Alibaba Cloud WAF Bot Management automated configuration assistant. Automatically completes bot protection policy evaluation, configuration, verification, and tuning via OpenAPI/CLI. Supports scenarios such as LLM API protection, retail promotion anti-scalper, general anti-crawling, and academic research platforms. Triggers when the user mentions Bot management, crawler protection, anti-crawling, WAF Bot, BOT2.0, LLM API abuse prevention, retail anti-scalper, promotion protection, SMS bombing, script attacks, or automated traffic protection.
Alibaba Cloud WAF Bot Management automated configuration assistant. Automatically completes bot protection policy evaluation, configuration, verification, and tuning via OpenAPI/CLI. Supports scenarios such as LLM API protection, retail promotion anti-scalper, general anti-crawling, and academic research platforms. Triggers when the user mentions Bot management, crawler protection, anti-crawling, WAF Bot, BOT2.0, LLM API abuse prevention, retail anti-scalper, promotion protection, SMS bombing, script attacks, or automated traffic protection.
Alibaba Cloud CLI (aliyun) must be installed and configured. Credentials must be obtained through the default credential chain; hardcoding AK/SK in scripts is prohibited.
# Verify CLI is available
aliyun version
# Verify credentials are valid
aliyun waf-openapi describe-instance --region cn-hangzhou \
--user-agent "AlibabaCloud-Agent-Skills/alibabacloud-waf-bot-management"
The user must have purchased a WAF 3.0 instance (Enterprise edition or above), and the Bot Management module must be enabled (Bot Management is a WAF add-on module and must be purchased separately).
AI-Mode Configuration
This skill uses the aliyun CLI for all operations. AI-Mode lifecycle management commands:
Current state: AI-Mode must be enabled before executing any aliyun waf-openapi commands. All business CLI commands below include the --user-agent flag for traceability. System commands (e.g., --help, configure) do not set user-agent.
Input Collection
Use AskUserQuestion to collect the following information. Any missing items must be followed up on:
Required Items
Industry Scenario: LLM/API Service | Retail E-commerce/Promotion | General Anti-Crawling | Academic Research Platform
Protected Domains: At least one domain that needs protection
Access Method: CNAME | ALB Cloud Product Access | Hybrid Cloud | Not sure (can be queried via API)
Scenario-Specific Follow-Up Questions
LLM Scenario: API endpoint path prefix (e.g., /api/v1/), whether there is a mobile app, daily average API call volume
Retail Scenario: Whether there are promotion time windows (date + time period), whether there is an app/mini-program, whether there are flash-sale/seckill scenarios
Academic Research Scenario: Whether users access from cloud provider VMs, whether Python/script-based API calls are allowed
General Scenario: Current attack symptoms (bandwidth saturation / data scraping / SMS bombing / other)
Optional Items
WAF instance region (default: cn-hangzhou)
Whether there are compliance restrictions (e.g., cannot show CAPTCHA, cannot block by region)
Whether specific legitimate crawlers need to be protected (e.g., search engine spiders)
Execution Workflow
Step 1: Current State Assessment (CLI Automation)
Query the current WAF instance and Bot Management configuration status via API, and output an assessment report.
WAF instance status is normal, Bot Management module is enabled
Protected domains are onboarded to WAF (CNAME or cloud product access)
Protected objects are created and associated
Log service is enabled (required for subsequent verification)
Bot collection fields are added to logs and indexing is enabled
If the Bot module is not enabled or domains are not onboarded, output operational guidance and pause. Wait for the user to confirm completion before continuing.
Runtime Error Handling (applies to all CLI calls):
When executing CLI commands in Step 1/3/4, handle errors as follows:
Pause the workflow. Ask the user to verify the RAM policy includes AliyunWAFReadWriteAccess
InvalidSecurityToken.Expired
STS Token expired
Ask the user to run aliyun configure to refresh credentials and retry
Throttling / Throttling.User
API rate limited
Wait 5 seconds and retry, up to 3 retries with increasing intervals (5s/10s/15s)
InternalError
Server-side error
Wait 10 seconds and retry once. If still failing, pause and report completed steps
InvalidParameter
Parameter error
Verify InstanceId and region are correct. Do not auto-retry
Rollback Strategy: If some rules fail to create during Step 3, successfully created rules will not be automatically rolled back. Output the list of created rule IDs and advise the user to manually run delete-defense-rule to clean up, or wait until all rules are confirmed before enabling the template (Step 3.4 executes last).
SDK Integration Checklist (three critical pitfalls to proactively remind about):
Web clients must integrate the Web SDK; otherwise, all four soft-block actions (JS challenge, dynamic token, slider, strict slider) will fail
Static files (js/css/images) cannot have the Web SDK injected; only built-in Bot detection rules + slider can be used
When APP and Web share the same domain, the APP must integrate the SDK; otherwise, JS challenges will fail due to the lack of a JS environment, impacting business
For detailed SDK integration steps, see references/sdk-integration-guide.md.
Step 2: Scenario-Based Rule Recommendation
Based on the user's selected scenario, load the corresponding configuration plan:
Scenario
Reference Document
Core Protection Targets
LLM/API Service
references/scene-llm-api.md
LLM API endpoints
Retail E-commerce/Promotion
references/scene-retail-promotion.md
Login page / Order page / Product page / Pricing API
General Anti-Crawling
references/scene-anti-crawl.md
All web pages
Academic Research Platform
references/scene-academic.md
API endpoints + Web pages
Each scenario document includes: recommended rule labels to enable, rules not recommended for enabling with reasons, action selection, rate-limit threshold references, and special considerations.
Universal Rules: All scenarios must reference references/rules-blacklist.md (list of rules not recommended for enabling) and references/attack-level-matrix.md (attack level matching matrix).
Step 3: CLI Automated Configuration
Based on the scenario recommendations from Step 2, automatically create protection templates and rules via CLI.
3.0 Configure Whitelist (Execute First)
Before creating protection rules, add trusted IPs to the whitelist to avoid false positives on internal monitoring and legitimate services:
To obtain resource_id: Extract the ResourceId field from the describe-defense-resources response in Step 1.5. If no protected objects were found in Step 1, create one first via create-defense-resource.
Canary Deployment Recommendation: For initial configuration, set all disposition actions to monitor (observe only, no blocking). Run for a period and review hit data. After confirming no false positives, switch to the formal disposition actions. Recommended canary periods by scenario: LLM/Retail scenarios 24-48 hours, general anti-crawling 24-48 hours, academic research scenarios 7-14 days (diverse user patterns require a longer observation period).
Canary Switch SOP (monitor -> formal action):
Review canary period hit data via describe-rule-hits-top-rule-id and describe-rule-hits-top-client-ip
Check whether any flagged Top IPs/UAs are legitimate users (cross-validate with SLS logs)
After confirming no false positives, modify rule actions one by one:
# Switch a single rule from monitor to formal action (e.g., captcha)
aliyun waf-openapi modify-defense-rule \
--region {region} \
--InstanceId {instance_id} \
--RuleId {rule_id} \
--Action "captcha" \
--user-agent "AlibabaCloud-Agent-Skills/alibabacloud-waf-bot-management"
After switching each rule, run for 4 hours of observation. Confirm no anomalies before switching the next rule
If the target action is block, it is recommended to first switch to captcha and observe for 4 hours before upgrading to block:
# captcha -> block upgrade (execute only after confirming captcha has no false positives)
aliyun waf-openapi modify-defense-rule \
--region {region} \
--InstanceId {instance_id} \
--RuleId {rule_id} \
--Action "block" \
--user-agent "AlibabaCloud-Agent-Skills/alibabacloud-waf-bot-management"
After all switches are complete, confirm all rule statuses via describe-defense-rules
For more granular log analysis (e.g., single-device multi-account switching detection), use SLS queries. Templates are available in references/sls-query-templates.md.
Step 5: Effectiveness Assessment and Tuning
Based on the data from Step 4, output an assessment report:
