Run

aliyun version

to verify >= 3.3.3. If not installed or version too low, run

curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

to update, or see

references/cli-installation-guide.md

for installation instructions.

[MUST] run

aliyun configure set --auto-plugin-install true

to enable automatic plugin installation. [MUST] run

aliyun plugin update

to ensure that any existing plugins are always up-to-date.

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-waf-checkresponse-intercept-query"

aliyun configure ai-mode disable

aliyun

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-checkresponse-intercept-query

• Request ID (traceid) is obtained from the HTML body of WAF's block response, or from the 405 block page displayed in the browser
• Uses Alibaba Cloud default credential chain for authentication (ECS RAM Role, ~/.alibabacloud/config, etc.)

1. The 405 block page displayed in the browser, which shows the Request ID directly
2. The HTML body of WAF's block (intercept) response, which contains the traceid

DescribeSlsLogStoreStatus

aliyun waf-openapi DescribeSlsLogStoreStatus --region <region-id> --InstanceId '<instance-id>' --RegionId '<region-id>' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-checkresponse-intercept-query

• If the response indicates log service is already enabled (

  SlsLogStoreStatus

  is true/enabled), skip the enable operation and proceed directly to Step 2c (idempotent: no redundant writes).
• If log service is not enabled, inform the user that WAF log service must be activated before log queries can proceed. With user consent, call

  ModifyUserWafLogStatus

  to enable it:

aliyun waf-openapi ModifyUserWafLogStatus \
  --region <region-id> \
  --InstanceId '<instance-id>' \
  --Status 1 \
  --RegionId '<region-id>' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-checkresponse-intercept-query

Constraint: This skill only supports enabling log service (

Status=1

). Disabling log service is not permitted. Never call this API with

Status=0

.

DescribeSlsLogStoreStatus

rule_id

final_plugin

DescribeDefenseRule

DefenseScene

• custom_acl

  - Custom access control rules

• custom_cc

  - Custom rate limiting rules (CC rules)

• waf_group

  - WAF protection rules

• antiscan

  - Anti-scan rules

• dlp

  - Data leakage prevention

• tamperproof

  - Anti-tampering

final_plugin

undefined

• Request ID: {request_id}
• Block Time: {time}
• Client IP: {real_client_ip (masked, e.g. 192...***)}
• Request URL: {host}{request_path}?{masked_query_params}

• Rule ID: {rule_id}
• Rule Name: {rule_name}
• Action: {action}

1. Re-check global log service status (should have been verified in Step 2b, but re-confirm):
   bash

   aliyun waf-openapi DescribeSlsLogStoreStatus --region <region-id> --InstanceId '<instance-id>' --RegionId '<region-id>' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-checkresponse-intercept-query

   If not enabled, prompt the user and enable with

   ModifyUserWafLogStatus

   (see Step 2b). Only enabling (

   Status=1

   ) is allowed.
2. Check protection object log switch:
   bash

   aliyun waf-openapi DescribeResourceLogStatus --region <region-id> --InstanceId '<instance-id>' --RegionId '<region-id>' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-checkresponse-intercept-query

3. Enable protection object log collection (check-then-act: only if

   DescribeResourceLogStatus

   shows log collection is disabled for the target resource; skip if already enabled):
   bash

   aliyun waf-openapi ModifyResourceLogStatus \
     --region <region-id> \
     --InstanceId '<instance-id>' \
     --Resource '<resource-name>' \
     --Status true \
     --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-checkresponse-intercept-query

1. Verify CLI profile configuration:
   bash

   aliyun configure list

2. Check RAM policy permissions: Required permissions:

   • waf-openapi:DescribeInstance

   • waf-openapi:DescribeSlsLogStoreStatus

   • waf-openapi:DescribeSlsLogStore

   • waf-openapi:ModifyUserWafLogStatus

     (optional, for enabling log service)

   • waf-openapi:DescribeDefenseRule

     (for rule details)

   • sls:GetLogs

     (for log queries)
3. Try specifying a different profile:
   bash

   aliyun waf-openapi DescribeInstance --profile <profile-name> --region <region-id> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-checkresponse-intercept-query

1. Verify Request ID format: Should be 32 characters without hyphens
2. Check time range: The script automatically expands search up to 90 days
3. Verify the correct region: Try both

   cn-hangzhou

   and

   ap-southeast-1

4. Check log retention (TTL): Default is 180 days, use

   --ttl

   parameter if different

• Logs found in only one region -> use that region directly
• Logs found in both regions -> ask the user for clarification
• No logs found in either region -> ask the user for the expected region, check protection object log switch

1. Check current rule status first — call

   DescribeDefenseRule

   to query the rule's current status. If the rule is already in the target state (e.g., already disabled), skip the write operation and inform the user (idempotent check-then-act pattern)
2. Only perform disable operations (

   ModifyDefenseRuleStatus

   with

   RuleStatus=0

   )
3. Never delete rules
4. Never modify rule content
5. Must confirm with user before executing

undefined

• RAM Policy Requirements
• Rule Configuration Details
• Rule Operation Policy
• Common Block Reasons
• WAF OpenAPI