/alibabacloud-apigw-inspection

name: alibabacloud-apigw-inspection
description: |
  Perform instance inspection on Alibaba Cloud Cloud-Native API Gateway, AI Gateway, and API Gateway, and query Cloud Monitor metric data. Use when the user needs to view monitoring metrics of gateway instances (such as CPU usage, memory usage, connections, network IO, bandwidth, rate limiting, etc.), obtain metric data for a specific point in time or time range, or evaluate resource utilization.
  Trigger scenarios include: "check if the Cloud-Native API Gateway has enough resources", "view monitoring data of the AI Gateway instance", "inspect this API Gateway instance", "how is the gateway performing", "check if the gateway has any anomalies", "check gateway health status", etc.

Cloud-Native API Gateway / AI Gateway / API Gateway Instance Inspection

Scenario Description

Perform health inspection on Alibaba Cloud gateway instances, retrieve monitoring metric data, and generate inspection reports.

**Architecture**: `Cloud Monitor (CMS) + API Gateway (cloudapi) + Cloud-Native API Gateway / AI Gateway (apig)`

**Supported Product Types**: | Product Type | Instance ID Format | Query Command | |---------|-----------|----------| | Cloud-Native API Gateway | gw-xxxxxxx | `aliyun apig list-gateways` | | AI Gateway | gw-xxxxxxx | `aliyun apig list-gateways` | | API Gateway (Dedicated) | apigateway-xx-xxxxxxx | `aliyun cloudapi describe-instances` |

> **Note**: API Gateway shared instances (VPC_SHARED) do not support inspection. Only dedicated instances (VPC_DEDICATED) are supported.

---

Installation

**Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > follow the upgrade/installation instructions below.

**Upgrade / Install Aliyun CLI** (choose one based on your platform):

• **macOS (Homebrew)**:

  brew install aliyun-cli        # fresh install
  brew upgrade aliyun-cli        # upgrade existing

• **Linux / macOS (binary)**:

  curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

• **Windows (PowerShell)**:

  Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"
  Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

After upgrade, verify with `aliyun version`. For more platforms and detailed instructions, see `references/cli-installation-guide.md`.

**Pre-check: Aliyun CLI plugin update required** > [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

---

Observability (MUST follow for every aliyun command)

Upon loading this skill, generate a random session ID (32-char lowercase hex string) once for the entire session. Use it as `{session-id}` below.

**Rule: Every `aliyun` CLI command that calls a cloud API MUST include the `--user-agent` flag.**

Local utility commands (e.g. `configure`, `plugin`, `version`) do not support this flag and should be excluded.

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-apigw-inspection/{session-id}

---

Environment Variables

No additional environment variables required. Credentials are configured via `aliyun configure`.

---

Authentication

> **Pre-check: Alibaba Cloud Credentials Required** > > **Security Rules:** > - **NEVER** read, echo, or print AK/SK values (e.g., `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` is FORBIDDEN) > - **NEVER** ask the user to input AK/SK directly in the conversation or command line > - **NEVER** use `aliyun configure set` with literal credential values > - **ONLY** use `aliyun configure list` to check credential status > > ```bash > aliyun configure list > ``` > Check the output for a valid profile (AK, STS, or OAuth identity). > > **If no valid profile exists, STOP here.** > 1. Obtain credentials from [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak) > 2. Configure credentials **outside of this session** (via `aliyun configure` in terminal or environment variables in shell profile) > 3. Return and re-run after `aliyun configure list` shows a valid profile

---

RAM Permission Policy

This skill only involves read-only operations and requires the following minimum RAM permissions:

| Product | RAM Action | Description | |------|-----------|------| | API Gateway | apigateway:DescribeInstances | List API Gateway instances | | API Gateway | apigateway:DescribeInstanceDropPacket | View dropped packet count | | API Gateway | apigateway:DescribeInstanceDropConnections | View dropped connection count | | API Gateway | apigateway:DescribeInstanceSlbConnect | View concurrent connection count | | API Gateway | apigateway:DescribeInstanceTraffic | View traffic information | | API Gateway | apigateway:DescribeInstanceQps | View QPS data | | Cloud-Native API Gateway / AI Gateway | apig:ListGateways | Query gateway list | | Cloud Monitor | cms:QueryMetricData | Query monitoring data |

Full policy document: [references/ram-policies.md](references/ram-policies.md)

> **[MUST] Permission Failure Handling:** When any command or API call fails due to permission errors at any point during execution, follow this process: > 1. Read `references/ram-policies.md` to get the full list of permissions required by this SKILL > 2. Use `ram-permission-diagnose` skill to guide the user through requesting the necessary permissions > 3. Pause and wait until the user confirms that the required permissions have been granted

---

Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call, > ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks, > passwords, domain names, resource specifications, etc.) MUST be confirmed with the > user. Do NOT assume or use default values without explicit user approval.

| Parameter | Required/Optional