Alibabacloud Dataworks Data Ops

DataWorks Data Operations

DataWorks Operations Center assistant for task and workflow operations, alert rule creation and management. Supports periodic, manual, and triggered tasks/workflows (excludes real-time/streaming tasks).

Installation

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update,

or see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] CLI AI-Mode & User-Agent — Before executing any business CLI command:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops"
aliyun plugin update

After the workflow is complete:

aliyun configure ai-mode disable

Environment Variables

The aliyun CLI default timeout may cause indefinite hangs. You [MUST] set the following environment variables before executing any API command:

For large-volume queries (e.g., paginated task instance lists with 500+ results), ALIBABA_CLOUD_READ_TIMEOUT may be increased to 60000 ms.

If an API call times out, [MUST] retry once with a doubled read timeout value. If the second attempt also fails, report the timeout to the user and suggest checking network connectivity, project ID validity, or RAM permissions.

No other special environment variable requirements.

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

RAM Permissions

This skill requires the following RAM permissions:

Task Management

Task Instance Management

Workflow (Operations Center, read-only)

Workflow Instance (Operations Center, read-only)

Alert Rules (Custom Monitoring, read-only)

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

1. Read references/ram-policies.md to get the full list of permissions required by this SKILL

2. Use ram-permission-diagnose skill to guide the user through requesting the necessary permissions

3. Pause and wait until the user confirms that the required permissions have been granted

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., ProjectId, RegionId, bizdate, instance IDs, etc.)

MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

Instance status enum values (used for --status parameter):

• NotRun - Not Run
• Running - Running
• Failure - Failed
• Success - Success
• WaitTime - Waiting for Time
• WaitResource - Waiting for Resources

Workflow instance type enum values (used for --type parameter):

• Normal - Normal Scheduling
• Manual - Manual Run
• SmokeTest - Smoke Test
• SupplementData - Backfill Data
• ManualWorkflow - Manual Workflow
• TriggerWorkflow - Trigger Workflow

Core Workflows

0. Confirm Target Region

Confirm the target region with the user. Common regions:

• cn-hangzhou - East China 1 (Hangzhou)
• cn-shanghai - East China 2 (Shanghai)
• cn-beijing - North China 2 (Beijing)
• cn-shenzhen - South China 1 (Shenzhen)

---

Task Management

# Query task list
aliyun dataworks-public list-tasks \
  --region <REGION> \
  --project-id <PROJECT_ID> \
  [--name <TASK_NAME>] \
  [--page-size <SIZE>] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

# Get task details
aliyun dataworks-public get-task \
  --region <REGION> \
  --id <TASK_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

For more command parameters and the full command list, see references/related-commands.md

---

Task Instance Management

# Query task instance list (filter by status)
aliyun dataworks-public list-task-instances \
  --region <REGION> \
  --project-id <PROJECT_ID> \
  --bizdate <BIZDATE_TIMESTAMP> \
  [--status NotRun|Running|Failure|Success|WaitTime|WaitResource] \
  [--task-name <TASK_NAME>] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

# Get task instance details (use instance ID from list above)
aliyun dataworks-public get-task-instance \
  --region <REGION> \
  --id <TASK_INSTANCE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

# Get task instance log
aliyun dataworks-public get-task-instance-log \
  --region <REGION> \
  --id <TASK_INSTANCE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

For more commands (instance details, upstream/downstream instances, operation logs, etc.) see references/related-commands.md

---

Workflow (Operations Center, read-only)

# Query workflow list
aliyun dataworks-public list-workflows \
  --region <REGION> \
  --project-id <PROJECT_ID> \
  [--name <WORKFLOW_NAME>] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

# Get workflow details
aliyun dataworks-public get-workflow \
  --region <REGION> \
  --id <WORKFLOW_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

---

Workflow Instance (Operations Center, read-only)

# Query workflow instance list
aliyun dataworks-public list-workflow-instances \
  --region <REGION> \
  --project-id <PROJECT_ID> \
  --biz-date <BIZDATE_TIMESTAMP> \
  [--type Normal|Manual|SmokeTest|SupplementData|ManualWorkflow|TriggerWorkflow] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

# Get workflow instance details
aliyun dataworks-public get-workflow-instance \
  --region <REGION> \
  --id <WORKFLOW_INSTANCE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

---

Alert Rules (Custom Monitoring, read-only)

# Query alert rule list
aliyun dataworks-public list-alert-rules \
  --region <REGION> \
  --page-number <PAGE_NUMBER> \
  --page-size <PAGE_SIZE> \
  [--name <RULE_NAME>] \
  [--owner <OWNER_UID>] \
  [--receiver <RECEIVER_UID>] \
  [--task-ids <ID1> <ID2> ...] \
  [--types <TYPE1> <TYPE2> ...] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

# Get alert rule details
aliyun dataworks-public get-alert-rule \
  --region <REGION> \
  --id <ALERT_RULE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

---

Command Examples

# Step 1: Query failed task instances
aliyun dataworks-public list-task-instances \
  --region cn-hangzhou \
  --project-id 240863 \
  --bizdate 1775404800000 \
  --status Failure \
  --page-size 100 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

# Step 2: View instance log
aliyun dataworks-public get-task-instance-log \
  --region cn-hangzhou \
  --id <INSTANCE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Success Verification

1. Query Verification: ListTaskInstances returns a TaskInstances list, containing instance ID, status, task name, and other information 2. Log Verification: GetTaskInstanceLog returns a TaskInstanceLog field containing log content

For detailed verification steps, see references/verification-method.md

Cleanup

This skill does not create resources. No cleanup required.

Best Practices

1. Business Date Calculation: Bizdate is typically the millisecond timestamp for 00:00:00 the day before the scheduling date 2. Paginated Queries: Use --page-number and --page-size for pagination, maximum 500 per page 3. Pre-operation Check: It is recommended to check instance logs first to confirm the status and avoid repeated failures

References

Acceptance Criteria: alibabacloud-dataworks-data-ops

Scenario: DataWorks task instance operations Purpose: Skill test acceptance standards

---

Correct CLI Command Patterns

1. Product — Verify product name exists

✅ CORRECT

aliyun dataworks-public list-task-instances --region cn-hangzhou --project-id 12345 --bizdate 1743350400000 --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Wrong product name
aliyun dataworks list-task-instances ...
# Missing --region
aliyun dataworks-public list-task-instances --project-id 12345 --bizdate 1743350400000 --user-agent AlibabaCloud-Agent-Skills
# Missing --user-agent
aliyun dataworks-public list-task-instances --region cn-hangzhou --project-id 12345 --bizdate 1743350400000

2. Command — Verify API name is correct

✅ CORRECT

# Use plugin mode format (lowercase hyphen)
aliyun dataworks-public list-task-instances ...
aliyun dataworks-public get-task-instance-log ...
aliyun dataworks-public list-regions ...

❌ INCORRECT

# Use traditional API format (camelCase)
aliyun dataworks-public ListTaskInstances ...
aliyun dataworks-public GetTaskInstanceLog ...

3. Parameters — Verify parameter names are correct

✅ CORRECT

# ListTaskInstances required parameters
aliyun dataworks-public list-task-instances \
  --region cn-hangzhou \
  --project-id 12345 \
  --bizdate 1743350400000 \
  --status Failure \
  --user-agent AlibabaCloud-Agent-Skills

# GetTaskInstanceLog required parameters
aliyun dataworks-public get-task-instance-log \
  --region cn-hangzhou \
  --id 67890 \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Missing --region
aliyun dataworks-public list-task-instances --project-id 12345 --bizdate 1743350400000 ...
# Wrong parameter name
aliyun dataworks-public list-task-instances --projectId 12345 ...
aliyun dataworks-public list-task-instances --biz_date 1743350400000 ...

4. Enum Values — Verify enum values are valid

✅ CORRECT

# Status enum values are correct
--status Failure
--status Success
--status Running
--status NotRun
--status WaitTime
--status WaitResource

❌ INCORRECT

# Wrong status value
--status failed
--status FAILED
--status Error

Security Patterns

1. Credential Handling

✅ CORRECT

# Only check credential status
aliyun configure list

❌ INCORRECT

# Read/print AK/SK
echo $ALIBABA_CLOUD_ACCESS_KEY_ID
echo $ALIBABA_CLOUD_ACCESS_KEY_SECRET

# Ask user to input credentials
read -p "Enter AK: " ak
aliyun configure set --access-key-id $ak

2. User Agent

✅ CORRECT

# Every aliyun command includes user-agent
aliyun dataworks-public list-task-instances --region cn-hangzhou --project-id 12345 --bizdate 1743350400000 --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Missing user-agent
aliyun dataworks-public list-task-instances --region cn-hangzhou --project-id 12345 --bizdate 1743350400000

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Permission List

RAM permissions required for this skill:

Task Management Permissions

Task Instance Management Permissions

Workflow (Operations Center) Permissions

Workflow Instance (Operations Center) Permissions

Alert Rule (Custom Monitoring) Permissions

Recommended Permission Policy

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:GetTask",
        "dataworks:ListTasks",
        "dataworks:ListUpstreamTasks",
        "dataworks:ListDownstreamTasks",
        "dataworks:ListTaskOperationLogs",
        "dataworks:ListTaskInstances",
        "dataworks:GetTaskInstance",
        "dataworks:GetTaskInstanceLog",
        "dataworks:ListUpstreamTaskInstances",
        "dataworks:ListDownstreamTaskInstances",
        "dataworks:ListTaskInstanceOperationLogs",
        "dataworks:GetWorkflow",
        "dataworks:ListWorkflows",
        "dataworks:ListWorkflowInstances",
        "dataworks:GetWorkflowInstance",
        "dataworks:ListAlertRules",
        "dataworks:GetAlertRule"
      ],
      "Resource": "*"
    }
  ]
}

Principle of Least Privilege

To restrict to a specific workspace, replace Resource with:

"Resource": [
  "acs:dataworks:<region>:<account-id>:project/<project-id>"
]

Permission Check Command

# Check current account identity
aliyun sts get-caller-identity --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

CLI Command Quick Reference

DataWorks Operations Commands

Task Management

Query Task List

aliyun dataworks-public list-tasks \
  --region <REGION> \
  --project-id <PROJECT_ID> \
  [--ids <ID1> <ID2> ...] \
  [--name <TASK_NAME>] \
  [--owner <OWNER_ACCOUNT_ID>] \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  [--project-env Prod|Dev] \
  [--sort-by "Id Desc"] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Parameter Description:

Get Task Details

aliyun dataworks-public get-task \
  --region <REGION> \
  --id <TASK_ID> \
  [--project-env Prod|Dev] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Parameter Description:

Query Upstream/Downstream Tasks

aliyun dataworks-public list-upstream-tasks \
  --region <REGION> \
  --id <TASK_ID> \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  [--project-env Prod|Dev] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

aliyun dataworks-public list-downstream-tasks \
  --region <REGION> \
  --id <TASK_ID> \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  [--project-env Prod|Dev] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Query Task Operation Logs

aliyun dataworks-public list-task-operation-logs \
  --region <REGION> \
  --id <TASK_ID> \
  [--date <UNIX_TIMESTAMP_MS>] \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  [--project-env Prod|Dev] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

---

Task Instance Management

Query Task Instance List

aliyun dataworks-public list-task-instances \
  --region <REGION> \
  --project-id <PROJECT_ID> \
  --bizdate <BIZDATE_TIMESTAMP> \
  [--status <STATUS>] \
  [--task-name <TASK_NAME>] \
  [--owner <OWNER_ACCOUNT_ID>] \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  [--project-env Prod|Dev] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Parameter Description:

Get Task Instance Details

aliyun dataworks-public get-task-instance \
  --region <REGION> \
  --id <TASK_INSTANCE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Get Instance Log

aliyun dataworks-public get-task-instance-log \
  --region <REGION> \
  --id <TASK_INSTANCE_ID> \
  [--run-number <RUN_NUMBER>] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Parameter Description:

Query Upstream/Downstream Task Instances

aliyun dataworks-public list-upstream-task-instances \
  --region <REGION> \
  --id <TASK_INSTANCE_ID> \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

aliyun dataworks-public list-downstream-task-instances \
  --region <REGION> \
  --id <TASK_INSTANCE_ID> \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Query Task Instance Operation Logs

aliyun dataworks-public list-task-instance-operation-logs \
  --region <REGION> \
  --id <TASK_INSTANCE_ID> \
  [--date <UNIX_TIMESTAMP_MS>] \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

---

Workflow (Operations Center, read-only)

Get Workflow Details

aliyun dataworks-public get-workflow \
  --region <REGION> \
  --id <WORKFLOW_ID> \
  [--env-type Prod|Dev] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Query Workflow List

aliyun dataworks-public list-workflows \
  --region <REGION> \
  --project-id <PROJECT_ID> \
  [--name <WORKFLOW_NAME>] \
  [--owner <OWNER_ACCOUNT_ID>] \
  [--ids <ID1> <ID2> ...] \
  [--tags <TAG1> <TAG2> ...] \
  [--trigger-type Scheduler|Manual|TriggerWorkflow] \
  [--env-type Prod|Dev] \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  [--sort-by "Id Desc"] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

---

Workflow Instance (Operations Center, read-only)

Query Workflow Instance List

aliyun dataworks-public list-workflow-instances \
  --region <REGION> \
  --project-id <PROJECT_ID> \
  --biz-date <BIZDATE_TIMESTAMP> \
  [--name <INSTANCE_NAME>] \
  [--owner <OWNER_ACCOUNT_ID>] \
  [--type Normal|Manual|SmokeTest|SupplementData|ManualWorkflow|TriggerWorkflow] \
  [--workflow-id <WORKFLOW_ID>] \
  [--ids <ID1> <ID2> ...] \
  [--tags <TAG1> <TAG2> ...] \
  [--unified-workflow-instance-id <UNIFIED_ID>] \
  [--filter '<FILTER_JSON>'] \
  [--page-size <SIZE>] \
  [--page-number <NUMBER>] \
  [--sort-by "Id Desc"] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Get Workflow Instance Details

aliyun dataworks-public get-workflow-instance \
  --region <REGION> \
  --id <WORKFLOW_INSTANCE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

---

Common Query Commands

Query Failed Instances

# Get business date (yesterday 00:00:00 timestamp)
BIZDATE=$(($(date -j -v-1d -f "%Y-%m-%d" "$(date +%Y-%m-%d)" "+%s") * 1000))

aliyun dataworks-public list-task-instances \
  --region cn-hangzhou \
  --project-id 240863 \
  --bizdate $BIZDATE \
  --status Failure \
  --page-size 100 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Query by Task Name

aliyun dataworks-public list-task-instances \
  --region cn-hangzhou \
  --project-id <PROJECT_ID> \
  --bizdate <BIZDATE> \
  --task-name "ods_user_log" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

---

Alert Rules (Custom Monitoring, read-only)

Query Alert Rule List

aliyun dataworks-public list-alert-rules \
  --region <REGION> \
  --page-number <PAGE_NUMBER> \
  --page-size <PAGE_SIZE> \
  [--name <RULE_NAME>] \
  [--owner <OWNER_UID>] \
  [--receiver <RECEIVER_UID>] \
  [--task-ids <ID1> <ID2> ...] \
  [--types <TYPE1> <TYPE2> ...] \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Parameter Description:

Get Alert Rule Details

aliyun dataworks-public get-alert-rule \
  --region <REGION> \
  --id <ALERT_RULE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops

Parameter Description:

Success Verification Methods

1. ListTaskInstances Verification

Expected Response Structure

{
  "RequestId": "xxx-xxx-xxx",
  "PagingInfo": {
    "TotalCount": 10,
    "PageSize": 100,
    "PageNumber": 1,
    "TaskInstances": [
      {
        "Id": 12345,
        "TaskId": 1001,
        "TaskName": "ods_user_log",
        "Status": "Failure",
        "Bizdate": 1743350400000,
        "TriggerTime": 1743436800000,
        "Owner": "xxx"
      }
    ]
  }
}

Verification Steps

1. Check response contains PagingInfo field 2. Check TaskInstances array contains queried instances 3. Check each instance contains Id, Status, TaskName and other key fields

Verification Command

# Query and check returned instance count
aliyun dataworks-public list-task-instances \
  --region cn-hangzhou \
  --project-id <PROJECT_ID> \
  --bizdate <BIZDATE> \
  --status Failure \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops | jq '.PagingInfo.TotalCount'

2. GetTaskInstanceLog Verification

Expected Response Structure

{
  "RequestId": "xxx-xxx-xxx",
  "TaskInstanceLog": "This is running log..."
}

Verification Steps

1. Check response contains TaskInstanceLog field 2. Log content is not empty or contains valid information

Verification Command

# Get log and check length
aliyun dataworks-public get-task-instance-log \
  --region cn-hangzhou \
  --id <TASK_INSTANCE_ID> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-ops | jq '.TaskInstanceLog | length'

Common Error Handling