alibabacloud-waf-quick-showcase

What this skill does

# Using WAF to Protect Web Applications on ECS

With this skill, you can quickly deploy a complete web application protection solution, including network environment setup, ECS instance creation, sample application deployment, and WAF integration.

## Prerequisites

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

**[MUST] AI-Mode Configuration** — Must configure AI-Mode before executing CLI commands:

1. **Enable AI-Mode** (before any CLI commands):
   ```bash
   aliyun configure ai-mode enable
   ```

2. **Set User-Agent for AI-Mode**:
   ```bash
   aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-waf-quick-showcase"
   ```

3. **Disable AI-Mode** (after workflow completion):
   ```bash
   aliyun configure ai-mode disable
   ```

**[MUST] CLI User-Agent** — Every `aliyun` CLI command invocation must include:
`--user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-quick-showcase`

## Supported Scenarios

> **This skill supports two usage scenarios**:
> 
> 1. **Quick WAF Protection Experience**: Create VPC, ECS, and WAF from scratch for a complete protection experience
> 2. **Existing WAF Protection Experience**: User already has WAF, create new VPC and ECS to integrate with existing WAF
> 
> **Prohibited Scenario**:
> - **Existing ECS Integration**: Does not support integrating user's existing ECS into WAF
> 
> If the user indicates they have existing ECS and want to integrate it into WAF, respond:
> "This skill is designed for experiencing the complete WAF protection workflow and requires creating new ECS instances. If you want to integrate your existing ECS into WAF, please refer to the Cloud Product Integration feature in the WAF console."

> **CRITICAL: Scenario 1 Resource Creation Rules**
> 
> If the user requests "Quick Experience" (Scenario 1):
> - **VPC**: Create new if quota is sufficient; use existing VPC if quota is full
> - **Must Create New**: VSwitch, Security Group, ECS
> - **WAF Reusable**: If WAF already exists, skip creation and use existing WAF to integrate ECS
> - If creation fails, must stop and inform the user

> **MUST: Scenario 1 Must Check for Existing WAF Instance**
>
> After authentication confirmation and before parameter confirmation, must execute:
> ```bash
> aliyun waf-openapi describe-instance --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-quick-showcase
> ```
>
> - **If valid InstanceId is returned**: Skip WAF creation steps and use this WAF directly to integrate ECS
> - **Prompt**: "Detected that your account already has a WAF instance (InstanceId: [xxx]), will use this instance for protection experience."
> - **If no WAF instance**: Execute Step 4 to create new WAF

### Scenario 2: Existing WAF Protection Experience (Detailed)

> **CRITICAL: Handling Process When User Already Has WAF**
> 
> When the user indicates they have a WAF instance:
> 1. **Ask for WAF Instance ID**: Must first ask for the user's existing WAF instance ID
> 2. **Skip WAF Creation**: **Prohibit** executing `create-postpaid-instance`, directly use the WAF instance ID provided by the user
> 3. **Create New Network and ECS**: Still need to create VPC, VSwitch, Security Group, ECS
> 4. **Integrate Existing WAF**: Use the user's WAF instance ID to execute `sync-product-instance` and `create-cloud-resource`
>
> **Inquiry Prompt**:
> "You already have a WAF instance. Please provide your WAF instance ID (format: waf-cn-xxx), and I will create a new ECS for you and integrate it with your existing WAF for experience."

## Pre-flight Checks (Must Remind Users Before Each Run)

> **IMPORTANT: Must proactively ask and help users complete the following checks before running**
> 
> 1. **CLI Version**: Run `aliyun version` to confirm version >= 3.3.3. If not installed or version too low, run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update.
>    Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.
> 2. **Authentication Configuration**: Run `aliyun configure list` to confirm authentication status is Valid
> 3. **Auto Plugin**: Run `aliyun configure set --auto-plugin-install true`
> 4. **Account Balance**: Confirm Alibaba Cloud account balance >= 100 CNY

### Authentication Configuration Check (Must Execute)

```bash
aliyun configure list
```

> **Reminder when authentication is valid**:
> "Detected that your current CLI authentication configuration is valid:
> - Authentication Mode: [OAuth/AK/StsToken] | Account: [Profile Name] | Region: [Region]
> 
> Please confirm whether to use the current account for operations? Operations will incur charges."
>
> **MUST: Wait for user confirmation before continuing**
> - **Prohibit**: Executing any resource creation operations before user confirmation
> - **Prohibit**: Any authentication mode (including StsToken) must wait for user confirmation

> **When authentication is invalid**: Run `aliyun configure --mode OAuth` to complete configuration

> **Security Reminder**: Explicitly handling AK/SK credentials is strictly prohibited. This skill only supports OAuth authentication mode.

## Solution Architecture

**Architecture Components**: VPC + VSwitch + Security Group + ECS + WAF 3.0 (Pay-as-you-go)

**Traffic Path**: User Request → WAF 3.0 (Traffic Filtering and Cleaning) → ECS (Web Application)

## Installation and Configuration

For detailed installation steps, see [references/cli-installation-guide.md](references/cli-installation-guide.md)

**Quick Start**:
```bash
# macOS (Homebrew)
brew install aliyun-cli

# Authentication Configuration (OAuth Mode)
aliyun configure --mode OAuth

# Verify Version (must be >= 3.3.3)
aliyun version
```

> **Security Reminder**: Explicitly handling AK/SK credentials is strictly prohibited. This skill only supports OAuth authentication mode.

## Parameter Confirmation

> **MUST: Must confirm parameters before execution**
> 
> **Prohibit**: Directly using default values to execute commands; must confirm parameters with the user first.
>
> **MUST: Input Validation Rules** (Must verify the following formats)
> - **RegionId**: Must match `^[a-z]{2}-[a-z]+-[a-z]\d*$` format (e.g., cn-hangzhou-j)
> - **CidrBlock**: Must be valid CIDR format and within RFC1918 private network segments (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
> - **ZoneId**: Must have RegionId as prefix (e.g., cn-hangzhou-j corresponds to cn-hangzhou)
> - **InstanceType**: Must comply with Alibaba Cloud ECS specification naming convention (ecs.[series]-[spec])
> - **InstancePassword**: 8-30 characters, must contain uppercase letters, lowercase letters, and numbers
> - **Security Requirement**: All parameters are prohibited from containing special characters (such as ; | & $ ` \ etc.)

### Parameter Confirmation Prompt (Must Execute)

> After authentication confirmation and before executing any commands, must confirm the following parameters with the user:
>
> **Confirmation Prompt**:
> "Before starting deployment, please confirm the following parameters:
> 
> 1. **Region**: cn-hangzhou (or other regions you prefer, such as cn-shanghai, cn-beijing)
> 2. **VPC CIDR Block**: 192.168.0.0/16
> 3. **Zone**: cn-hangzhou-j
> 4. **ECS Specification**: ecs.e-c1m2.large
> 5. **ECS Password**: Please provide your ECS login password (8-30 characters, containing uppercase letters, lowercase letters, and numbers)
> 
> Do you want to use the above parameters? Or tell me which ones you want to modify."
>
>