/alibabacloud-ecs-vpc-publicnetwork-troubleshoot

name: alibabacloud-ecs-vpc-publicnetwork-troubleshoot
description: Diagnose Alibaba Cloud ECS public network access problems and VPC cloud service public network access problems. Covers ECS public network access, ECS public IP reachability, and ECS security group blocking (automatically handling the NAT-gateway egress path for instances without a public IP); and VPC cloud service public network access with NAT gateway, SNAT, route and EIP checks for DataWorks, SAE, ACK and other services. Use this when troubleshooting public network connectivity failures for ECS instances or VPC cloud services.

ECS/VPC Public Network Connectivity Troubleshooting

Automated diagnosis of public network connectivity for Alibaba Cloud ECS instances and VPC cloud services. **Two core capabilities only:**

1. **ECS public network diagnosis** — full-chain check for an ECS instance covering public IP reachability and security-group blocking; the NAT-gateway egress path for instances without a public IP is handled automatically as a sub-path (the script picks Branch A / Branch B by itself). 2. **VPC cloud service public network diagnosis** — public egress check for a cloud service (DataWorks / SAE / ACK, etc.) behind a VSwitch (NAT gateway / SNAT / route / EIP).

Execution Principle (script-only, no fallback)

All diagnostic operations MUST be performed by invoking the bundled Python scripts under `scripts/`. There are exactly three:

| Allowed invocation | Purpose | |--------------------|---------| | `python3 scripts/sts_create.py` | Obtain/validate credentials (runs first) | | `python3 scripts/ecs_public_troubleshoot.py` | ECS public network diagnosis | | `python3 scripts/vpc_service_public_troubleshoot.py` | VPC cloud service diagnosis |

**Forbidden — do NOT** reproduce the diagnostic logic by any other means (each is a structural violation, even if the output looks correct):

• running `aliyun ecs ...` / `aliyun vpc ...` / `aliyun natgateway ...` / `aliyun antiddos-public ...` / `aliyun cloudfw ...` / `aliyun bssopenapi ...` or any other `aliyun` CLI command for diagnosis;
• running `aliyun configure get` or any command to fetch credentials manually;
• writing numbered/ad-hoc helper scripts (`01_describe_ecs.sh`, ...) or inline SDK/`curl`/HTTP code.

If a script fails (non-zero exit, no JSON, credential/authorization error), **stop and report the error** — never fall back to any of the above.

Credentials (do not handle manually)

`sts_create.py` runs first and writes credentials to the local cache `scripts/.sts_cache.json`. The two main scripts (`ecs_public_troubleshoot.py`, `vpc_service_public_troubleshoot.py`) **read that cache automatically**. The agent MUST NOT:

• export `ALIBABA_CLOUD_*` variables manually, pass `--access-key-id` / `--access-key-secret` / `--sts-token` (the scripts do not accept them), or run `aliyun configure get`;
• echo plaintext AK/SK/token on the command line.

If `sts_create.py` fails, abort immediately and report the credential/authorization error.

User Confirmation (required before any API call)

This skill makes **read-only** Alibaba Cloud API calls only (`Describe*` / `GetCallerIdentity` queries); it never creates, modifies, deletes, restarts, or otherwise changes any resource. Before invoking any script:

1. **Restate the diagnostic scope** to the user — the target resource (`instance_id` / `vswitch_id`), the `region_id`, and that only read-only diagnostic APIs will be called against that single resource. 2. **Obtain confirmation to proceed.** An explicit diagnostic request that already names the target resource is sufficient authorization: restate the scope and proceed. If the target or scope is ambiguous, or the user has not clearly authorized the check, **ask the user and wait for confirmation before making any API call**. 3. Never call any API before this confirmation, and never expand scope beyond the confirmed resource.

Trigger Conditions

• ECS cannot access / be accessed from the public network; public IP reachability issues
• ECS ping / connectivity timeout to the public network; NAT gateway / SNAT outbound issues
• Security group blocking public access to an ECS instance
• VPC cloud service (DataWorks / SAE / ACK) cannot access the public network

Input Parameters

| Parameter | Type | Required | Description | Example | |-----------|------|----------|-------------|---------| | region_id | string | Yes | Alibaba Cloud region ID | cn-hangzhou | | test_scenario | string | Yes | `ecs_public` / `vpc_service_public` (inferred from identifiers) | ecs_public | | instance_id | string | ECS scenario | ECS instance ID | i-bp116m5pkhsle6xm5pl8 | | vswitch_id | string | VPC scenario | VSwitch ID | vsw-bp1xat3xsvck79y8zo8yo | | uid | string | No | Account UID (auto-obtained from credentials if omitted) | 1552974654746705 | | service_type | string | No | Cloud service type (VPC scenario): dataworks / sae / ack / others | dataworks | | output_format | string | No | table / json / markdown | table |

**Mandatory-parameter gate**: `region_id` plus the scenario identifier (`instance_id` for ECS, `vswitch_id` for VPC) are required. Extract everything already present in the user's prompt first. If a mandatory field is still missing, ask the user once; if it is still not provided, abort with:

Missing required parameters: [<comma-separated list>]. Aborting diagnostic workflow.

Do NOT fabricate/guess mandatory values or read external metadata to infer them.

Module Index

| Module | Purpose | File | |--------|---------|------| | Preparation | Credential acquisition and CLI call templates | [references/module1_preparation.md](references/module1_preparation.md) | | RAM Policies | Minimum read-only privilege list | [references/ram-policies.md](references/ram-policies.md) | | Scenario 1: ECS Public Network | ECS script invocation, JSON output, status logic | [references/module2_ecs_public.md](references/module2_ecs_public.md) | | Scenario 2: VPC Service