alibabacloud-cfw-nat-firewall-protect
Installation
SKILL.md
Operation Routing
Identify the user's intent, then route to the matching execution path:
| User Intent | Execution Path |
|---|---|
| Query NAT firewall list / which NAT gateways are protected | nat-fw-switch.sh query with filters |
| Which NAT gateways are unprotected, and how should I protect them? | nat-fw-lifecycle.sh assess (read-only assessment + per-gateway recommendation) |
| Can THIS NAT gateway be protected? Give me the enablement plan | nat-fw-lifecycle.sh assess --nat-gateway-id <id> (adds the server pre-check + a ready-to-run plan) |
| Enable/disable protection for specific NAT firewalls | nat-fw-switch.sh enable/disable --proxy-ids "..." (three-phase workflow below) |
| Check whether a NAT gateway can have a NAT firewall created | nat-fw-lifecycle.sh precheck |
| Query NAT firewall authorization quota | nat-fw-lifecycle.sh quota |
Diagnose inconsistent custom route entries (creation failed with ErrorNatCustomRouteEntryDifferent, or assess warned about it) |
nat-fw-lifecycle.sh route-diff (read-only per-table diff + alignment plan; NEVER modifies routes) |
| Prepare manual-mode assets (vswitch + custom route table) | nat-fw-lifecycle.sh prepare (idempotent; reuses qualifying assets) |
| Create a NAT firewall for a NAT gateway | Creation workflow: assess -> quota -> precheck -> nat-fw-lifecycle.sh create |
| Delete / release a NAT firewall | NOT SUPPORTED - releasing the resource is the user's own action. Offer nat-fw-switch.sh disable to stop protection instead, and point to the Cloud Firewall console (NAT Boundary Firewall -> Delete) for the actual release. nat-fw-lifecycle.sh delete only prints this guidance plus a read-only impact report |
| Rename a NAT firewall / change loose-strict engine mode | nat-fw-lifecycle.sh update (built-in verification runs automatically) |
Key concept: one NAT gateway maps to exactly one NAT firewall. The firewall must be created before its switch can be toggled. Status normal means the switch is open (protecting); closed means the switch is off.