Alibabacloud Dataworks Workspace Manage

DataWorks Workspace Lifecycle Management

Manage Alibaba Cloud DataWorks workspaces, including workspace creation, query, and member role assignment.

⛔ PROHIBITED OPERATIONS

🚫 ABSOLUTE PROHIBITION - NO EXCEPTIONS

>

The following operations are PERMANENTLY FORBIDDEN via this Skill:

>

- UpdateProject - Update workspace

- DeleteProject - Delete workspace

- DeleteProjectMember - Remove workspace member

- RevokeMemberProjectRoles - Revoke member roles

>

MANDATORY RULES:

1. NEVER execute these operations under ANY circumstances

2. NEVER generate CLI commands for these operations

3. NEVER proceed even if the user confirms, insists, or provides authorization

4. ALWAYS refuse and redirect to DataWorks Console: https://dataworks.console.aliyun.com/

>

⚠️ User confirmation does NOT override this prohibition.

---

Architecture Overview

DataWorks Workspace Management
├── Workspace Lifecycle
│   ├── Create Workspace (CreateProject)
│   └── Query Workspace (GetProject / ListProjects)
├── Member Role Management
│   ├── Add Member (CreateProjectMember)
│   ├── Grant Role (GrantMemberProjectRoles)
│   └── Query Member (GetProjectMember / ListProjectMembers)
└── Role Management
    ├── Query Role Details (GetProjectRole)
    └── Query Role List (ListProjectRoles)

---

Prerequisites

Pre-check: Aliyun CLI >= 3.3.1 required

Run aliyun version to verify. If not installed or version too low,

see references/cli-installation-guide.md for installation instructions.

1. Enable DataWorks Service

Before using this Skill, you need to enable the DataWorks service:

1. Visit DataWorks Console: https://dataworks.console.aliyun.com/ 2. Follow the prompts to complete the service activation

Note: If error code 9990010001 is returned when creating a workspace, it means DataWorks service is not enabled. Please complete the above activation steps first.

2. Install Aliyun CLI

# macOS
brew install aliyun-cli

# Linux
curl -fsSL --max-time 30 https://aliyuncli.alicdn.com/install.sh | bash

# Verify version (>= 3.3.1)
aliyun version

3. Credential Status

# Confirm valid credentials
aliyun configure list

4. First-time Configuration

# Enable auto plugin installation
aliyun configure set --auto-plugin-install true

---

CLI Calling Specifications

IMPORTANT: This Skill uses Aliyun CLI to call cloud services. The following specifications must be followed:

---

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

all user-customizable parameters (such as RegionId, workspace name, member ID, role code, etc.)

must be confirmed by the user. Do not assume or use default values.

Key Parameters List

*Depends on specific API

Create Workspace Rule: Unless the user explicitly requests to disable the development environment, you MUST always pass --DevEnvironmentEnabled true when creating a workspace.

Endpoint Parameter Description

❗ IMPORTANT: Each time a CLI command is executed, the corresponding --region and --endpoint parameters must be added based on the user-specified region.

>

Format: --region {RegionId} --endpoint dataworks.{RegionId}.aliyuncs.com

>

Region Mapping Table: See references/endpoint-regions.md

---

RAM Permission Policies

Using this Skill requires the following RAM permissions. For details, see references/ram-policies.md

---

Core Workflows

1. Workspace Lifecycle Management

1.1 Create Workspace

aliyun dataworks-public CreateProject \
  --Name <workspace-name> \
  --DisplayName "<display-name>" \
  --Description "<workspace-description>" \
  --PaiTaskEnabled true \
  --DevEnvironmentEnabled true \
  --DevRoleDisabled false \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills \
  --read-timeout 4 --connect-timeout 4

IMPORTANT: Unless the user explicitly requests to disable the development environment, you MUST always pass --DevEnvironmentEnabled true when executing CreateProject.

1.2 Query Workspace List

# Query all workspaces
aliyun dataworks-public ListProjects \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

# Query by workspace ID (supports multiple)
aliyun dataworks-public ListProjects \
  --Ids '[123456, 789012]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

# Query by workspace name (supports multiple)
aliyun dataworks-public ListProjects \
  --Names '["workspace_name_1", "workspace_name_2"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

# Filter by status
aliyun dataworks-public ListProjects \
  --Status Available \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

# Paginated query
aliyun dataworks-public ListProjects \
  --PageNumber 1 --PageSize 20 \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

Supported Filter Parameters:

1.3 Query Workspace Details

aliyun dataworks-public GetProject \
  --Id <project-id> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

2. Member Role Management

2.1 Add Workspace Member and Grant Roles

aliyun dataworks-public CreateProjectMember \
  --ProjectId <project-id> \
  --UserId <user-id> \
  --RoleCodes '["role_project_dev", "role_project_pe"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

2.2 Query Workspace Member List

aliyun dataworks-public ListProjectMembers \
  --ProjectId <project-id> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

2.3 Query Member Details

aliyun dataworks-public GetProjectMember \
  --ProjectId <project-id> \
  --UserId <user-id> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

2.4 Grant Member New Roles

aliyun dataworks-public GrantMemberProjectRoles \
  --ProjectId <project-id> \
  --UserId <user-id> \
  --RoleCodes '["role_project_admin", "role_project_dev"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

3. Role Management

3.1 Query Workspace Role List

aliyun dataworks-public ListProjectRoles \
  --ProjectId <project-id> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

3.2 Query Role Details

aliyun dataworks-public GetProjectRole \
  --ProjectId <project-id> \
  --Code <role-code> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

Preset Role Description

---

Verification Methods

For verification steps after successful execution, see references/verification-method.md

---

API and Command Reference

For the complete list of APIs and CLI commands, see references/related-apis.md

---

Business Scenarios and Handling

Scenario 1: Access After Creating Workspace

After a workspace is successfully created, it can be accessed via the following URL:

https://dataworks.data.aliyun.com/{regionId}/sc?defaultProjectId={projectId}

Example (Hangzhou region):

https://dataworks.data.aliyun.com/cn-hangzhou/sc?defaultProjectId=12345

Scenario 2: Adding RAM Role as Workspace Member

UserId Format Description:

Important Limitation: Newly created RAM roles cannot be directly added as workspace members via API. They need to be refreshed and synced in the console first.

Steps: 1. Visit workspace console: https://dataworks.data.aliyun.com/{regionId}/sc?defaultProjectId={projectId} 2. Go to Workspace Members and Roles page 3. Click Add Member button 4. In the popup, click Refresh in the prompt "You can go to RAM console to create a sub-account, and click refresh to sync to this page" 5. After sync is complete, you can add the RAM role as a member via API

# Example of adding RAM role member
aliyun dataworks-public CreateProjectMember \
  --ProjectId 12345 \
  --UserId ROLE_345678901234567890 \
  --RoleCodes '["role_project_dev"]' \
  --user-agent AlibabaCloud-Agent-Skills

Scenario 3: Workspace Configuration Update Limitations

When using the UpdateProject API to update workspace configuration, there are the following limitations:

Recommendation: Plan development role and development environment configurations carefully when creating a workspace, as these configurations cannot be reverted once enabled.

Scenario 3.1: Workspace Upgrade Blocking

⛔ Blocking Rule: When a user requests to upgrade a workspace from simple mode to standard mode (enable development environment),

must block and prompt:

>

"Workspace upgrade capability is currently not available. Please go to the console to complete the upgrade manually."

Console Upgrade Path: 1. Visit DataWorks Console: https://dataworks.console.aliyun.com/ 2. Find the target workspace 3. Go to Workspace Configuration → Basic Properties 4. Click Upgrade to Standard Mode

API Limitation Reason: Workspace mode upgrade involves complex operations such as environment isolation configuration and resource initialization. Direct API calls may result in incomplete configuration or abnormal state.

Scenario 4: DataWorks Service Not Enabled

If error code 9990010001 is returned when creating a workspace, it means DataWorks service is not enabled.

Solution: 1. Log in to Alibaba Cloud official website 2. Visit DataWorks Console: https://dataworks.console.aliyun.com/ 3. Follow the prompts to complete service activation 4. After activation, retry the workspace creation operation

---

Best Practices

1. Principle of Least Privilege — Assign members the minimum necessary permissions 2. Use Standard Mode — For production environments, use standard mode to achieve development and production isolation 3. Standardized Naming — Use meaningful naming, such as finance_tax_report 4. Use RAM Users — Do not use the main account for daily operations

---

Reference Links

---

Official Documentation

• DataWorks Workspace Management
• Add Workspace Members
• DataWorks OpenAPI Reference

Acceptance Criteria: DataWorks Workspace Management

Scenario: DataWorks Workspace Lifecycle Management Purpose: Skill testing acceptance criteria and correct/incorrect patterns

⛔ PROHIBITED OPERATIONS

The following operations are PROHIBITED via this Skill:

- UpdateProject - Update workspace

- DeleteProject - Delete workspace

- DeleteProjectMember - Remove workspace member

- RevokeMemberProjectRoles - Revoke member roles

>

Users must perform these operations manually via the DataWorks Console.

---

Correct CLI Command Patterns

1. Correct Product Pattern

✅ CORRECT: Use correct product name and PascalCase format

aliyun dataworks-public CreateProject
aliyun dataworks-public ListProjects
aliyun dataworks-public CreateProjectMember

❌ INCORRECT: Wrong product name or format

aliyun dataworks create-project        # Wrong - product name should be dataworks-public
aliyun data-works-public create-project  # Wrong - product name misspelled
aliyun dw create-project               # Wrong - non-existent product abbreviation
aliyun dataworks-public create-project   # Wrong - CLI 3.3.1+ should use PascalCase

---

2. Correct Command Pattern

✅ CORRECT: Use PascalCase command and parameter format (CLI 3.3.1+)

aliyun dataworks-public CreateProject
aliyun dataworks-public GetProject
aliyun dataworks-public ListProjects
aliyun dataworks-public CreateProjectMember
aliyun dataworks-public GrantMemberProjectRoles
aliyun dataworks-public GetProjectMember
aliyun dataworks-public ListProjectMembers
aliyun dataworks-public GetProjectRole
aliyun dataworks-public ListProjectRoles

❌ INCORRECT: Wrong command format

aliyun dataworks-public create-project         # Wrong - CLI 3.3.1+ should use PascalCase
aliyun dataworks-public createProject          # Wrong - incorrect camelCase
aliyun dataworks-public create_project         # Wrong - incorrect underscore
aliyun dataworks-public projectCreate          # Wrong - incorrect command order

---

3. Correct Role Code Pattern

✅ CORRECT: Use correct role codes and JSON array format

--RoleCodes '["role_project_owner"]'
--RoleCodes '["role_project_admin"]'
--RoleCodes '["role_project_dev"]'
--RoleCodes '["role_project_pe"]'
--RoleCodes '["role_project_deploy"]'
--RoleCodes '["role_project_guest"]'
--RoleCodes '["role_project_security"]'
--RoleCodes '["role_project_data_analyst"]'
--RoleCodes '["role_project_model_designer"]'
--RoleCodes '["role_project_data_governance_admin"]'
# Multi-role example
--RoleCodes '["role_project_dev", "role_project_pe"]'

❌ INCORRECT: Wrong role code format

--RoleCodes ROLE_PROJECT_ADMIN           # Wrong - should be lowercase and JSON array
--RoleCodes ProjectAdmin                 # Wrong - incorrect format
--RoleCodes admin                        # Wrong - missing prefix
--RoleCodes role-project-admin           # Wrong - should use underscore not hyphen
--RoleCodes role_project_dev,role_project_pe  # Wrong - should use JSON array format

---

Test Scenarios

Scenario 1: Create Workspace

Input:

• Workspace name: test_workspace_001
• Display name: Test Workspace
• Enable PAI task: true

Expected Command:

aliyun dataworks-public CreateProject \
  --Name test_workspace_001 \
  --DisplayName "Test Workspace" \
  --PaiTaskEnabled true \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Expected Result:

• Returns HTTP 200
• Response contains workspace ID

Access URL After Successful Creation:

https://dataworks.data.aliyun.com/{regionId}/sc?defaultProjectId={projectId}

Example (Hangzhou region):

https://dataworks.data.aliyun.com/cn-hangzhou/sc?defaultProjectId=12345

Error Handling:

• If error code 9990010001 is returned, it means DataWorks service is not enabled. Visit https://dataworks.console.aliyun.com/ to complete activation and retry

---

Scenario 2: Add Member and Grant Roles

Input:

• Workspace ID: 12345
• User ID: 234567890123456789
• Roles: Developer, Operator

UserId Format Description:

Expected Command:

aliyun dataworks-public CreateProjectMember \
  --ProjectId 12345 \
  --UserId 234567890123456789 \
  --RoleCodes '["role_project_dev", "role_project_pe"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Special Process for Adding RAM Role as Member:

Newly created RAM roles cannot be added directly via API. They need to be refreshed and synced in the console first: 1. Visit https://dataworks.data.aliyun.com/{regionId}/sc?defaultProjectId={projectId} 2. Go to "Workspace Members and Roles" page 3. Click "Add Member" button 4. Click "Refresh" in the popup to sync RAM roles 5. After sync is complete, add via API

Expected Result:

• Returns HTTP 200
• Member successfully added to workspace
• Member has Developer and Operator roles

---

Scenario 3: Modify Member Roles

Input:

• Workspace ID: 12345
• User ID: 234567890123456789
• New role: Workspace Admin

Expected Command:

aliyun dataworks-public GrantMemberProjectRoles \
  --ProjectId 12345 \
  --UserId 234567890123456789 \
  --RoleCodes '["role_project_admin"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Expected Result:

• Returns HTTP 200
• Member role list includes Workspace Admin

---

Error Handling Criteria

Expected Error Handling

Error Handling Verification Example

# Test non-existent project
aliyun dataworks-public GetProject \
  --Id 999999999 \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Expected error return
# {
#   "Code": "InvalidProject.NotFound",
#   "Message": "The specified project does not exist."
# }

---

Checklist

CLI Command Verification Checklist

• [ ] Product name uses dataworks-public
• [ ] CLI version >= 3.3.1
• [ ] Commands use PascalCase format (e.g., CreateProject)
• [ ] Parameters use PascalCase format (e.g., --ProjectId)
• [ ] Role codes use JSON array format (e.g., '["role_project_dev"]')
• [ ] Workspace names use underscores not hyphens
• [ ] Each command includes --endpoint dataworks.<region-id>.aliyuncs.com parameter

Business Scenario Verification Checklist

• [ ] Workspace can be accessed normally via access URL after creation
• [ ] RAM role has been refreshed and synced in console before adding
• [ ] Development role and development environment configurations have been carefully planned (cannot be reverted once enabled)
• [ ] DataWorks service has been enabled

---

Official References

• DataWorks OpenAPI Documentation
• Alibaba Cloud CLI Documentation

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.1+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.1 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.1)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "China East 1 (Hangzhou)"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.1+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

DataWorks Service Endpoints

Official Documentation: https://help.aliyun.com/zh/dataworks/developer-reference/api-dataworks-public-2024-05-18-endpoint

Asia Pacific

Europe and Americas

Middle East

Industry Cloud

---

Usage Instructions

When executing CLI commands, you must add the corresponding --region and --endpoint parameters based on the user-specified region:

--region {RegionId} --endpoint dataworks.{RegionId}.aliyuncs.com

Examples:

• South Korea: --region ap-northeast-2 --endpoint dataworks.ap-northeast-2.aliyuncs.com
• Shanghai: --region cn-shanghai --endpoint dataworks.cn-shanghai.aliyuncs.com

DataWorks Workspace Management - RAM Permission Policies

This document lists the RAM permission policy configurations required to use the DataWorks Workspace Management Skill.

⛔ PROHIBITED OPERATIONS

The following permissions are related to PROHIBITED operations:

- dataworks:UpdateProject - Update workspace

- dataworks:DeleteProject - Delete workspace

- dataworks:DeleteProjectMember - Remove member

- dataworks:RevokeMemberProjectRoles - Revoke roles

>

These operations must be performed manually via the DataWorks Console.

---

Recommended Permission Policy

The following policy includes permissions for allowed operations:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:CreateProject",
        "dataworks:GetProject",
        "dataworks:ListProjects",
        "dataworks:CreateProjectMember",
        "dataworks:GrantMemberProjectRoles",
        "dataworks:GetProjectMember",
        "dataworks:ListProjectMembers",
        "dataworks:GetProjectRole",
        "dataworks:ListProjectRoles"
      ],
      "Resource": "*"
    }
  ]
}

---

Permission Policies by Function

1. Workspace Read-Only Permission

Suitable for scenarios that only need to view workspace information:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:GetProject",
        "dataworks:ListProjects",
        "dataworks:GetProjectMember",
        "dataworks:ListProjectMembers",
        "dataworks:GetProjectRole",
        "dataworks:ListProjectRoles"
      ],
      "Resource": "*"
    }
  ]
}

2. Member Management Permission

Suitable for scenarios that need to manage workspace members:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:CreateProjectMember",
        "dataworks:GrantMemberProjectRoles",
        "dataworks:GetProjectMember",
        "dataworks:ListProjectMembers",
        "dataworks:GetProjectRole",
        "dataworks:ListProjectRoles"
      ],
      "Resource": "*"
    }
  ]
}

---

Resource-Level Permission Control

To restrict access to specific workspaces, you can use resource-level permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:GetProject",
        "dataworks:ListProjectMembers",
        "dataworks:CreateProjectMember"
      ],
      "Resource": [
        "acs:dataworks:*:*:project/12345",
        "acs:dataworks:*:*:project/67890"
      ]
    }
  ]
}

Resource format description:

• acs:dataworks:{region}:{accountId}:project/{projectId}
• Use * to represent all regions or all accounts
• Can specify multiple workspace IDs

---

Permission Details

---

System Policies

Alibaba Cloud provides the following DataWorks-related system policies:

Attach System Policy

# Attach full access permission
aliyun ram attach-policy-to-user \
  --policy-name AliyunDataWorksFullAccess \
  --policy-type System \
  --user-name <ram-user-name>

# Attach read-only permission
aliyun ram attach-policy-to-user \
  --policy-name AliyunDataWorksReadOnlyAccess \
  --policy-type System \
  --user-name <ram-user-name>

---

Create Custom Policy

Create via Console

1. Log in to RAM Console 2. Select Permission Management > Permission Policies 3. Click Create Permission Policy 4. Select Script Editor, paste the above policy JSON 5. Fill in the policy name, such as DataWorksWorkspaceManage 6. Click OK to create the policy

Create via CLI

# Create policy file
cat > dataworks-workspace-policy.json << 'EOF'
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:CreateProject",
        "dataworks:UpdateProject",
        "dataworks:GetProject",
        "dataworks:ListProjects",
        "dataworks:CreateProjectMember",
        "dataworks:GrantMemberProjectRoles",
        "dataworks:GetProjectMember",
        "dataworks:ListProjectMembers",
        "dataworks:GetProjectRole",
        "dataworks:ListProjectRoles"
      ],
      "Resource": "*"
    }
  ]
}
EOF

# Create RAM policy
aliyun ram create-policy \
  --policy-name DataWorksWorkspaceManage \
  --policy-document "$(cat dataworks-workspace-policy.json)" \
  --description "DataWorks workspace management permissions"

# Attach policy to user
aliyun ram attach-policy-to-user \
  --policy-name DataWorksWorkspaceManage \
  --policy-type Custom \
  --user-name <ram-user-name>

---

Best Practices

1. Principle of Least Privilege — Grant only the minimum permissions needed to complete tasks 2. Use Custom Policies — Create fine-grained custom policies based on actual needs 3. Regular Audits — Regularly check and clean up unnecessary permissions 4. Use Resource-Level Control — Restrict access to specific workspaces where possible 5. Separate Responsibilities — Use different permission policies for different roles

---

Frequently Asked Questions

Q: Why am I receiving Forbidden.RAM error?

A: The current user does not have permission to perform this operation. Please check: 1. Whether the user has been granted the corresponding RAM policy 2. Whether the policy includes the required Actions 3. Whether Resource restricts the access scope

Q: How to view current user's permissions?

# View user's policies
aliyun ram list-policies-for-user --user-name <ram-user-name>

# View policy details
aliyun ram get-policy \
  --policy-name DataWorksWorkspaceManage \
  --policy-type Custom

Q: What operations require console access?

A: The following high-risk operations must be performed via the DataWorks Console:

• Update workspace (UpdateProject)
• Delete workspace (DeleteProject)
• Remove workspace member (DeleteProjectMember)
• Revoke member roles (RevokeMemberProjectRoles)

Console URL: https://dataworks.console.aliyun.com/

---

Related Documentation

• Alibaba Cloud RAM Permission Policy Syntax
• DataWorks Permission System Overview
• RAM Access Control

DataWorks Workspace Management - API and CLI Command Reference

⛔ PROHIBITED OPERATIONS

The following APIs are PROHIBITED via this Skill:

- UpdateProject - Update workspace

- DeleteProject - Delete workspace

- DeleteProjectMember - Remove workspace member

- RevokeMemberProjectRoles - Revoke member roles

>

Users must perform these operations manually via the DataWorks Console.

---

API Version Information

• Product Code: dataworks-public
• API Version: 2024-05-18
• Endpoint: dataworks.{regionId}.aliyuncs.com

---

Workspace Management APIs

CreateProject - Create Workspace

Request Parameters

Access URL After Successful Creation:

https://dataworks.data.aliyun.com/{regionId}/sc?defaultProjectId={projectId}

Example (Hangzhou region):

https://dataworks.data.aliyun.com/cn-hangzhou/sc?defaultProjectId=12345

Common Error Codes:

CLI Example

aliyun dataworks-public CreateProject \
  --Name my_workspace \
  --DisplayName "My Workspace" \
  --Description "Test workspace" \
  --PaiTaskEnabled true \
  --DevEnvironmentEnabled true \
  --DevRoleDisabled false \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

---

GetProject - Query Workspace Details

Request Parameters

CLI Example

aliyun dataworks-public GetProject \
  --Id 12345 \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

---

ListProjects - Query Workspace List

Request Parameters

CLI Examples

# Query all workspaces
aliyun dataworks-public ListProjects \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Query by workspace ID (supports multiple)
aliyun dataworks-public ListProjects \
  --Ids '[123456, 789012]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Query by workspace name (supports multiple)
aliyun dataworks-public ListProjects \
  --Names '["my_workspace", "test_workspace"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Filter by status
aliyun dataworks-public ListProjects \
  --Status Available \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Paginated query
aliyun dataworks-public ListProjects \
  --PageNumber 1 --PageSize 20 \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

---

Workspace Member Management APIs

CreateProjectMember - Add Workspace Member

Request Parameters

UserId Format Description:

Alibaba Cloud account ID, RAM sub-account ID, and RAM role ID are all supported as UserId:

⚠️ Important: Newly created RAM roles cannot be directly added as workspace members via API. You need to first visit the "Workspace Members and Roles" page in the workspace console, click the "Add Member" button, and click "Refresh" in the popup to sync the RAM role before adding via API.

>

Console URL: https://dataworks.data.aliyun.com/{regionId}/sc?defaultProjectId={projectId}

CLI Examples

# Add Alibaba Cloud account or RAM sub-account
aliyun dataworks-public CreateProjectMember \
  --ProjectId 12345 \
  --UserId 234567890123456789 \
  --RoleCodes '["role_project_dev", "role_project_pe"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Add RAM role (must refresh and sync in console first)
aliyun dataworks-public CreateProjectMember \
  --ProjectId 12345 \
  --UserId ROLE_345678901234567890 \
  --RoleCodes '["role_project_dev"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

---

GetProjectMember - Query Member Details

Request Parameters

CLI Example

aliyun dataworks-public GetProjectMember \
  --ProjectId 12345 \
  --UserId 234567890123456789 \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

---

ListProjectMembers - Query Member List

Request Parameters

CLI Example

aliyun dataworks-public ListProjectMembers \
  --ProjectId 12345 \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

---

Workspace Role Management APIs

GetProjectRole - Query Role Details

Request Parameters

CLI Example

aliyun dataworks-public GetProjectRole \
  --ProjectId 12345 \
  --Code role_project_admin \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

---

ListProjectRoles - Query Role List

Request Parameters

CLI Example

aliyun dataworks-public ListProjectRoles \
  --ProjectId 12345 \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

---

Preset Role Code Reference

---

Official API Documentation Links

• CreateProject
• UpdateProject
• DeleteProject
• GetProject
• ListProjects
• CreateProjectMember
• GrantMemberProjectRoles

DataWorks Workspace Management - Operation Verification Methods

This document provides verification steps and expected results after each operation is completed.

⛔ PROHIBITED OPERATIONS

The following operations are PROHIBITED via this Skill:

- UpdateProject - Update workspace

- DeleteProject - Delete workspace

- DeleteProjectMember - Remove workspace member

- RevokeMemberProjectRoles - Revoke member roles

>

Users must perform these operations manually via the DataWorks Console.

---

Workspace Operation Verification

1. Create Workspace Verification

Operation: aliyun dataworks-public CreateProject

Verification Steps:

# Step 1: Create workspace
aliyun dataworks-public CreateProject \
  --Name test_workspace_001 \
  --DisplayName "Test Workspace" \
  --Description "Workspace for verification testing" \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Step 2: Get project ID from response
# Expected response contains: "Id": <project-id>

# Step 3: Verify workspace has been created
aliyun dataworks-public GetProject \
  --Id <project-id> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Access URL After Successful Creation:

After a workspace is successfully created, it can be accessed via the following URL:

https://dataworks.data.aliyun.com/{regionId}/sc?defaultProjectId={projectId}

Example (Hangzhou region, project ID 12345):

https://dataworks.data.aliyun.com/cn-hangzhou/sc?defaultProjectId=12345

Expected Result:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "Project": {
    "Id": 12345,
    "Name": "test_workspace_001",
    "DisplayName": "Test Workspace",
    "Description": "Workspace for verification testing",
    "Status": "Available"
  }
}

Common Error Handling:

Verification Points:

• [ ] Return status code is 200
• [ ] Returned workspace name matches the one specified during creation
• [ ] Workspace status is Available
• [ ] Workspace can be accessed normally via access URL

---

2. Query Workspace List Verification

Operation: aliyun dataworks-public ListProjects

Verification Steps:

aliyun dataworks-public ListProjects \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Expected Result:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "PagingInfo": {
    "PageNumber": 1,
    "PageSize": 10,
    "TotalCount": 5
  },
  "Projects": [
    {
      "Id": 12345,
      "Name": "workspace_001",
      "DisplayName": "Workspace 1",
      "Status": "Available"
    }
  ]
}

Verification Points:

• [ ] Return status code is 200
• [ ] Returned list contains expected workspaces
• [ ] Pagination information is correct

---

Member Management Operation Verification

5. Add Workspace Member Verification

Operation: aliyun dataworks-public CreateProjectMember

UserId Format Description:

Alibaba Cloud account ID, RAM sub-account ID, and RAM role ID are all supported as UserId:

Verification Steps:

# Step 1: Add member (using Alibaba Cloud account or RAM sub-account)
aliyun dataworks-public CreateProjectMember \
  --ProjectId <project-id> \
  --UserId <user-uid> \
  --RoleCodes '["role_project_dev"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Step 2: Verify member has been added
aliyun dataworks-public GetProjectMember \
  --ProjectId <project-id> \
  --UserId <user-uid> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Adding RAM Role as Member:

Newly created RAM roles cannot be added directly via API. They need to be refreshed and synced in the console first:

1. Visit workspace console:

   https://dataworks.data.aliyun.com/{regionId}/sc?defaultProjectId={projectId}

2. Go to Workspace Members and Roles page 3. Click Add Member button 4. In the popup, click Refresh in the prompt "You can go to RAM console to create a sub-account, and click refresh to sync to this page" 5. After sync is complete, add RAM role member via API

# Add RAM role as member (must refresh and sync in console first)
aliyun dataworks-public CreateProjectMember \
  --ProjectId <project-id> \
  --UserId ROLE_<ram-role-id> \
  --RoleCodes '["role_project_dev"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Expected Result:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "ProjectMember": {
    "ProjectId": 12345,
    "UserId": "234567890123456789",
    "Roles": [
      {
        "Code": "role_project_dev",
        "Name": "Developer"
      }
    ]
  }
}

Verification Points:

• [ ] Return status code is 200
• [ ] Member's role list contains granted roles
• [ ] RAM role has been refreshed and synced in console before adding

---

6. Query Member List Verification

Operation: aliyun dataworks-public ListProjectMembers

Verification Steps:

aliyun dataworks-public ListProjectMembers \
  --ProjectId <project-id> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Expected Result:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "PagingInfo": {
    "TotalCount": 3
  },
  "ProjectMembers": [
    {
      "UserId": "234567890123456789",
      "Roles": [...]
    }
  ]
}

Verification Points:

• [ ] Return status code is 200
• [ ] Member list contains newly added member
• [ ] Total member count is correct

---

7. Grant Member Roles Verification

Operation: aliyun dataworks-public GrantMemberProjectRoles

Verification Steps:

# Step 1: Grant new roles
aliyun dataworks-public GrantMemberProjectRoles \
  --ProjectId <project-id> \
  --UserId <user-id> \
  --RoleCodes '["role_project_pe"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

# Step 2: Verify roles have been granted
aliyun dataworks-public GetProjectMember \
  --ProjectId <project-id> \
  --UserId <user-id> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Expected Result:

• Member's role list now contains the newly granted role

Verification Points:

• [ ] Return status code is 200
• [ ] Member role list contains role_project_pe

---

---

Role Management Operation Verification

10. Query Role List Verification

Operation: aliyun dataworks-public ListProjectRoles

Verification Steps:

aliyun dataworks-public ListProjectRoles \
  --ProjectId <project-id> \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com

Expected Result:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "ProjectRoles": [
    {
      "Code": "role_project_owner",
      "Name": "Project Owner",
      "Type": "System"
    },
    {
      "Code": "role_project_admin",
      "Name": "Workspace Admin",
      "Type": "System"
    },
    {
      "Code": "role_project_dev",
      "Name": "Developer",
      "Type": "System"
    }
  ]
}

Verification Points:

• [ ] Return status code is 200
• [ ] Contains system preset roles
• [ ] Role information is complete (Code, Name, Type)

---

Error Handling Verification

Common Error Codes and Handling

---

Verification Checklist

After completing all verifications, ensure the following items have passed:

• [ ] Workspace created successfully and can be queried
• [ ] Workspace list query returns correct results
• [ ] Member added successfully and assigned correct roles
• [ ] Member list query returns all members
• [ ] Role grant operation took effect
• [ ] Error handling meets expectations