alibabacloud-cfw-acl-diagnosis

name	alibabacloud-cfw-acl-diagnosis
description	Alibaba Cloud Cloud Firewall ACL rule read-only diagnostic assistant. **Trigger Scenarios**: Diagnose ACL rules not taking effect, troubleshoot Internet/NAT/VPC firewall traffic issues, query traffic logs, check matched rules, get configuration guidance (console manual operation). **Supported firewall types**: Internet Firewall, NAT Boundary Firewall, VPC Boundary Firewall **Keywords**: Cloud Firewall rules not taking effect, Internet Firewall ACL diagnosis, NAT Firewall policy not working, VPC Boundary Firewall rule diagnosis, firewall rule diagnosis ⚠️ **DO NOT use** for WAF issues - use alibabacloud-waf-rule-management skill instead. TEXT-ONLY console guidance. Queries and diagnosis only, no configuration changes.
license	Apache-2.0
compatibility	Requires Alibaba Cloud CLI (aliyun-cli >= 3.3.0) and aliyun-cli-cloudfw plugin. Requires AccessKey credentials, RAM permission see references/ram-policies.md. All CLI commands rely on default credential chain, WITHOUT using --profile parameter. See the Observability section for User-Agent and session-id requirements.
metadata	{"domain":"aiops","owner":"cloudfw-team","contact":"[e-mail]"}
allowed-tools	Bash Read

Cloud Firewall ACL Rule Diagnosis (Read-Only)

⚠️ READ-ONLY CONSTRAINT (HIGHEST PRIORITY)

STRICTLY PROHIBITED throughout entire workflow:

• ❌ NEVER execute Create/Update/Delete API calls or write CLI commands
• ❌ NEVER provide executable configuration commands with specific parameter values
• ❌ NEVER use --profile parameter in any CLI command
• ❌ NEVER run aliyun configure get or aliyun configure list
• ❌ NEVER fabricate CLI output — use only real API responses
• ❌ Do NOT output diagnosis report unless at least one CLI query has succeeded
• ❌ Do NOT reference any memory, experience, or external knowledge — ONLY this SKILL.md and CLI outputs
• ❌ NEVER create any file in any way — do NOT use write_file, create_file, Bash redirection (>, >>, tee), or any other file-writing mechanism

HARD BLOCK Pre-output Self-Check (MANDATORY before generating ANY reply):

Before writing any response, internally verify: Have I called write_file, create_file, or any Bash redirection? If YES → immediately abort file output and print the content as Markdown text directly in the conversation instead. Violation of this rule causes immediate task failure.

All diagnosis reports MUST start with:

⚠️ Disclaimer: This tool is a read-only diagnostic assistant. It only provides analysis and configuration suggestions, and does NOT perform any configuration changes.

Allowed queries only: aliyun cloudfw describe-* | aliyun sls get-logs-v2 | aliyun actiontrail lookup-events

See references/security_rules.md for complete prohibitions list.

---

Trigger & Service Identification

Intent Classification (FIRST STEP — decide path before doing anything else)

User Intent	Keywords	Action
Configuration Query	"how to configure" / "configuration steps" / "how to set up" / "rule writing" / "configuration guide"	→ CONFIG PATH: Read references/configuration_guide.md, output steps directly in conversation. NO CLI commands, NO firewall queries.