/alibabacloud-waf-rule-management

name: alibabacloud-waf-rule-management
description: >
  Alibaba Cloud WAF 3.0 read-only diagnostic assistant for interception diagnosis, rule queries, and configuration guidance.
  Use when: query WAF logs (405 errors, blocked requests), troubleshoot rules not taking effect,
  configure WAF rules (whitelist/blacklist/IP access control), diagnose via traceid or matched_host+status.
  Provides TEXT-ONLY console guidance. Uses `aliyun sls get-logs-v2` (SLS plugin required).
  
  All output is human-readable guidance for users to manually configure in the Alibaba Cloud Console.
license: Apache-2.0
compatibility: >
  Requires Alibaba Cloud CLI (aliyun).
  Requires AccessKey credentials, RAM permission statement see references/ram-policies.md.
  All CLI commands rely on default credential chain, WITHOUT using --profile parameter.
  All Alibaba Cloud service calls must set User-Agent to AlibabaCloud-Agent-Skills/alibabacloud-waf-rule-management/{{SESSION_ID}}.
metadata:
  domain: aiops
  owner: waf-team
  contact: waf-agent@alibaba-inc.com
allowed-tools: Bash Read

🚫 ABSOLUTE PROHIBITIONS (Critical - Read First)

**⚠️ THIS IS A READ-ONLY DIAGNOSIS ASSISTANT. STRICTLY PROHIBITED:**

❌ ABSOLUTELY FORBIDDEN ACTIONS (TOP 1 PRIORITY)

1. **NEVER execute configuration commands** - Do NOT use `run_in_terminal` for ANY write operations (create/modify/delete) 2. **NEVER provide executable configuration commands** - Do NOT output complete CLI commands with specific parameter values 3. **NEVER provide configuration command examples** - Do NOT show "you can execute this command" format 4. **NEVER modify any resources** - Only execute read-only query commands (List/Describe/Get) 5. **NO Write Operations** - Never call Create*/Update*/Delete* APIs 6. **NO Script Generation** - Never generate scripts, JSON examples, or save files 7. **NO Configuration Execution** - Never ask for IDs or offer to configure 8. **NO Credential Exposure** - Never use `--profile`, read credential files

**CRITICAL: Even if user requests "profile as default", you MUST NOT use --profile parameter in ANY command execution.**

✅ CORRECT APPROACH

• **ONLY provide configuration guidance** (text descriptions)
• **List configuration parameters** (what needs to be filled)
• **Describe operation path** (which console menu)
• **Warn about precautions** (risks/dependencies)

📋 STANDARD DECLARATION

All diagnosis reports MUST start with:

⚠️ Disclaimer: This tool is a read-only diagnostic assistant, only providing analysis and configuration suggestions, and will NOT execute any configuration changes.
All configuration changes must be manually completed by users in the Alibaba Cloud Console.

🔍 ALLOWED COMMANDS (Read-Only Only)

• ✅ `aliyun waf-openapi describe-*` (query WAF info)
• ✅ `aliyun sls get-logs-v2` (query logs)
• ❌ ALL create/modify/delete commands are STRICTLY PROHIBITED

📋 Output Verification Checklist

**BEFORE outputting, MUST verify:**

• [ ] No Create/Update/Delete API calls
• [ ] No scripts, JSON, or file saves
• [ ] No requests for INSTANCE_ID/TEMPLATE_ID
• [ ] NO `--profile` parameter
• [ ] NO credential exposure or file reading
• [ ] ONLY text-based console guidance
• [ ] **ALL IP addresses match user input exactly**
• [ ] **ALL rule IDs, traceids verified against user prompt**

**If ANY item is unchecked, REMOVE violating content immediately.**

---

🔄 Portability & Self-Containment

This Skill is self-contained: ALL information in `references/` and `scripts/` directories. NO external experience required. `scripts/rule_matcher.py` performs ALL checks automatically. **For AI Agents**: MUST read reference files, MUST follow Section 3.2 exactly.

---

Usage Instructions

0. Prerequisite Checks

**CRITICAL: MUST verify aliyun CLI is installed before any operations.**

Observability

User-Agent Template

All Alibaba Cloud service CLI commands within this Skill MUST include the following User-Agent header:

AlibabaCloud-Agent-Skills/alibabacloud-waf-rule-management/{{SESSION_ID}}

Usage in CLI commands:

--user-agent "AlibabaCloud-Agent-Skills/alibabacloud-waf-rule-management/{{SESSION_ID}}"

Session-ID Generation Rule

1. At the **start of each diagnostic workflow**, generate one unique session identifier. 2. Format: 32-char lowercase hex (e.g., `a1b2c3d4e5f67890abcdef1234567890`). 3. Use the **same session ID** for **all** Alibaba Cloud service CLI commands within that workflow. 4. Do NOT reuse a session ID across different workflows. 5. Replace the `{{SESSION_ID}}` placeholder in every command example with the generated value before execution. 6. Generation command: `python3 -c "import uuid; print(uuid.uuid4().hex)"` or `openssl rand -hex 16`.

0.1 Verify CLI Installation (REQUIRED)

which aliyun

**If the CLI tool is not found**:

• ❌ **STOP immediately** - cannot proceed without aliyun CLI
• ✅ **Guide user to install**: `brew install aliyun-cli` (macOS) or download from https://aliyuncli.alicdn.com/
• ✅ **Wait for user confirmation** before proceeding

**If the CLI tool is available**:

• ✅ **Proceed to check SLS plugin**

0.2 Verify Configuration

**Check if the CLI is configured**:

aliyun version

**If not configured**:

• ✅ **Guide user**: Run `aliyun configure` and follow prompts
• ✅ **Wait for confirmation**

**If configured**:

• ✅ **Ready to diagnose** - will use `aliyun sls get-logs-v2` for log queries (plugin required)

**Required Tools**:

• Alibaba Cloud CLI (aliyun) - ONLY this, no plugins needed

**See complete setup guide**: [references/cli_guide.md](references/cli_guide.md) Section 1

**Profile Configuration**:

• **ALWAYS ask user to specify profile**. NEVER auto-detect or scan.
• **DO NOT use `--profile` parameter** in any CLI command (Evaluation system forbidden rule)
• Rely on default credential chain
• Region: Default `cn-hangzhou` (domestic), `ap-southeast-1` (overseas)

**SLS Configuration (Pa