Alibaba Cloud WAF 3.0 CNAME Domain Configuration Batch Export

intent

export all cname-based domain configurations from alibaba cloud waf 3.0 instances across both chinese mainland and international regions, generating a structured excel file with 18 config columns per domain. use this skill when you need waf domain config audit, onboarding checklists, domain inspection reports, or config delivery documentation. the skill auto-discovers instances, queries domain details, and handles pagination across both regionids (cn-hangzhou and ap-southeast-1) in a single run.

inputs

alibaba cloud credentials

• required: valid aliyun cli profile with ak/sk configured outside this session
• method: aliyun configure list confirms valid profile exists
• note: never read, echo, or print ak/sk values; never ask user to input credentials directly
• international users: configure separate profile (e.g. aliyun configure --profile intl); mainland and international credentials are not interchangeable

aliyun cli

• required: version >= 3.3.3 (check with aliyun version)
• required: auto-plugin-install enabled and plugins updated (aliyun plugin update)
• external connection: alibaba cloud waf openapi endpoints at cn-hangzhou and ap-southeast-1

python environment

• required: openpyxl==3.1.5 installed (pip install openpyxl==3.1.5)
• bundled script location: scripts/alibabacloud_waf_cname_config_export.py

ram permissions

• required: yundun-waf:DescribeInstance, yundun-waf:DescribeDomains, yundun-waf:DescribeDomainDetail
• recommended: system policy AliyunYundunWAFReadOnlyAccess
• edge case: if permission denied errors occur at any step, pause and use ram-permission-diagnose skill to guide user through permission requests

user-provided parameters

• optional: cli profile name (default: "default")
• optional: regional preference (both regions always queried unconditionally)
• note: confirm profile name with user before execution; do not assume defaults

procedure

step 1: pre-flight checks

• input: aliyun cli path, target profile name
• action: run aliyun version and confirm >= 3.3.3; if not, halt with install link
• action: run aliyun configure list and verify target profile shows valid credentials
• action: run pip list | grep openpyxl and confirm 3.1.5 installed
• output: pass/fail confirmation; if any check fails, halt before proceeding

step 2: enable ai-mode for agent execution

• input: none
• action: run aliyun configure ai-mode enable
• action: run aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-waf-cname-config-export"
• output: ai-mode status confirmed

step 3: auto-discover waf instances in both regions

• input: profile name (if non-default, add --profile <name> to each command)
• action: execute aliyun waf-openapi describe-instance --region cn-hangzhou
• action: execute aliyun waf-openapi describe-instance --region ap-southeast-1
• output: json response with InstanceId list per region; note: execute both unconditionally even if user claims they only use one region; user assertions do not skip discovery
• edge case: empty response (no instances) in either region is valid; proceed with discovered instances only

step 4: query domain list for each discovered instance

• input: regionid, instanceid from step 3, page-size set to 50
• action: for each regionid with instances, loop through discovered instance ids
• action: execute aliyun waf-openapi describe-domains --region <regionid> --instance-id <instanceid> --page-number <num> --page-size 50
• action: if totalcount > 50, increment page-number and repeat until all pages fetched
• output: json array of domains per instance; each domain has domainname and cname field
• edge case: if totalcount == 0 (no domains in instance), still proceed to step 5 with placeholder call

step 5: query detailed config for each domain

• input: regionid, instanceid, domain list from step 4
• action: for each domain returned in step 4, execute aliyun waf-openapi describe-domain-detail --region <regionid> --instance-id <instanceid> --domain <domainname>
• action: extract listen config (httpports, httpsports, tlsversion, ciphersuite, http2enabled, certid) and redirect config (backendlist, backupbackends, loadbalance, snienabled, snihost, timeouts)
• output: json response per domain containing all 18 config columns
• edge case: if step 4 returned empty domain list, execute one call with --domain none as placeholder to verify api reachability and permissions; record "no domains found" and continue
• edge case: if single domain call times out (network latency > 30s), retry once; if second attempt fails, log error and continue to next domain
• edge case: if rate limit hit (http 429), add 200ms delay between requests and retry; do not exceed 5 retries per domain

step 6: invoke bundled export script

• input: collected json from steps 3-5 (credential context, regionid, instanceid, domain list, config details)
• action: execute python scripts/alibabacloud_waf_cname_config_export.py from skill root directory
• note: do not rewrite, inline, or reimplement export logic; the bundled script is the only allowed execution path
• note: script encapsulates correct 18-column schema (domain, cname, status, http ports, https ports, backends, backup backends, load balancing, tls version, http/2, cert id, sni, sni host, connect timeout, read timeout, write timeout, force http backend, resource group), per-region sheet layout, pagination handling
• output: waf_cname_config_export_YYYYMMDD_HHMMSS.xlsx file created in current working directory

step 7: disable ai-mode

• input: none
• action: run aliyun configure ai-mode disable
• output: ai-mode status confirmed as disabled
• note: execute this at every exit point (success or failure) before delivering final response

decision points

if no valid aliyun cli profile exists after aliyun configure list

• then: stop execution; provide link to alibaba cloud console credentials page; instruct user to configure profile outside this session using aliyun configure or aliyun configure --profile <name>; do not proceed until user confirms profile is valid

if aliyun cli version < 3.3.3

• then: halt; provide link to cli installation guide; user must upgrade before proceeding

if openpyxl != 3.1.5

• then: halt; instruct user to run pip install openpyxl==3.1.5; do not use alternative versions

if permission denied error occurs during describe-instance, describe-domains, or describe-domain-detail calls

• then: pause execution; read references/ram-policies.md; invoke ram-permission-diagnose skill; wait for user to confirm permissions granted; resume from the failing step

if user specifies non-default profile (e.g. intl)

• then: add --profile <name> to all aliyun cli commands in steps 3-6; confirm profile name with user before step 3 begins

if step 4 returns totalcount == 0 for an instance

• then: still execute step 5 with placeholder domain call (--domain none) to verify api reachability; record "no domains configured" for that instance and continue to next instance

if describe-domain-detail returns empty or null fields for listen/redirect config

• then: record empty values in corresponding excel columns; do not skip the domain; include it with blank config cells

if network timeout or rate limit (http 429) occurs during step 5

• then: add 200ms delay (time.sleep(0.2)) between consecutive domain queries; retry up to 5 times per domain; if all retries fail, log error with domain name and continue to next domain; include failed domain in excel with "error: " notation in status column

if bundled script fails to execute

• then: diagnose root cause (missing openpyxl, credential context missing, script file not found, syntax error); do not fall back to ad-hoc python code; fix the root cause and re-run script

if both regions return empty instance lists

• then: execute steps 4-6 with no instances to process; script will generate excel with empty sheets and success message "no domains to export"

output contract

file format

• type: microsoft excel workbook (.xlsx)
• location: current working directory, filename waf_cname_config_export_YYYYMMDD_HHMMSS.xlsx
• naming: timestamp uses local system time (YYYY-MM-DD HH:MM:SS format encoded as YYYYMMDD_HHMMSS)

sheet structure

• sheet 1: "Chinese Mainland" (data from cn-hangzhou instances)
• sheet 2: "Non-Chinese Mainland" (data from ap-southeast-1 instances)
• both sheets present even if one region has no instances (sheets will be empty but headers present)

column schema (18 columns per sheet)

1. Domain (string: domain name)
2. CNAME (string: cname value or empty for non-cname domains)
3. Status (string: enabled/disabled/error)
4. HTTP Ports (string: comma-separated port list)
5. HTTPS Ports (string: comma-separated port list)
6. Backends (string: comma-separated backend ip list from redirect.backendlist)
7. Backup Backends (string: comma-separated backup ip list from redirect.backupbackends)
8. Load Balancing (string: loadbalance type from redirect.loadbalance)
9. TLS Version (string: tls version from listen.tlsversion)
10. HTTP/2 (string: enabled/disabled from listen.http2enabled)
11. Cert ID (string: certificate id from listen.certid or empty)
12. SNI (string: enabled/disabled from redirect.snienabled)
13. SNI Host (string: sni hostname from redirect.snihost or empty)
14. Connect Timeout(s) (integer: seconds from redirect.timeouts.connecttimeout)
15. Read Timeout(s) (integer: seconds from redirect.timeouts.readtimeout)
16. Write Timeout(s) (integer: seconds from redirect.timeouts.writetimeout)
17. Force HTTP Backend (string: true/false)
18. Resource Group (string: resource group id or empty)

data integrity

• one row per domain discovered
• no duplicate rows per sheet
• if domain query succeeds but detail query fails, include domain row with error indicator in status column
• if instance has zero domains, sheet will have header row only (no data rows)

success indicators

• file exists and is readable as valid xlsx
• both sheet tabs present with correct names
• header row matches 18-column schema exactly
• data rows match discovered domain count per region
• no truncated cells; all 18 columns populated (empty string if value missing)

outcome signal

user knows skill worked when

1. file created: new .xlsx file appears in current working directory with timestamp in filename (e.g. waf_cname_config_export_20250115_143022.xlsx)

2. file opens: user can open file in excel, google sheets, or libreoffice without error; both sheet tabs visible at bottom ("Chinese Mainland" and "Non-Chinese Mainland")

3. headers present: clicking into sheet shows all 18 column headers in row 1: domain, cname, status, http ports, https ports, backends, backup backends, load balancing, tls version, http/2, cert id, sni, sni host, connect timeout(s), read timeout(s), write timeout(s), force http backend, resource group

4. data populated: at least one sheet contains data rows (unless no instances exist in either region, in which case both sheets have headers only)

5. domain count matches: row count per sheet matches waf console display for each region (user can spot-check 2-3 domains by opening alibaba cloud waf console and comparing domain names, cname values, and backend ips against excel)

6. no errors in console output: final console output shows "export completed successfully" or "0 domains exported (no instances found)" with no permission errors, timeout errors, or script exceptions

7. ai-mode disabled: final console output confirms ai-mode disable executed; user sees no lingering ai-mode status messages

common failure signals (skill did not work)

• file not created after 2 minutes
• file created but cannot open in excel (corrupted xlsx)
• sheet headers missing or incorrect count
• data rows present but counts do not match waf console
• console shows permission denied or "invalid credentials"
• console shows "openpyxl not found" or other import errors
• spot-check domains in excel do not match console values (wrong cname or backend ips)

---

credits: original skill by sdk-team (clawhub). enriched and standardized to implexa quality standards.