This skill supports two usage scenarios:

1. Quick WAF Protection Experience: Create VPC, ECS, and WAF from scratch for a complete protection experience
2. Existing WAF Protection Experience: User already has WAF, create new VPC and ECS to integrate with existing WAF

Prohibited Scenario:

• Existing ECS Integration: Does not support integrating user's existing ECS into WAF

If the user indicates they have existing ECS and want to integrate it into WAF, respond: "This skill is designed for experiencing the complete WAF protection workflow and requires creating new ECS instances. If you want to integrate your existing ECS into WAF, please refer to the Cloud Product Integration feature in the WAF console."

CRITICAL: Scenario 1 Resource Creation Rules

If the user requests "Quick Experience" (Scenario 1):

• VPC: Create new if quota is sufficient; use existing VPC if quota is full
• Must Create New: VSwitch, Security Group, ECS
• WAF Reusable: If WAF already exists, skip creation and use existing WAF to integrate ECS
• If creation fails, must stop and inform the user

MUST: Scenario 1 Must Check for Existing WAF Instance

After authentication confirmation and before parameter confirmation, must execute:

bash

aliyun waf-openapi describe-instance --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills

• If valid InstanceId is returned: Skip WAF creation steps and use this WAF directly to integrate ECS
• Prompt: "Detected that your account already has a WAF instance (InstanceId: [xxx]), will use this instance for protection experience."
• If no WAF instance: Execute Step 4 to create new WAF

CRITICAL: Handling Process When User Already Has WAF

When the user indicates they have a WAF instance:

1. Ask for WAF Instance ID: Must first ask for the user's existing WAF instance ID
2. Skip WAF Creation: Prohibit executing

   create-postpaid-instance

   , directly use the WAF instance ID provided by the user
3. Create New Network and ECS: Still need to create VPC, VSwitch, Security Group, ECS
4. Integrate Existing WAF: Use the user's WAF instance ID to execute

   sync-product-instance

   and

   create-cloud-resource

Inquiry Prompt: "You already have a WAF instance. Please provide your WAF instance ID (format: waf-cn-xxx), and I will create a new ECS for you and integrate it with your existing WAF for experience."

IMPORTANT: Must proactively ask and help users complete the following checks before running

1. CLI Version: Run

   aliyun version

   to confirm version >= 3.3.1
2. Authentication Configuration: Run

   aliyun configure list

   to confirm authentication status is Valid
3. Auto Plugin: Run

   aliyun configure set --auto-plugin-install true

4. Account Balance: Confirm Alibaba Cloud account balance >= 100 CNY

aliyun configure list

Reminder when authentication is valid: "Detected that your current CLI authentication configuration is valid:

• Authentication Mode: [OAuth/AK/StsToken] | Account: [Profile Name] | Region: [Region]

Please confirm whether to use the current account for operations? Operations will incur charges."

MUST: Wait for user confirmation before continuing

• Prohibit: Executing any resource creation operations before user confirmation
• Prohibit: Any authentication mode (including StsToken) must wait for user confirmation

When authentication is invalid: Run

aliyun configure --mode OAuth

to complete configuration

Security Reminder: Explicitly handling AK/SK credentials is strictly prohibited. This skill only supports OAuth authentication mode.

MUST: Must confirm parameters before execution

Prohibit: Directly using default values to execute commands; must confirm parameters with the user first.

MUST: Input Validation Rules (Must verify the following formats)

• RegionId: Must match

  ^[a-z]{2}-[a-z]+-[a-z]\d*$

  format (e.g., cn-hangzhou-j)
• CidrBlock: Must be valid CIDR format and within RFC1918 private network segments (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• ZoneId: Must have RegionId as prefix (e.g., cn-hangzhou-j corresponds to cn-hangzhou)
• InstanceType: Must comply with Alibaba Cloud ECS specification naming convention (ecs.[series]-[spec])
• InstancePassword: 8-30 characters, must contain uppercase letters, lowercase letters, and numbers
• Security Requirement: All parameters are prohibited from containing special characters (such as ; | & $ ` \ etc.)

After authentication confirmation and before executing any commands, must confirm the following parameters with the user:

Confirmation Prompt: "Before starting deployment, please confirm the following parameters:

1. Region: cn-hangzhou (or other regions you prefer, such as cn-shanghai, cn-beijing)
2. VPC CIDR Block: 192.168.0.0/16
3. Zone: cn-hangzhou-j
4. ECS Specification: ecs.e-c1m2.large
5. ECS Password: Please provide your ECS login password (8-30 characters, containing uppercase letters, lowercase letters, and numbers)

Do you want to use the above parameters? Or tell me which ones you want to modify."

MUST: Wait for user confirmation or modification before continuing

• Expected user responses: "Confirm", "Yes", "OK", or provide modifications
• Prohibit: Executing any resource creation operations before user confirms parameters
• Prohibit: Auto-generating ECS passwords; passwords must be provided by the user
• If the user does not provide a password, must ask again and cannot continue
• If the user wants to modify parameters, record the modifications and confirm again

MUST: Must reject execution if parameter validation fails

• If user-provided parameters do not meet the format requirements, must clearly inform the user and provide correct examples
• Prohibit: Using invalid parameters to execute commands
• Prohibit: Escaping dangerous characters and continuing execution (should directly reject and require user to provide legal parameters)

MUST: Return Value and Output Desensitization

• In any scenario, the

  --password

  parameter value in commands, logs, and error messages displayed to users must be shown as

  ***

  or

  [REDACTED]

• CLI Execution Echo: If CLI output contains plaintext passwords, must replace and desensitize before displaying to users
• Error Message Handling: If error messages may contain passwords, must desensitize before displaying
• Prohibited Behaviors:
  • Printing complete commands containing plaintext passwords in terminal
  • Saving plaintext passwords in history records
  • Leaking plaintext passwords in error logs
• Correct Example:
  bash

  # Actually executed command (internal)
  aliyun ecs run-instances --password MyPass@2024 ...
  
  # Command displayed to user (desensitized)
  aliyun ecs run-instances --password *** ...

MUST: Must use user-confirmed parameters when executing commands

• The

  cn-hangzhou

  ,

  192.168.0.0/16

  , etc. in the command examples below are reference values only
• Prohibit: Directly copying example commands for execution; must replace with actual values confirmed by the user
• If the user changes the region to cn-shanghai, then all subsequent commands'

  --biz-region-id

  ,

  --region

  ,

  --zone-id

  must be modified accordingly

RegionId

^[a-z]{2}-[a-z]+-[a-z]\d*$

CidrBlock

ZoneId

${RegionId}-${letter}

InstanceType

ecs.[series]-[spec]

ImageId

.vhd

InstancePassword

SHOULD: Special Character Filtering

• All parameters are prohibited from containing:

  ; | & $ \

  " ' < > ( ) { } [ ] ! # ~`
• If the above characters are detected, must reject execution and prompt the user to re-enter

CRITICAL: Must check quota before creating VPC (Each account has a maximum of 10 VPCs per region by default)

aliyun vpc describe-vpcs --biz-region-id cn-hangzhou --page-size 50 --connect-timeout 5 --read-timeout 30 --user-agent AlibabaCloud-Agent-Skills

CRITICAL: Failure Handling and Rollback Mechanism

If any resource creation fails:

1. Stop Immediately: Must not continue executing subsequent steps
2. Inform User: Clearly explain the failure reason (such as insufficient resources, insufficient permissions, insufficient quota, etc.)
3. Prohibit Substitution: Must not use existing resources instead

Failure Prompt: "Sorry, [VPC/ECS/WAF] creation failed, reason: [error message]. Please check and try again."

undefined

CRITICAL: ABSOLUTELY PROHIBITED - Using Existing ECS Instances

• MUST CREATE NEW: Always create a new ECS instance using

  RunInstances

• PROHIBITED: Discovering and reusing existing ECS instances (e.g., 'Found multiple existing ECS instances... Selected i-bp1xxx')
• PROHIBITED: Saying "I found an existing ECS instance named 'web-server-waf-demo', will use it"
• Security Policy: Even if user has existing ECS instances, the skill MUST create a new one for the WAF protection experience
• Correct Behavior:
  • ✅ Always execute

    aliyun ecs run-instances

    to create a new instance
  • ✅ Use user-provided password for the new instance
  • ✅ If user asks to use existing ECS, explain: "This skill creates new resources for a complete WAF protection experience"

Recommended Image IDs (Avoid Blind Queries):

• Alibaba Cloud Linux 3:

  aliyun_3_x64_20G_alibase_20240819.vhd

• Alternative:

  aliyun_3_x64_20G_alibase_20221102.vhd

Directly use the above ImageId, no need to call DescribeImages query.

MUST: Password Desensitization Processing

• Prohibit: Displaying plaintext passwords in terminal output, log printing, or commands shown to users
• Must: Replace

  --password

  parameter value with

  ***

  or

  [REDACTED]

  before displaying
• Example:

  --password ***

  instead of

  --password MyPass@2024

• Security Requirement: Password is only used in original form when passing to CLI commands; any echo must be desensitized

undefined

⚠️ Integration Reminder: When integrating WAF, web services may experience brief second-level connection interruptions. It is recommended to perform operations during off-peak business hours.

IMPORTANT: Must prompt users for next steps after WAF integration is complete

Prompt: "WAF has been successfully integrated with ECS! You can proceed with the following operations:

1. Deploy Web Application: Log in to ECS to deploy your web application, or use sample application for testing
2. Verify Protection Effectiveness: Access ECS public IP to test normal access and attack interception

For detailed verification methods, see references/verification-method.md"

• CLI Installation Guide | RAM Policies | Related APIs
• Verification Methods | Acceptance Criteria | Official Solution Document