Alibabacloud Dms Skill

Alibaba Cloud DMS Database Read/Write

Search for target databases and execute SQL queries and data modifications via Alibaba Cloud DMS OpenAPI.

Scenario Description

This skill implements the following workflow:

1. Search Target Database — Search databases by keyword to get Database ID 2. Execute SQL Query — Execute SQL statements on the target database

Architecture

User Request → Search Database → Get Database ID → Execute SQL → Return Results

Prerequisites

AI-Mode Lifecycle (MUST follow in order)

This skill MUST run inside an AI-Mode session. Treat the following five steps as a strict lifecycle — do not skip, reorder, or interleave the setup steps with command execution:

1. aliyun configure ai-mode enable                                              # Enable AI-Mode
2. aliyun configure ai-mode set-user-agent AlibabaCloud-Agent-Skills/alibabacloud-dms-skill   # Register skill User-Agent
3. aliyun configure set --auto-plugin-install true && aliyun plugin update      # Plugin update
4. <execute DMS commands via ./scripts/*.sh>                                    # Execute commands
5. aliyun configure ai-mode disable                                             # Disable AI-Mode (Cleanup)

Steps 1–3 belong to setup (this section). Step 4 is covered by Core Workflow. Step 5 is covered by Cleanup.

Pre-checks

Pre-check 0: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update,

or see references/cli-installation-guide.md for installation instructions.

Pre-check 1: Enable AI-Mode

[MUST] run aliyun configure ai-mode enable to enable AI-Mode before any other configuration or command.

This activates the AI-Mode session that downstream OpenAPI services use to recognize agent-issued traffic.

Pre-check 2: Register skill User-Agent under AI-Mode

[MUST] run aliyun configure ai-mode set-user-agent AlibabaCloud-Agent-Skills/alibabacloud-dms-skill

to register this skill's identifier as the AI-Mode User-Agent for the current session.

Run this immediately after ai-mode enable and before any plugin update or DMS command.

Pre-check 3: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.

Plugin update MUST happen AFTER AI-Mode is enabled and the User-Agent is registered, so the plugin manager itself reports the correct identifier.

• Aliyun CLI >= 3.3.3
• jq (for JSON parsing): brew install jq
• Credentials configured via aliyun configure

Pre-check 4: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

[MUST] Per-command CLI User-Agent — In addition to the AI-Mode User-Agent registered in Pre-check 2, every aliyun CLI command invocation in step 4 MUST also include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dms-skill The per-command flag and the AI-Mode session-level setting are complementary — both MUST be present so the identifier is sent on every request even if the AI-Mode session expires.

RAM Permissions

[MUST] RAM Permission Pre-check: Verify that the current user has the following RAM permissions before execution.

See references/ram-policies.md for the complete permission list.

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., database keyword, SQL statement, db-id, etc.)

MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

Core Workflow

Task 1: Search Target Database

Search for databases by keyword to get the Database ID:

./scripts/search_database.sh <keyword> --json

Example:

# Search for databases containing "mydb"
./scripts/search_database.sh mydb --json

The output includes database_id, schema_name, db_type, host, port, etc.

Task 2: Execute SQL Query

Execute SQL using the Database ID obtained in the previous step:

./scripts/execute_query.sh --db-id <database_id> --sql "<SQL_statement>"

Write Operation Protection

For write operations (INSERT/UPDATE/DELETE), the script implements protective pre-check:

DDL Operations (DROP/TRUNCATE/ALTER/RENAME) are completely blocked — these must be executed via DMS Console.

Examples:

# Read operations (no confirmation needed)
./scripts/execute_query.sh --db-id 78059000 --sql "SHOW TABLES"
./scripts/execute_query.sh --db-id 78059000 --sql "SELECT * FROM users LIMIT 10" --json

# Write operations - preview first (recommended)
./scripts/execute_query.sh --db-id 78059000 --sql "INSERT INTO users (name) VALUES ('test')" --dry-run

# Write operations - execute with confirmation
./scripts/execute_query.sh --db-id 78059000 --sql "INSERT INTO users (name) VALUES ('test')" --force
./scripts/execute_query.sh --db-id 78059000 --sql "UPDATE users SET name='test' WHERE id=1" --force
./scripts/execute_query.sh --db-id 78059000 --sql "DELETE FROM users WHERE id=1" --force

# Logic database mode
./scripts/execute_query.sh --db-id 78059000 --sql "SELECT 1" --logic

Complete Example

# 1. Search database (assuming searching for "order")
./scripts/search_database.sh order --json
# Example output:
# [{"DatabaseId": "78059000", "SchemaName": "order_db", ...}]

# 2. Execute query
./scripts/execute_query.sh --db-id 78059000 --sql "SELECT COUNT(*) FROM orders"

Success Verification

After executing SQL, check the returned results:

1. Script return code is 0 2. Output contains query results (column names and row data) 3. No error messages

# Verify query success
./scripts/execute_query.sh --db-id <db-id> --sql "SELECT 1" --json
# Expected output: [{"Success": true, "RowCount": 1, ...}]

Cleanup

This skill performs read and write operations but does not create persistent resources, so no database resources need to be released.

However, the AI-Mode lifecycle requires an explicit teardown step:

[MUST] Disable AI-Mode after all tasks complete

Run aliyun configure ai-mode disable once all DMS commands in this skill session have finished

(success or failure). This terminates the AI-Mode session and prevents the registered

AlibabaCloud-Agent-Skills/alibabacloud-dms-skill User-Agent from leaking into subsequent unrelated CLI usage.

aliyun configure ai-mode disable

Write Operation Safety

Available Scripts

Note: Scripts use aliyun-cli credentials configured via aliyun configure.

Best Practices

1. Confirm database — Verify the target database before executing SQL 2. Use --json parameter — Facilitates programmatic processing of output 3. Preview write operations — Always use --dry-run first for INSERT/UPDATE/DELETE 4. Explicit confirmation — Use --force only after reviewing the preview 5. Avoid DDL operations — DROP/TRUNCATE/ALTER/RENAME are blocked; use DMS Console instead

Reference Links

Acceptance Criteria: DMS Database Query

Scenario: DMS Database Query Workflow Purpose: Skill testing acceptance criteria

---

Correct SDK Code Patterns

1. Import Patterns

✅ CORRECT

from alibabacloud_dms_enterprise20181101.client import Client as DmsClient
from alibabacloud_dms_enterprise20181101 import models as dms_models
from alibabacloud_tea_openapi import models as open_api_models

❌ INCORRECT

# Wrong: Using old SDK import paths
from aliyunsdkdms_enterprise.request.v20181101 import GetUserActiveTenantRequest

# Wrong: Missing required imports
from alibabacloud_dms_enterprise20181101 import Client  # Missing models

---

2. Client Initialization

✅ CORRECT

def create_client() -> DmsClient:
    ak = os.getenv("ALICLOUD_ACCESS_KEY_ID") or os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")
    sk = os.getenv("ALICLOUD_ACCESS_KEY_SECRET") or os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")
    if not ak or not sk:
        raise RuntimeError("Missing credentials")
    config = open_api_models.Config(
        access_key_id=ak,
        access_key_secret=sk,
        endpoint="dms-enterprise.cn-hangzhou.aliyuncs.com",
    )
    return DmsClient(config)

❌ INCORRECT

# Wrong: Hardcoded credentials
config = open_api_models.Config(
    access_key_id="LTAI5tXXXXXXXX",  # NEVER hardcode
    access_key_secret="8dXXXXXXXXXX",  # NEVER hardcode
)

# Wrong: Missing endpoint
config = open_api_models.Config(
    access_key_id=ak,
    access_key_secret=sk,
    # endpoint missing
)

---

3. Get Tenant ID (Tid)

✅ CORRECT

def get_tid(client: DmsClient) -> int:
    resp = client.get_user_active_tenant(dms_models.GetUserActiveTenantRequest())
    if not resp.body.success:
        raise RuntimeError(f"Failed to get Tid: {resp.body.error_message}")
    return resp.body.tenant.tid

❌ INCORRECT

# Wrong: Not checking success status
def get_tid(client):
    resp = client.get_user_active_tenant(dms_models.GetUserActiveTenantRequest())
    return resp.body.tenant.tid  # May fail silently

# Wrong: Hardcoded Tid
tid = 12345  # NEVER hardcode Tid

---

4. Search Database

✅ CORRECT

def search_databases(keyword: str) -> list[dict]:
    client = create_client()
    tid = get_tid(client)
    req = dms_models.SearchDatabaseRequest(search_key=keyword, tid=tid)
    resp = client.search_database(req)
    records = []
    if resp.body.search_database_list and resp.body.search_database_list.search_database:
        for db in resp.body.search_database_list.search_database:
            records.append({
                "database_id": db.database_id,
                "schema_name": db.schema_name,
            })
    return records

❌ INCORRECT

# Wrong: Not passing Tid
req = dms_models.SearchDatabaseRequest(search_key=keyword)  # Missing tid

# Wrong: Not handling empty results
for db in resp.body.search_database_list.search_database:  # May raise AttributeError
    pass

---

5. Execute SQL Query

✅ CORRECT

def execute_query(db_id: int, sql: str, logic: bool = False) -> list[dict]:
    client = create_client()
    tid = get_tid(client)
    req = dms_models.ExecuteScriptRequest(
        tid=tid,
        db_id=db_id,
        script=sql,
        logic=logic,
    )
    resp = client.execute_script(req)
    if not resp.body.success:
        raise RuntimeError(f"SQL execution failed: {resp.body.error_message}")
    # Process results...

❌ INCORRECT

# Wrong: Using wrong parameter names
req = dms_models.ExecuteScriptRequest(
    tid=tid,
    database_id=db_id,  # Wrong: should be db_id
    sql=sql,  # Wrong: should be script
)

# Wrong: Not checking success status
resp = client.execute_script(req)
return resp.body.results  # May contain error

---

Test Scenarios

Scenario 1: Get Tenant ID

Input: Valid credentials in environment variables Expected Output: Integer Tid value Verification:

python scripts/get_tid.py
# Output: 12345 (numeric Tid)

Scenario 2: Search Database

Input: Keyword "test" Expected Output: List of matching databases Verification:

python scripts/search_database.py test --json
# Output: [{"database_id": "xxx", "schema_name": "test_db", ...}]

Scenario 3: Execute SQL Query

Input: Valid db_id and SQL "SELECT 1" Expected Output: Query results Verification:

python scripts/execute_query.py --db-id 12345 --sql "SELECT 1" --json
# Output: [{"success": true, "row_count": 1, ...}]

---

Error Handling Patterns

✅ CORRECT Error Handling

try:
    results = execute_query(db_id, sql)
except RuntimeError as e:
    print(f"Error: {e}", file=sys.stderr)
    return 1

❌ INCORRECT Error Handling

# Wrong: Catching all exceptions silently
try:
    results = execute_query(db_id, sql)
except:
    pass  # Silently ignoring errors

# Wrong: No error handling
results = execute_query(db_id, sql)  # May crash

---

Environment Requirements

• Python >= 3.10
• Required packages: alibabacloud-dms-enterprise20181101, alibabacloud-tea-openapi, alibabacloud-credentials
• Environment variables: ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies for DMS Database Query

This document lists the RAM (Resource Access Management) permissions required for the DMS database query workflow.

Summary Table

RAM Policy Document

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dms:GetUserActiveTenant",
        "dms:SearchDatabase",
        "dms:ExecuteScript"
      ],
      "Resource": "*"
    }
  ]
}

Minimal Permission Policy

For production environments, consider restricting permissions to specific resources:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dms:GetUserActiveTenant"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dms:SearchDatabase"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "dms:TenantId": "${your-tenant-id}"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "dms:ExecuteScript"
      ],
      "Resource": "acs:dms:*:*:database/${database-id}",
      "Condition": {
        "StringEquals": {
          "dms:SqlType": ["SELECT"]
        }
      }
    }
  ]
}

Permission Descriptions

dms:GetUserActiveTenant

• Purpose: Retrieve the tenant ID (Tid) for the current user
• Required: Yes (prerequisite for all other DMS API calls)
• Resource: * (tenant-level operation)

dms:SearchDatabase

• Purpose: Search for databases by keyword
• Required: Yes (to find the target database)
• Resource: * (searches across all accessible databases)

dms:ExecuteScript

• Purpose: Execute SQL scripts on a database
• Required: Yes (core functionality)
• Resource: Can be restricted to specific database IDs
• Note: This permission allows execution of SELECT, DML, and DDL statements. Consider restricting to read-only queries in production.

Best Practices

1. Least Privilege: Only grant dms:ExecuteScript on specific databases that users need to access 2. Read-Only Access: For reporting/analytics users, consider creating a separate policy that only allows SELECT queries 3. Audit Logging: Enable DMS audit logging to track all SQL executions 4. Regular Review: Periodically review and revoke unnecessary permissions

Related Documentation

• Alibaba Cloud RAM Documentation
• DMS Permission Management

Related APIs for DMS Database Query

This document lists all APIs used in the DMS database query workflow.

API Summary Table

API Details

GetUserActiveTenant

Description: Get the active tenant information for the current user. All DMS API calls require the Tid (tenant ID) parameter.

Endpoint: dms-enterprise.cn-hangzhou.aliyuncs.com

Request Parameters: None required

Response:

{
  "RequestId": "xxx",
  "Success": true,
  "Tenant": {
    "Tid": 12345,
    "TenantName": "xxx",
    "Status": "ACTIVE"
  }
}

SDK Usage:

from alibabacloud_dms_enterprise20181101 import models as dms_models

resp = client.get_user_active_tenant(dms_models.GetUserActiveTenantRequest())
tid = resp.body.tenant.tid

---

SearchDatabase

Description: Search for databases by keyword. Returns matching databases with their IDs, types, and connection information.

Endpoint: dms-enterprise.cn-hangzhou.aliyuncs.com

Request Parameters:

Response:

{
  "RequestId": "xxx",
  "Success": true,
  "SearchDatabaseList": {
    "SearchDatabase": [
      {
        "DatabaseId": "12345",
        "SchemaName": "mydb",
        "DbType": "MySQL",
        "Host": "rm-xxx.mysql.rds.aliyuncs.com",
        "Port": 3306,
        "Encoding": "utf8mb4",
        "EnvType": "product"
      }
    ]
  }
}

SDK Usage:

from alibabacloud_dms_enterprise20181101 import models as dms_models

req = dms_models.SearchDatabaseRequest(
    search_key="mydb",
    tid=tid
)
resp = client.search_database(req)
for db in resp.body.search_database_list.search_database:
    print(db.database_id, db.schema_name)

---

ExecuteScript

Description: Execute SQL scripts on a specified database. Supports SELECT, DML (INSERT/UPDATE/DELETE), and DDL statements.

Endpoint: dms-enterprise.cn-hangzhou.aliyuncs.com

Request Parameters:

Response:

{
  "RequestId": "xxx",
  "Success": true,
  "Results": {
    "Results": [
      {
        "Success": true,
        "Message": "",
        "RowCount": 10,
        "ColumnNames": ["id", "name", "created_at"],
        "Rows": {
          "Row": [
            {"RowValue": ["1", "Alice", "2024-01-01"]}
          ]
        }
      }
    ]
  }
}

SDK Usage:

from alibabacloud_dms_enterprise20181101 import models as dms_models

req = dms_models.ExecuteScriptRequest(
    tid=tid,
    db_id=12345,
    script="SELECT * FROM users LIMIT 10",
    logic=False
)
resp = client.execute_script(req)
for result in resp.body.results.results:
    print(result.column_names)
    for row in result.rows.row:
        print(row.row_value)

Additional Useful APIs

These APIs are not used in the core workflow but may be useful for extended scenarios:

API Documentation Links

• DMS OpenAPI Overview
• API Reference
• SDK Downloads