alibabacloud-ddoscoo-port-configuration-backup

Alibaba Cloud DDoS Pro Port Configuration Backup and Restore

Scenario

This Skill is the entry point and router for backing up and restoring manual non-website DDoS Pro port configuration. It confirms the operation boundary, loads the applicable business workflow, and enforces authentication, permissions, parameters, safety, and success criteria.

The export and import procedures are maintained only in references/export-workflow.md and references/import-workflow.md . Do not reconstruct or duplicate those procedures here.

The portable scope includes manual TCP and UDP forwarding rules and their configuration, plus the instance-level non-website AI switch and mode. The AI policy applies to the IP object: the product has no independent port object, so all non-website ports on one instance share the same setting. Each port backup records that shared desired state, but it is not a port-exclusive setting.

Exclude website-derived automatic rules, scenario-specific protection, Protection for Infrastructure, website protection, and runtime traffic, connections, attacks, blackholes, and logs.

Architecture

user request -> parameter and authorization boundary -> export or import workflow -> Aliyun CLI -> one-port YAML desired state -> exact readback verification

Installation

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version . If the CLI is missing or older than 3.3.3, follow references/cli-installation-guide.md

and continue only after the version check succeeds.

Pre-check: Aliyun CLI plugin update required

Run aliyun configure set --auto-plugin-install true and then aliyun plugin update .

Environment

Set no credential environment variables. Use only an existing Aliyun CLI profile explicitly selected by the user. Never read, display, or persist credential environment variables.

Authentication

Pre-check: Alibaba Cloud Credentials Required

Security Rules:

NEVER read, echo, or print AK/SK values (for example, echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

NEVER ask the user to input AK/SK directly in the conversation or command line

NEVER use aliyun configure set with literal credential values

ONLY use aliyun configure list to check credential status

bashaliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity). The exact profile selected by the user must appear in the output. Never substitute a similar name or silently use the default profile.

If no valid profile exists, STOP here.

Obtain credentials from Alibaba Cloud Console

Configure credentials outside this session with aliyun configure

Return only after aliyun configure list shows a valid profile

Every cloud API call must explicitly carry the confirmed --profile , --region , and required User-Agent. The profile name is command-local and must not appear in backups, results, or reports.

RAM Policy

Export requires read-only permissions. Import adds temporary, least-privilege write permissions only for the selected workflow. Read references/ram-policies.md for the complete Action sets.

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

Read references/ram-policies.md to get the full list of permissions required by this SKILL

Use ram-permission-diagnose skill to guide the user through requesting the necessary permissions

Pause and wait until the user confirms that the required permissions have been granted

A permission failure means the state is unknown. Never reinterpret it as an empty configuration, disabled feature, or unsupported capability, and never change the request route to bypass the permission boundary.

Parameter Confirmation

Before the first cloud API call, confirm every user-customizable parameter required by the selected mode. Do not assume a profile, region, resource-group scope, protocol, or target instance. An unspecified export directory uses the documented default. The selected workflow owns all later confirmation points.

ParameterRequirementDescriptionDefault OperationRequiredexport or import None CLI profileRequiredExisting profile used explicitly on every callNone RegionRequiredOne DDoS Pro control-plane region per run: cn-hangzhou for Mainland China or ap-southeast-1 outside Mainland ChinaNone Resource-group scopeRequiredOne exact resource group or an explicitly confirmed all-accessible-groups scopeNone Backup scopeExportsingle_port , multiple_ports , instance , or account ; always one YAML per portNone SourceExportExact IP or instance ID; account scope follows the export workflowNone Port selectorPort exportProtocol and frontend port for every manual rule; a bare port number follows limited discoveryNone Input or output pathMode-specificExport defaults to ./ddoscoo-port-backups/ ; import requires one or more one-port YAML filesExport default Target instanceImportTarget instance for every YAML; use the only usable EIP directly, otherwise ask the user to chooseNone Import authorizationImportExplicit request to restore validated YAML to the selected target instance and EIPNone Shared non-website AI decisionConditional importRequired only when backup and target shared values conflictNone

Observability

When loading this Skill, generate one random 32-character lowercase hexadecimal session ID and reuse it for every cloud API call in the same export or import.

Every aliyun command that calls a cloud API must include:

text--user-agent AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-port-configuration-backup/{session-id}

Example:

bashaliyun ddoscoo describe-instances --page-number 1 --page-size 50
--region '' --profile ''
--user-agent AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-port-configuration-backup/{session-id}

Local management commands (aliyun version , aliyun configure list , aliyun configure set , and aliyun plugin update ) do not accept the User-Agent flag. Do not use global AI mode or an environment variable to set the User-Agent.

Core Workflow

IMPORTANT: Parameter Confirmation — Before executing any cloud API call, confirm all user-customizable parameters required by the selected mode. If only a port number is provided, the export workflow may perform one limited ownership discovery; confirm the resolved protocol and port identity before reading per-port details.

Select exactly one mode: export configuration, or import/restore from a specified backup.

Complete the CLI, authentication, RAM, and parameter gates before any cloud API call.

Load only the references required by that mode:

Export: read and execute references/export-workflow.md in full.

Import or restore: read and execute references/import-workflow.md in full.

Both modes use references/verification-method.md

for normalization and success decisions.

Load the schema, coverage matrix, or command index only when that detail is needed.

Complete the selected workflow and exact readback. Never use a process exit code or RequestId as a substitute for configuration equality.

Reference authority

export-workflow.md and import-workflow.md own business order, confirmation points, stop conditions, and artifacts.

related-commands.md owns command and parameter spelling, but cannot expand the restore scope.

verification-method.md owns normalization and success decisions; it cannot add business operations.

acceptance-criteria.md owns package and release checks, not runtime steps.

If two references genuinely conflict, resolve them by this authority order. If the conflict remains, stop before the affected cloud write and report it precisely; do not guess.

Non-negotiable Gates

Operate only on confirmed manual non-website ports. Automatic rules may be used to detect identity conflicts, but never written or deleted.

Non-website AI is an instance-shared policy. If it conflicts with the target, explain that all non-website ports on the instance are affected and obtain the user's explicit choice before any writ