: grep -c "aliyun antiddos-public" /path/to/terminal.log (adapt to your log method)
echo "antiddos-public: $(grep -c 'antiddos-public' <<< "$TERMINAL_LOG")"
echo "ddosbgp: $(grep -c 'aliyun ddosbgp' <<< "$TERMINAL_LOG")"
echo "ddoscoo: $(grep -c 'aliyun ddoscoo' <<< "$TERMINAL_LOG")"
# [STRICT] Count assets from API responses - must use jq/grep, not hardcoded
echo "=== Asset statistics (from API JSON responses) ==="
# Parse actual JSON outputs, e.g.: jq '.InstanceList | length', jq '.DomainList | length'
Output must contain pipe commands (grep, jq, wc -l). Pure echo "number" without pipes = fabrication = abort.Mismatch with report draft → abort, re-traverse log, re-run. Report MUST quote the verification output snippet.
Cleanup
[MUST] Mandatory exit safeguard: Regardless of exit reason (success, failure, cancellation, timeout), the final step MUST unconditionally execute AI-Mode disable + verification. Highest priority, cannot be overridden.
bash
aliyun configure ai-mode disable
# Verify: try status command, if unsupported fall back to configure list
VERIFY=$(aliyun configure ai-mode status 2>&1)
if echo "$VERIFY" | grep -q "not a valid\|unknown\|error"; then
# Fallback: check via configure list output
aliyun configure list | grep -i "ai-mode\|agent"
fi
# If still uncertain, run disable again to be safe
aliyun configure ai-mode disable
[MUST] Only write "AI-Mode confirmed disabled" if verification succeeded. If both status and configure list fail to confirm, write "AI-Mode disable executed but verification inconclusive (CLI compatibility issue)" — do NOT claim confirmed.
