alibabacloud-cloudfw-vpc-firewall-diagnosis

name	alibabacloud-cloudfw-vpc-firewall-diagnosis
description	Diagnose Alibaba Cloud Cloud Firewall VPC firewall provisioning failures, route policy configuration failures, and closure pre-check risks using read-only CloudFirewall, CBN, VPC, STS, and ActionTrail APIs. Use this skill when troubleshooting VPC firewall creation failures, route policy/drainage configuration failures, firewall status stuck in configuring, or assessing route and ACL impact before closing VPC firewall drainage.
license	Apache-2.0
compatibility	Requires Alibaba Cloud CLI (aliyun-cli >= 3.3.0) and Python 3.6+. All CLI commands use --profile and never pass AccessKey ID or AccessKey Secret explicitly. All Alibaba Cloud service calls must set User-Agent to AlibabaCloud-Agent-Skills/alibabacloud-cloudfw-vpc-firewall-diagnosis.
metadata	{"domain":"aiops","owner":"cloudfw-team","contact":"[e-mail]"}
allowed-tools	Bash
hooks	{"PreToolUse":[{"matcher":"Bash","command":"bash ${SKILL_DIR}/scripts/check-write-operation.sh","description":"Bash command whitelist and confirmation gate. This read-only diagnostic skill only allows clearly matched read-only Alibaba Cloud CLI APIs, environment checks, local inspection commands, and bundled diagnostic scripts. Write operations, destructive local commands, or unmatched Bash commands return permissionDecision=ask.\n"}]}

VPC Firewall Provisioning Failure Diagnosis

Prerequisites

CLI Tool

• aliyun-cli version: >= 3.3.0.
• Validation: aliyun version.

Python Runtime

• Python version: Python 3.6+ for scripts/analyze_routes.py and scripts/closure_precheck.py.
• Dependencies: Standard library only (json, subprocess, sys).

Alibaba Cloud Credentials

Configure a CLI profile with aliyun configure, then pass credentials through --profile <profile> in every command.

aliyun configure --profile <profile-name>
# Enter AccessKey ID, AccessKey Secret, Region, and output format as prompted.

Never hardcode AccessKey values in commands, scripts, or documentation. See references/profile_setup_guide.md.

Required RAM Permissions

This skill is a read-only diagnostic tool. Grant only the minimum read-only actions below.

Action	Purpose
cloudfw:DescribeTrFirewallsV2List	Query VPC firewall list and key status fields.
cloudfw:DescribeVpcFirewallList	Query VPC boundary firewall information.
cloudfw:DescribeVpcFirewallPrecheckDetail	Query precheck details. This API uses --Region, not --RegionId.
cloudfw:DescribeFirewallTask	Query drainage task status and ErrorDetail.
cloudfw:DescribeTrFirewallPolicyBackUpAssociationList	Query the rollback target route table.
cloudfw:DescribeVpcFirewallControlPolicy	Query VPC firewall ACL policies.
actiontrail:LookupEvents	Query recent operation history.