/alibabacloud-network-reachability-analysis

name: alibabacloud-network-reachability-analysis
description: >
  Perform Alibaba Cloud NIS (Network Intelligence Service) network path reachability analysis
  with forward/reverse path diagnosis, topology visualization, and resource monitoring.
  Use when analyzing network connectivity, diagnosing unreachable paths, checking security groups
  or route tables, or visualizing network topology between cloud resources.
  Triggers: "reachability analysis", "network path analysis", "NIS analysis", "connectivity diagnosis",
  "path reachable", "network troubleshooting",
  "可达性分析", "网络路径分析", "NIS分析", "连通性诊断", "路径可达", "网络排障".

NIS Network Reachability Analysis / NIS 网络可达性分析

> **Language / 语言**: Respond in the same language the user uses. > If the user speaks Chinese, use the Chinese (zh-CN) prompts below. > If the user speaks English, use the English (en) prompts below.

Guides an agent through interactive network reachability analysis using Alibaba Cloud NIS. Covers forward/reverse path analysis, topology visualization (Mermaid), and monitoring diagnostics for resources along the path.

**Architecture**: `NIS (CreateAndAnalyzeNetworkPath + GetNetworkReachableAnalysis) + CloudMonitor (DescribeMetricData)`

> ⚠️ **CRITICAL / 关键**: **READ-ONLY OPERATIONS ONLY** > > This skill performs **read-only** network diagnostics. **DO NOT** create, modify, or delete any cloud resources. > > 本技能仅执行**只读**网络诊断操作。**严禁**创建、修改或删除任何云资源。 > > Allowed: `CreateAndAnalyzeNetworkPath`, `GetNetworkReachableAnalysis`, `DescribeMetricData`, `Describe*` APIs > > 允许：分析任务创建与查询、监控数据查询、Describe* 类查询 API > > Forbidden: `Create*` (except `CreateAndAnalyzeNetworkPath`), `Modify*`, `Delete*`, `Start*`, `Stop*`, `Run*` APIs > > 禁止：创建类 API（除 `CreateAndAnalyzeNetworkPath` 外）、修改、删除、启停、执行类 API

Installation

> **Pre-check: Aliyun CLI >= 3.3.1 required** > Run `aliyun version` to verify >= 3.3.1. If not installed or version too low, > see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions. > Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.

aliyun version
aliyun configure set --auto-plugin-install true

Authentication

> **Pre-check: Alibaba Cloud Credentials Required** > > **Security Rules:** > - **NEVER** read, echo, or print AK/SK values (e.g., `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` is FORBIDDEN) > - **NEVER** ask the user to input AK/SK directly in the conversation or command line > - **NEVER** use `aliyun configure set` with literal credential values > - **ONLY** use `aliyun configure list` to check credential status > > ```bash > aliyun configure list --user-agent AlibabaCloud-Agent-Skills > ``` > Check the output for a valid profile (AK, STS, or OAuth identity). > > **If no valid profile exists, STOP here.** > 1. Obtain credentials from [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak) > 2. Configure credentials **outside of this session** (via `aliyun configure` in terminal or environment variables in shell profile) > 3. Return and re-run after `aliyun configure list` shows a valid profile

RAM Permissions

See [references/ram-policies.md](references/ram-policies.md) for the full RAM policy.

Required actions: `nis:CreateAndAnalyzeNetworkPath`, `nis:GetNetworkReachableAnalysis`, `cms:DescribeMetricData`.

Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call, > ALL user-customizable parameters (e.g., RegionId, instance IDs, IP addresses, > protocol, ports, resource types, etc.) MUST be confirmed with the user. > Do NOT assume or use default values without explicit user approval.

Collect the following parameters interactively:

| Parameter | Required | Description (EN) | 说明 (ZH) | Default | |-----------|----------|-------------------|-----------|---------| | RegionId | Yes | Region of the analysis task | 分析任务所在地域 | — | | SourceType | Yes | `ecs`, `vsw`, `internetIp`, `vpn`, `vbr` | 源端类型 | — | | SourceId | Yes | Source resource ID (or public IP if `internetIp`) | 源资源 ID（公网 IP 类型直接填 IP） | — | | SourceIpAddress | Conditional | On-Premise IP, **required** for `vpn`/`vbr` | 云下私网 IP，`vpn`/`vbr` 时**必填** | — | | TargetType | Yes | `ecs`, `vsw`, `internetIp`, `vpn`, `vbr`, `clb` | 目的端类型 | — | | TargetId | Yes | Target resource ID (or public IP if `internetIp`) | 目的资源 ID（公网 IP 类型直接填 IP） | — | | TargetIpAddress | Conditional | On-Premise IP, **required** for `vpn`/`vbr` | 云下私网 IP，`vpn`/`vbr` 时**必填** | — | | Protocol | Yes | `tcp`, `udp`, or `icmp` | 协议类型 | — | | TargetPort | Conditional | Required for `tcp`/`udp` | `tcp`/`udp` 时必填 | — | | SourcePort | Optional | Source port | 源端口 | — |

Interactive Collection Logic / 交互收集逻辑

Use the prompts matching the user's language:

**Step 1 — Ask resource types / 询问资源类型**

| EN | ZH | |----|-----| | "What is the **source resource type**? (ecs / vsw / internetIp / vpn / vbr)" | "请问**源端资源类型**是什么？（ecs / vsw / internetIp / vpn / vbr）" | | "What is the **target resource type**? (ecs / vsw / internetIp / vpn / vbr / clb)" | "请问**目的端资源类型**是什么？（ecs / vsw / internetIp / vpn / vbr / clb）" |

**Step 2 — Type-specific prompts / 按类型提示**

| Condition | EN Prompt | ZH Prompt | |-----------|-----------|-----------| | `internetIp` | "For public IP analysis, please provide the **public IP address** directly as the ID." | "分析公网路径时，请直接提供**公网 IP 地址**作为 ID 传入。" | | `vpn` / `vbr` | "For hybrid cloud analysis, besides the resource ID, please also provide the **On-Premise IP** (private IP on your side)." | "连接云下环境时，除了资源 ID，请务必提供您的**云下私网 IP (On-Premise IP)** 以确保分析准确。" |

**Step 3 — Protocol & ports / 协议和端口**

| EN | ZH | |----|-----| | "What protocol? (tcp / udp / icmp) And what is the target port?" | "请问使用什么协议？（tcp / udp / icmp）目的端口是多少？" |

Core Workflow

Step 1: Forward