antiddos-public

--ddos-region-id

ddosbgp

--biz-region-id

--region

ddoscoo

--region

[MUST] Strict product routing isolation: APIs of the three products MUST NEVER be mixed. NEVER substitute

ddoscoo

APIs for

ddosbgp

queries or vice versa. If mixing is detected, abort immediately.

[MUST] ddosbgp endpoint routing:

ddosbgp describe-instance-list

default endpoint does NOT support mainland China Regions. You MUST specify

--endpoint ddosbgp.cn-hangzhou.aliyuncs.com

for ALL

describe-instance-list

calls.

[MUST] Easily confused API warning:

Scenario	Correct Command	Wrong Command (FORBIDDEN)
Native Protection attack events	ddosbgp describe-ddos-event (singular)	ddoscoo describe-ddos-events
Anti-DDoS Pro attack events	ddoscoo describe-ddos-events (plural)	ddosbgp describe-ddos-event

Aliyun CLI >= 3.3.3 required — see CLI Installation Guide. Credentials required — see CLI Credential Setup. Run

aliyun configure list

to verify. RAM permissions — see RAM Permission Policies.

[MUST] Permission Failure Handling: On permission errors: 1) Read

references/ram-policies.md

2) Use

ram-permission-diagnose

skill 3) Pause until user confirms permissions granted.

[MUST] AI-Mode lifecycle — Enable before any CLI invocation, disable at EVERY exit point:

bash

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddos-security-monitor"

IMPORTANT: ALL user-customizable parameters MUST be confirmed with the user before execution.

[MUST] ddosbgp Region traversal (dynamic + hardcoded fallback):

• Hardcoded baseline (12 Regions, MUST NOT be reduced):

  cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1

• Dynamic expansion: Call

  aliyun ddosbgp describe-regions

  (NOT ECS), union with baseline (only add, never subtract). If dynamic fetch fails, use baseline directly.
• Count validation: Final list >= 12 Regions. ALL must be traversed, NEVER break due to empty/error.

antiddos-public: Query from

cn-hangzhou

only (centralized). ddoscoo: MUST query both

cn-hangzhou

+

ap-southeast-1

.

[MUST] Loop rules: ALL Regions must be queried. On ANY error (InvalidRegionId/Empty/Throttling), log and

continue

— break/exit is FORBIDDEN. After loop, verify EXECUTED >= 12 (ddosbgp) or = 2 (ddoscoo). Log results immediately after each call — relying on memory is FORBIDDEN.

Empty result handling:

Total: 0

→ log "no instances", continue | Error code → log error, continue | Normal → extract instance IDs. After traversal, compile Region -> Instance ID list mapping for Phase 4.

undefined

[MANDATORY] NEVER break/return/exit - on ANY error, MUST continue

[CRITICAL] Must specify --endpoint for mainland China Regions

[MUST] Sequential Execution Guard: Execute API chains strictly in order for EACH instance. Do NOT stop at "planning" — every API MUST have an actual

aliyun

command executed with visible output. After each sub-step (4.1/4.2/4.3), print

echo "[Step 4.X Complete]"

. Proceeding to 4.4/4.5 without all calls completed is FORBIDDEN.

[MUST] Route by inventory: No instances in ALL Regions → execute probe calls (

--instance-id dummy

) on cn-hangzhou to preserve trace, report "not provisioned". Some Regions have instances → inspect those, skip empty Regions. NEVER substitute product APIs.

[MUST]

ddosbgp

APIs only. Attack events:

describe-ddos-event

(singular). L4 traffic:

describe-traffic

(MUST call). Region params: describe-ddos-event/describe-pack-ip-list use

--biz-region-id

; describe-traffic uses

--region

. Has instances → all 3 APIs per instance | ALL empty → 3 probe calls on cn-hangzhou (all required)

aliyun ddosbgp describe-ddos-event \
  --instance-id <id> --start-time <ts> --end-time <ts> \
  --page-no 1 --page-size 50 --biz-region-id <region-id>
aliyun ddosbgp describe-pack-ip-list \
  --instance-id <id> --page-no 1 --page-size 50 --biz-region-id <region-id>
aliyun ddosbgp describe-traffic \
  --instance-id <id> --start-time <ts> --end-time <ts> --region <region-id>

[MUST]

ddoscoo

APIs only. Has instances → all APIs per instance | Both Regions empty → probe calls on cn-hangzhou

aliyun ddoscoo describe-ddos-events \
  --instance-ids <id> --start-time <ts> --end-time <ts> \
  --page-number 1 --page-size 50 --region <region-id>
aliyun ddoscoo describe-domain-qps-list \
  --start-time <ts> --end-time <ts> --interval 300 --region <region-id>
aliyun ddoscoo describe-port-flow-list \
  --instance-ids <id> --start-time <ts> --end-time <ts> \
  --interval 300 --region <region-id>
aliyun ddoscoo describe-domain-status-code-list \
  --start-time <ts> --end-time <ts> --interval 300 \
  --query-type gf --region <region-id>
aliyun ddoscoo describe-domain-status-code-list \
  --start-time <ts> --end-time <ts> --interval 300 \
  --query-type upstrem --region <region-id>

Mandatory: Follow Report Template, no sections omitted. Group assets by Region.

[MUST] Data consistency validation:

1. Aggregation: Summary numbers must exactly match detail list counts
2. Deduplication: Same instance/IP across Regions → deduplicate before counting
3. Empty value annotation (hard rule): Empty array

   []

   → write

   0 (API returned empty)

   or

   Query failed (ErrorCode: XXX)

   . FORBIDDEN: vague phrases like "no anomaly found", "appears to be a false alarm". Key metrics with empty data MUST include

   [DATA MISSING]

   tag at section start
4. Cross-validation: Summary totals = sum of Region details
5. Call record verification: Claimed API calls and conclusions must match actual execution. Fabrication FORBIDDEN
6. Raw Data Binding: Copy-paste exact values from terminal output into report. FORBIDDEN: inferring from memory, writing "no domains" if API returned domains. Use

   grep

   /

   jq

   to verify before finalizing

[MUST] Pre-computation verification (hard blocker): [STRICT MODE] Directly writing

echo "<number>"

with pre-filled values is FORBIDDEN and counts as fabrication. You MUST use

grep

/

jq

/

wc

to parse actual terminal output or saved log. The verification script must contain pipe commands that extract real data, NOT hardcoded echo statements.

bash

# [STRICT] Count API calls from terminal history - must use grep, not hardcoded echo
echo "=== Call statistics ==="
# Example: grep -c "aliyun antiddos-public" /path/to/terminal.log  (adapt to your log method)
echo "antiddos-public: $(grep -c 'antiddos-public' <<< "$TERMINAL_LOG")"
echo "ddosbgp: $(grep -c 'aliyun ddosbgp' <<< "$TERMINAL_LOG")"
echo "ddoscoo: $(grep -c 'aliyun ddoscoo' <<< "$TERMINAL_LOG")"
# [STRICT] Count assets from API responses - must use jq/grep, not hardcoded
echo "=== Asset statistics (from API JSON responses) ==="
# Parse actual JSON outputs, e.g.: jq '.InstanceList | length', jq '.DomainList | length'

Output must contain pipe commands (

grep

,

jq

,

wc -l

). Pure

echo "number"

without pipes = fabrication = abort. Mismatch with report draft → abort, re-traverse log, re-run. Report MUST quote the verification output snippet.

[MUST] Mandatory exit safeguard: Regardless of exit reason (success, failure, cancellation, timeout), the final step MUST unconditionally execute AI-Mode disable + verification. Highest priority, cannot be overridden.

aliyun configure ai-mode disable

Fallback: check via configure list output