alibabacloud-ddos-security-monitor

What this skill does

# DDoS Security Product Inspection & Monitoring

This skill performs security inspection on DDoS security products under an Alibaba Cloud account, entirely through Aliyun CLI direct OpenAPI calls without any scripts or SDKs.

**Architecture**: `antiddos-public (Basic Protection) + ddosbgp (Native Protection) + ddoscoo (Anti-DDoS Pro/Premium) -> CLI OpenAPI -> Inspection Report`

## Product & API Overview

| Product | CLI Code | Use Case |
|---------|----------|----------|
| DDoS Basic Protection | `antiddos-public` | Default free protection for ECS/SLB, Region param: `--ddos-region-id` |
| DDoS Native Protection | `ddosbgp` | Paid upgrade, native IP-level protection, Region param: `--biz-region-id` or `--region` |
| DDoS Anti-DDoS Pro/Premium | `ddoscoo` | Dedicated Anti-DDoS IP, L4/L7 protection, Region param: `--region` |

> **[MUST] Strict product routing isolation**: APIs of the three products MUST NEVER be mixed. NEVER substitute `ddoscoo` APIs for `ddosbgp` queries or vice versa. If mixing is detected, abort immediately.
>
> **[MUST] ddosbgp endpoint routing**: `ddosbgp describe-instance-list` default endpoint does NOT support mainland China Regions. You MUST specify `--endpoint ddosbgp.cn-hangzhou.aliyuncs.com` for ALL `describe-instance-list` calls.
>
> **[MUST] Easily confused API warning**:
>
> | Scenario | Correct Command | Wrong Command (FORBIDDEN) |
> |----------|----------------|--------------------------|
> | **Native Protection** attack events | `ddosbgp describe-ddos-event` (singular) | ~~`ddoscoo describe-ddos-events`~~ |
> | **Anti-DDoS Pro** attack events | `ddoscoo describe-ddos-events` (plural) | ~~`ddosbgp describe-ddos-event`~~ |

## Pre-checks

> **Aliyun CLI >= 3.3.3 required** — see [CLI Installation Guide](references/cli-installation-guide.md).
> **Credentials required** — see [CLI Credential Setup](references/cli-setup.md). Run `aliyun configure list` to verify.
> **RAM permissions** — see [RAM Permission Policies](references/ram-policies.md).
>
> **[MUST] Permission Failure Handling:** On permission errors: 1) Read `references/ram-policies.md` 2) Use `ram-permission-diagnose` skill 3) Pause until user confirms permissions granted.
>
> **[MUST] AI-Mode lifecycle** — Enable before any CLI invocation, disable at EVERY exit point:
> ```bash
> aliyun configure ai-mode enable
> aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddos-security-monitor"
> ```

## Parameter Confirmation

> **IMPORTANT**: ALL user-customizable parameters MUST be confirmed with the user before execution.

| Parameter | Required/Optional | Description | Default |
|-----------|-------------------|-------------|---------|
| Inspection product scope | Optional | Basic/Native/Anti-DDoS Pro, default all | All |
| Time range | Optional | Inspection time window | Last 24 hours |
| Comparison mode | Optional | Day-over-day / week-over-week / custom | Day-over-day |
| Basic Protection instance-type | Optional | ecs/slb/eip/ipv6/swas/waf/ga_basic | ecs |

## Region Strategy

> **[MUST] ddosbgp Region traversal (dynamic + hardcoded fallback)**:
> - **Hardcoded baseline** (12 Regions, MUST NOT be reduced): `cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1`
> - **Dynamic expansion**: Call `aliyun ddosbgp describe-regions` (NOT ECS), **union** with baseline (only add, never subtract). If dynamic fetch fails, use baseline directly.
> - **Count validation**: Final list >= 12 Regions. ALL must be traversed, NEVER break due to empty/error.
>
> **antiddos-public**: Query from `cn-hangzhou` only (centralized).
> **ddoscoo**: MUST query both `cn-hangzhou` + `ap-southeast-1`.

## Core Inspection Workflow

### Phase 1: Environment, Credential & Permission Pre-check

```bash
# 1.1 Check CLI version + enable AI-Mode
aliyun version
aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddos-security-monitor"

# 1.2 Set global timeout and enable auto plugin install
aliyun configure set --auto-plugin-install true --connect-timeout 10 --read-timeout 30
aliyun plugin update

# 1.3 Check credential configuration
aliyun configure list

# 1.4 Validate permissions (one call per product)
aliyun antiddos-public describe-instance-ip-address \
  --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 1
aliyun ddosbgp describe-instance-list --page-no 1 --page-size 1 --region cn-hangzhou --endpoint ddosbgp.cn-hangzhou.aliyuncs.com
aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 1 --region ap-southeast-1
```

- Normal JSON -> permission OK | `Forbidden.RAM` / `NoPermission` -> see [RAM Policies](references/ram-policies.md)

> **[MUST] Abort rule**: If any pre-check fails 3 consecutive times, run `aliyun configure ai-mode disable`, output error report, and terminate.

### Phase 2: Product Inventory Check (Multi-Region Mandatory Traversal)

> **[MUST] Loop rules**: ALL Regions must be queried. On ANY error (InvalidRegionId/Empty/Throttling), log and `continue` — break/exit is FORBIDDEN. After loop, verify EXECUTED >= 12 (ddosbgp) or = 2 (ddoscoo). Log results immediately after each call — relying on memory is FORBIDDEN.
>
> **Empty result handling**: `Total: 0` → log "no instances", continue | Error code → log error, continue | Normal → extract instance IDs.
> After traversal, compile **Region -> Instance ID list** mapping for Phase 4.

```bash
# 2.1 Basic Protection assets
aliyun antiddos-public describe-instance-ip-address \
  --ddos-region-id cn-hangzhou --instance-type ecs --current-page 1 --page-size 50

# 2.2 Native Protection - [MUST execute full loop in single bash]
BASELINE="cn-hangzhou cn-shanghai cn-beijing cn-shenzhen cn-hongkong ap-southeast-1 ap-southeast-2 ap-southeast-3 ap-southeast-5 ap-northeast-1 us-west-1 eu-central-1"
DYNAMIC=$(aliyun ddosbgp describe-regions 2>/dev/null | grep -o '"RegionId":"[^"]*"' | cut -d'"' -f4 | tr '\n' ' ')
if [ -n "$DYNAMIC" ]; then
  ALL_REGIONS=$(echo "$BASELINE $DYNAMIC" | tr ' ' '\n' | sort -u | tr '\n' ' ')
else
  ALL_REGIONS="$BASELINE"
fi
EXECUTED=0
for region in $ALL_REGIONS; do
  # [MANDATORY] NEVER break/return/exit - on ANY error, MUST continue
  echo "=== ddosbgp query $region ==="
  # [CRITICAL] Must specify --endpoint for mainland China Regions
  RESULT=$(aliyun ddosbgp describe-instance-list --page-no 1 --page-size 50 --region $region --endpoint ddosbgp.cn-hangzhou.aliyuncs.com 2>&1)
  echo "$RESULT"
  if echo "$RESULT" | grep -q "InvalidRegionId\|ErrorCode"; then
    echo "[WARN] $region returned error, logged and continuing"
  fi
  EXECUTED=$((EXECUTED+1))
  continue
done
echo "=== Regions executed: $EXECUTED ==="

# 2.3 Native Protection associated IPs (per discovered instance, uses --biz-region-id)
aliyun ddosbgp describe-pack-ip-list \
  --instance-id <instance-id> --page-no 1 --page-size 50 --biz-region-id <region-id>

# 2.4 Anti-DDoS Pro instances [MUST query both Regions]
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region cn-hangzhou
aliyun ddoscoo describe-instances --page-number 1 --page-size 50 --region ap-southeast-1

# 2.5 Anti-DDoS Pro associated domains (per discovered instance)
aliyun ddoscoo describe-domains --instance-ids <instance-id> --region <region-id>
```

> **[MUST] End validation**: 1) Region count: ddosbgp >= 12, ddoscoo = 2 2) Product isolation: no mixed API prefixes 3) Instance deduplication: Global instances (CoverageType=4) appear in every Region — deduplicate by InstanceId

### Phase 3: Confirm Comparison Period

Ask user for comparison period, parse into second-precision Unix timestamps. **[MUST] Use bash `date` command — manual calculation FORBIDDEN:**

```bash
BASE_END=$(date +%s)
BASE_START=$((BASE_END - 86400))
COMPARE_END=$((BASE_START