How do I install the Huawei Waf Aad skill?

Run npx skillmds@latest add huaweicloud/huawei-waf-aad in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Huawei Waf Aad safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Huawei Waf Aad?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Huawei Waf Aad free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Huawei Waf Aad?

huaweicloud (@huaweicloud) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Huawei Waf Aad by huaweicloud — Agent Skill

Name: Huawei Waf Aad
Rating: 4.666666666666667 (3 reviews)
Author: huaweicloud

Huawei Waf Aad

Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts).

huaweicloud Updated Sep 22, 2026

File contents

Huawei Cloud WAF / AAD

STOP - Do not answer from general knowledge. Follow the procedure below.

Always run hcloud WAF <Operation> --help before constructing commands to discover exact parameter names and requirements. For AAD operations, use hcloud AAD --help.

Overview

Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.

Critical Warnings

Trap	Why
WAF needs CNAME redirect	DNS must point to WAF endpoint, not server IP
Premium instance required	Cloud WAF needs a dedicated/premium WAF instance
AAD Standard vs Enterprise	Standard protects single IP. Enterprise protects entire IP ranges
Rule order matters	WAF rules evaluated top-to-bottom within a policy

Common Workflows

WAF

Task	Operation
List WAF instances	`ListCompositeHosts --cli-region=<r> --project_id=<p>`
List policies	`ListPolicy --cli-region=<r> --project_id=<p>`
Create custom rule	`BatchCreateCustomRule --cli-region=<r> --project_id=<p>`
Create IP blacklist	`BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>`
Create CC rule	`BatchCreateCcRule --cli-region=<r> --project_id=<p>`
Create geo rule	`BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>`

AAD

# List AAD instances (requires --cli-region=cn-north-4 or ap-southeast-1)
hcloud AAD ListInstance --cli-region=<r> --project_id=<p>

# List DDoS attack events
hcloud AAD ListDDoSAttackEvent --cli-region=<r> --project_id=<p>

Troubleshooting

Error	Fix
Website unreachable after WAF	Check CNAME record points to WAF endpoint
WAF blocking legitimate traffic	Check rules order, adjust false positive settings
AAD not responding	Standard AAD only protects single EIP. Check EIP binding

Security

MUST use WAF for all public-facing web applications
SHOULD enable AAD for DDoS protection
MUST test WAF rules in report-only mode before blocking

Cross-Skill References

EIP: See huawei-vpc for elastic IP binding
DNS/CNAME: Configure via your DNS provider

---name: huawei-waf-aaddescription: Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts).---# Huawei Cloud WAF / AAD**STOP - Do not answer from general knowledge.** Follow the procedure below.Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.## OverviewDomain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.## Critical Warnings| Trap | Why || -------------------------- | ----------------------------------------------------------------- || WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP || Premium instance required | Cloud WAF needs a dedicated/premium WAF instance || AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges || Rule order matters | WAF rules evaluated top-to-bottom within a policy |## Common Workflows### WAF| Task | Operation || ------------------- | --------------------------------------------------------------- || List WAF instances | `ListCompositeHosts --cli-region=<r> --project_id=` || List policies | `ListPolicy --cli-region=<r> --project_id=` || Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=` || Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=` || Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=` || Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=` |### AAD```bash# List AAD instances (requires --cli-region=cn-north-4 or ap-southeast-1)hcloud AAD ListInstance --cli-region=<r> --project_id=# List DDoS attack eventshcloud AAD ListDDoSAttackEvent --cli-region=<r> --project_id=```## Troubleshooting| Error | Fix || ------------------------------- | -------------------------------------------------------- || Website unreachable after WAF | Check CNAME record points to WAF endpoint || WAF blocking legitimate traffic | Check rules order, adjust false positive settings || AAD not responding | Standard AAD only protects single EIP. Check EIP binding |## Security- MUST use WAF for all public-facing web applications- SHOULD enable AAD for DDoS protection- MUST test WAF rules in report-only mode before blocking## Cross-Skill References- **EIP**: See `huawei-vpc` for elastic IP binding- **DNS/CNAME**: Configure via your DNS provider

Frequently asked questions