Alibabacloud Dts Task Manager

Alibaba Cloud DTS Task Manager

Overview

Manage Alibaba Cloud DTS (Data Transmission Service) tasks: create data migration/synchronization tasks, view task status/latency, stop/start/release tasks. All operations are guided interactively.

Parameter Parsing

Determine the operation mode based on user input, and read the corresponding references file for detailed workflow:

When no parameters are provided, ask the user to choose the desired operation.

Step-by-Step Operation Workflows

Create Task (Migration / Sync)

Steps (full details in references/create-task.md): 1. Prerequisites check (CLI installed, auth configured) 2. Select Region + Task type (MIGRATION or SYNC) 3. Configure source: engine type, access method, connection info, optional SSL 4. Configure destination: engine type, access method, connection info, optional SSL 5. Define migration objects: full database or specific tables, with optional name mapping 6. Select migration types: schema / full data / incremental (default: all) 7. Select instance class: micro / small / medium / large 8. Review summary (passwords shown as ******) and confirm 9. Execute: CreateDtsInstance -> ConfigureDtsJob -> StartDtsJob 10. On failure at any step after instance creation, auto-release the instance

Example input: "Create a MySQL to Kafka sync task" Example output:

DTS task created successfully!
  Instance ID: <dts-instance-id>
  Job ID:      <job-id>
  Status:      Initializing

To check status:  aliyun dts DescribeDtsJobDetail --DtsJobId <job-id> --RegionId cn-hangzhou

List Tasks

Steps (full details in references/list-tasks.md): 1. Prerequisites check 2. Query tasks by each JobType (MIGRATION, SYNC, SUBSCRIBE) separately 3. Display consolidated results in table format

Example input: "List my DTS tasks" Example output:

| Task ID        | Name                         | Type      | Status         | Source       | Destination  | Delay  |
|----------------|------------------------------|-----------|----------------|--------------|--------------|--------|
| <job-id-1>     | migration-mysql-mysql-0401   | MIGRATION | Migrating      | RDS MySQL    | RDS MySQL    | -      |
| <job-id-2>     | sync-mysql-kafka-0401        | SYNC      | Synchronizing  | RDS MySQL    | Kafka        | 128ms  |

View Task Status

Steps (full details in references/task-status.md): 1. Prerequisites check 2. Resolve ID: if only one ID given, look up via DescribeDtsJobs first 3. Call DescribeDtsJobDetail 4. Display status, progress, delay (convert ms to readable format)

Example input: "Check status of <job-id>" Example output:

Task: <job-id> (migration-mysql-mysql-0401)
Type:   MIGRATION
Status: Migrating
Progress:
  Schema migration:    Finished
  Full data migration: Finished (1,234,567 rows)
  Incremental:         Running, delay 236ms
Source:      RDS MySQL <source-instance-id> (cn-hangzhou)
Destination: RDS MySQL <dest-instance-id> (cn-hangzhou)

Stop / Start / Release Task

Stop (full details in references/suspend-task.md): 1. Resolve ID, display task info, confirm, then call SuspendDtsJob

Start/Resume (full details in references/start-task.md): 1. Resolve ID, then call StartDtsJob

Release/Delete (full details in references/delete-task.md): 1. Resolve ID 2. Pre-check: call DescribeDtsJobDetail to check current status 3. If task is active (Synchronizing/Migrating/InitializingDataLoad), warn user and require explicit confirmation 4. Double confirmation required before calling DeleteDtsJob

Environment Setup

Steps (full details in references/setup.md): 1. Check aliyun CLI installation 2. Check authentication configuration 3. Test connectivity with a DescribeDtsJobs call

Edge Cases

• User provides only one ID: Try it as DtsJobId first; look up DtsInstanceId via DescribeDtsJobs. If DtsInstanceID field is empty on the task, pass only DtsJobId.
• API parameter case inconsistency: DescribeDtsJobDetail uses --DtsInstanceID (uppercase D), while DeleteDtsJob/ConfigureDtsJob use --DtsInstanceId (lowercase d). Always verify with aliyun dts <API> help before calling.
• Ambiguous ID format: If the ID doesn't clearly match DtsJobId or DtsInstanceId pattern, fuzzy search via DescribeDtsJobs.
• Delete active task: Never delete a running task without pre-check. Query status first; if Synchronizing/Migrating, prompt user to suspend first or explicitly confirm forced deletion.
• Creation failure mid-flow: If CreateDtsInstance succeeds but ConfigureDtsJob or StartDtsJob fails, auto-release the created instance to avoid ongoing charges.
• Timeout / retry: All API calls use --read-timeout 30 --connect-timeout 10. CreateDtsInstance includes --ClientToken (UUID) for idempotent retries.
• Multi-region queries: When listing tasks, query MIGRATION/SYNC/SUBSCRIBE separately per region. The --JobType parameter defaults to MIGRATION; omitting it silently drops sync/subscribe tasks. Never use --Type (causes InvalidParameter).
• MongoDB specifics: MongoDB endpoints require --SourceEndpointDatabaseName in ConfigureDtsJob.

Interaction Rules

Important: All information gathering must use interactive selections to avoid workflow interruption from free-text questions.

Selection-type information: Provide fixed options

Applicable to scenarios with fixed choices: task type, engine type, access method, instance selection, migration type, specification selection, etc.

Free-input information: Provide common defaults + custom input

Applicable to scenarios requiring user free input: IP address, port, username, password, database name, table name, etc. Provide common default values as options; users can select or enter custom values. Consolidate related input items into as few interaction rounds as possible.

Sensitive information: Never display in plaintext

CRITICAL: Passwords, AccessKey Secrets, certificates, and private keys must NEVER appear in plaintext anywhere in the conversation — this applies to ALL stages:

• During collection: When the user provides a password or secret in a message (e.g., "password: MyPass123"), you MUST immediately treat it as sensitive. Do NOT quote, repeat, summarize, or reference the plaintext value in your response. Simply acknowledge receipt, e.g., "Source database password received." Then internally store it for later CLI execution. Even if the user typed the password in plain text, your reply must NEVER contain it.
• When summarizing user input: If the user provides multiple fields including a password in one message (e.g., "username: dts, password: abc123"), your acknowledgment must mask the password: "Username: dts, Password: ******". Never reproduce the password portion of the user's message.
• In confirmation summaries: Always show ****** for password fields.
• In CLI commands displayed to the user: Show passwords as '******', never the actual value. The real value is only used internally when executing the command.
• In error messages / logs: If an API error response contains sensitive fields, redact them before displaying.
• In stored variables or references: Never repeat the plaintext value in follow-up messages.
• In local files: Never write passwords or secrets to any local file (scripts, configs, logs, temp files, etc.). All sensitive values must only exist in memory during CLI execution.

Use single quotes around passwords in actual CLI execution to prevent shell expansion.

Prerequisites

Before executing any operation, the following checks must be performed:

1. Check aliyun CLI installation

which aliyun

If not installed, prompt the user:

• macOS: brew install aliyun-cli
• Or download from https://github.com/aliyun/aliyun-cli/releases
• After installation, run aliyun configure to set up authentication

2. Check authentication configuration

aliyun configure list

If not configured, guide the user through setup:

aliyun configure --mode AK

Requires: AccessKey ID, AccessKey Secret, Region Id

Important: Never display the user's AccessKey Secret in the conversation. Protect sensitive information.

3. Select Region

Let the user select a Region using interactive choices, not text input.

Supported Region list:

Mainland China:

Hong Kong (China) and International:

Interactive pagination:

• First screen (common): cn-beijing (China North 2 - Beijing), cn-hangzhou (China East 1 - Hangzhou), cn-shanghai (China East 2 - Shanghai), cn-shenzhen (China South 1 - Shenzhen)
• After selecting Other: cn-guangzhou, cn-qingdao, cn-chengdu, cn-hongkong
• Continue Other: Show remaining Regions or let user input Region ID directly

This step can be combined with Step 1 (task type) to reduce interaction rounds.

Error Handling

• When API calls fail, parse error messages and provide actionable suggestions
• If instance creation succeeds but subsequent steps fail, automatically release the created instance to avoid charges
• Common errors:
• InvalidAccessKeyId.NotFound - Invalid AccessKey, check configuration
• Forbidden.RAM - Insufficient RAM permissions, requires AliyunDTSFullAccess policy
• InvalidParameter - Parameter error, check input
• UnSupportedTaskType - Unsupported link combination, suggest changing engine or access method
• OperationDenied - Operation denied, task status may not allow this operation
• Network timeout - Check network connection

CLI Call Standards

• All aliyun CLI commands must include --user-agent AlibabaCloud-Agent-Skills parameter (except local configuration commands like aliyun configure)
• All aliyun CLI API calls must set timeouts: --read-timeout 30 --connect-timeout 10
• All aliyun CLI command responses are JSON; parse JSON to extract key information for display

Input Validation and Injection Prevention

CRITICAL: Before constructing any CLI command, ALL user-provided input parameters must be validated and sanitized to prevent command injection.

Validation rules by parameter type:

Shell injection prevention:

• All user-provided parameter values must be wrapped in single quotes ('...') when passed to CLI commands, not just passwords
• Before quoting, reject any input containing single quotes ('), or escape them properly ('\'')
• Reject any input containing shell metacharacters (` ; | & $ ( ) { } \n ``) for parameters where they are never valid (IP, port, instance ID, username, database name)
• DbList JSON must be validated as syntactically correct JSON before passing to --DbList
• If validation fails, display a clear error message and ask the user to re-enter the value; never pass unvalidated input to the shell

Notes

• Never display passwords, certificates, keys, or other sensitive information in any output; show as ****** in confirmation summaries
• Releasing a task is an irreversible operation; always require double confirmation
• Creating tasks incurs charges (pay-as-you-go); remind users
• If the ID format is ambiguous, attempt fuzzy search matching via DescribeDtsJobs
• Use the Region from the configuration file by default, unless the user specifies a different Region
• All information gathering must use interactive methods to avoid workflow interruption
• Consolidate related input items into the same interaction round to minimize rounds

Create Data Migration/Synchronization Task (Interactive)

Supported Database Engines

Supported as Source

Supported as Destination

Note: The API EngineName column values are used for the --SourceEndpointEngineName and --DestinationEndpointEngineName parameters in CreateDtsInstance.

Engine Selection Pagination

Source engine priority display: MySQL, PostgreSQL, MongoDB, SQL Server Subsequent pages: Oracle, Tair/Redis, PolarDB for MySQL, MariaDB -> TiDB, PolarDB-X 2.0, ADB MySQL 3.0, PolarDB for PostgreSQL -> DB2 LUW, PolarDB-X 1.0, PolarDB (Oracle compatible), ADB PostgreSQL -> AS/400, DMS LogicDB, Data Delivery

Destination engine priority display: MySQL, PostgreSQL, Kafka, ClickHouse Subsequent pages: Tair/Redis, ADB MySQL 3.0, Doris, SelectDB -> PolarDB for MySQL, DuckDB, Lindorm, Tablestore -> Oracle, RocketMQ, DataHub, ADB PostgreSQL -> PolarDB for PostgreSQL, PolarDB-X 2.0, PolarDB-X 1.0

Creation Workflow

Step 1: Task Type

Ask the task type (if not specified in parameters): Data Migration (MIGRATION) or Data Synchronization (SYNC)

Step 2: Source Database Information

2a. Source engine type - Display with pagination (see "Engine Selection Pagination" above), priority: MySQL, PostgreSQL, MongoDB, SQL Server

2b. Source access method:

• Alibaba Cloud RDS / managed database instance (InstanceType=RDS)
• Public IP self-managed (InstanceType=other)
• Alibaba Cloud ECS self-managed (InstanceType=ECS)
• Express Connect / VPN Gateway / Smart Access Gateway (InstanceType=dg)

Select Other to show: Cloud Enterprise Network CEN (InstanceType=CEN)

Access method to API parameter mapping:

Important: PolarDB and Kafka use their own dedicated InstanceType values (POLARDB, KAFKA), not RDS. Only RDS MySQL/PostgreSQL/SQL Server/MariaDB/MongoDB/Redis use RDS as InstanceType.

2c. Source connection information:

If "Alibaba Cloud RDS / managed database instance" is selected:

Use aliyun CLI to query instance list for user selection:

For MySQL/PostgreSQL/SQL Server/MariaDB RDS:

aliyun rds DescribeDBInstances --RegionId <region> --Engine <MySQL|PostgreSQL|SQLServer|MariaDB> --PageSize 50 --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills 2>&1

For MongoDB:

aliyun dds DescribeDBInstances --RegionId <region> --PageSize 50 --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills 2>&1

For Redis/Tair:

aliyun r-kvstore DescribeInstances --RegionId <region> --PageSize 50 --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills 2>&1

For PolarDB (InstanceType=POLARDB):

aliyun polardb DescribeDBClusters --RegionId <region> --PageSize 50 --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills 2>&1

Extract DBClusterId and DBClusterDescription from Items.DBCluster[] for user selection.

For Kafka (InstanceType=KAFKA):

aliyun alikafka GetInstanceList --RegionId <region> --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills 2>&1

Extract InstanceId and Name from InstanceList.InstanceVO[] for user selection.

For other managed instances, extract instance IDs and descriptions (instance name, IP, status) from the returned JSON for user selection.

If "Public IP self-managed", "ECS self-managed", "Express Connect/VPN/SAG", or "CEN" is selected:

Collect connection information (consolidate into as few rounds as possible):

• IP address and port (format: 1.2.3.4:3306)
• Database username
• Database password

RDS instances also require username and password.

2d. SSL encrypted connection (optional):

After collecting connection information, ask whether SSL encrypted connection is needed: No SSL (default) or SSL encryption required.

If SSL is needed, collect certificate information:

• CA certificate file path
• Client certificate file path (optional, required for mutual SSL/mTLS)
• Client key file path (optional, required for mutual SSL/mTLS)

Read certificate file contents and pass via the Reserved parameter in ConfigureDtsJob:

Source SSL: {"srcSslEnabled":"true","srcSslCaCert":"PEM_CONTENT","srcSslClientCert":"PEM_CONTENT","srcSslClientKey":"PEM_CONTENT"} Destination SSL: {"destSslEnabled":"true","destSslCaCert":"PEM_CONTENT","destSslClientCert":"PEM_CONTENT","destSslClientKey":"PEM_CONTENT"}

Note: Escape newlines in certificate content with \n. Never display certificates and keys in output.

Step 3: Destination Database Information

Similar collection workflow as the source database:

• Destination engine type (select from supported destination engine list)
• Access method (managed instance/public IP/ECS/Express Connect VPN/CEN)
• If managed instance, list instance list for selection
• Connection information (username, password, etc.) — Kafka managed instances do NOT require username/password
• SSL encrypted connection (optional)

Kafka destination specifics: When Kafka is selected as destination, collect additional Kafka-specific settings:

• Target topic name (or use auto-generated from db/table name)
• Message format: canal_json (recommended), avro, or default
• Compression type: lz4 (recommended), snappy, gzip, or none
• Partition strategy: none / primary_key / table_pk
• Producer acks: 1 (recommended), 0, or all
• Topic mode: single topic (0) or per-table topic (2)

Step 4: Migration Objects

Ask: Full database migration (migrate all databases and tables) or Specific databases/tables (user inputs database and table names)

If "Specific databases/tables" is selected, collect:

• Source database name(s) to migrate/sync
• Table name(s) to migrate/sync (multiple tables separated by commas, * for all tables)

Step 4b: Destination Database and Table Name Mapping

Database name mapping: Ask for destination database name - Same as source (recommended) or Map to a different database name

Table name mapping: Ask whether table name mapping is needed - Not needed (recommended) or Map table names If table name mapping is needed, collect mapping relationships (format: source_table:dest_table, multiple separated by commas)

DbList JSON construction rules:

Full database migration with same name: {"mydb":{"name":"mydb","all":true}} Database name mapping: {"source_db":{"name":"target_db","all":true}} Specific tables without table name mapping: {"mydb":{"name":"target_db","Table":{"t1":{"name":"t1","all":true}}}} Specific tables with table name mapping: {"src_db":{"name":"dst_db","Table":{"src_t1":{"name":"dst_t1","all":true},"src_t2":{"name":"dst_t2","all":true}}}}

Step 5: Migration Types

Multi-select:

• Schema migration (StructureInitialization)
• Full data migration (DataInitialization)
• Incremental migration (DataSynchronization)

All selected by default.

Engine-specific constraints:

• Kafka as destination: StructureInitialization must be false (Kafka has no schema concept). Default to DataInitialization + DataSynchronization only.

Step 6: Instance Class

Select: micro (micro spec, for testing), small, medium, large

Step 7: Summary and Create

Display all configuration information to the user (password fields must show as `**`), then proceed with creation.

Step 8: Execute Creation

8a. Create DTS instance:

aliyun dts CreateDtsInstance \
  --RegionId <region> \
  --Type <MIGRATION|SYNC> \
  --SourceEndpointEngineName <MySQL|PostgreSQL|MongoDB|...> \
  --DestinationEndpointEngineName <MySQL|PostgreSQL|MongoDB|...> \
  --SourceRegion <region> \
  --DestinationRegion <region> \
  --InstanceClass <micro|small|medium|large> \
  --PayType PostPaid \
  --ClientToken <uuid> \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

Extract InstanceId (i.e., DtsInstanceId) and JobId from the response.

Idempotency: --ClientToken uses a UUID (e.g., generated by uuidgen) to ensure timeout retries do not create duplicate instances and incur extra charges. The same ClientToken returns the same result within 24 hours.

8b. Configure task:

aliyun dts ConfigureDtsJob \
  --RegionId <region> \
  --DtsInstanceId <instance-id> \
  --DtsJobId <job-id> \
  --DtsJobName "<auto-generated: sync/migration-source_engine-dest_engine-date>" \
  --JobType <MIGRATION|SYNC> \
  --SourceEndpointInstanceType <other|RDS|ECS|dg|CEN> \
  --SourceEndpointEngineName <engine-name> \
  --SourceEndpointRegion <region> \
  --SourceEndpointInstanceID "<rds-instance-id>" \
  --SourceEndpointUserName "<username>" \
  --SourceEndpointPassword '<password>' \
  --DestinationEndpointInstanceType <other|RDS|ECS|dg|CEN> \
  --DestinationEndpointEngineName <engine-name> \
  --DestinationEndpointRegion <region> \
  --DestinationEndpointIP "<ip>" \
  --DestinationEndpointPort "<port>" \
  --DestinationEndpointUserName "<username>" \
  --DestinationEndpointPassword '<password>' \
  --StructureInitialization <true|false> \
  --DataInitialization <true|false> \
  --DataSynchronization <true|false> \
  --DbList '<json>' \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

Notes:

• RDS instances (InstanceType=RDS) use --SourceEndpointInstanceID, no IP/Port needed
• PolarDB instances use InstanceType=POLARDB with --SourceEndpointInstanceID
• Kafka managed instances use InstanceType=KAFKA with --DestinationEndpointInstanceID, no username/password needed
• Self-managed (other), ECS, Express Connect/VPN (dg), CEN use --SourceEndpointIP + --SourceEndpointPort
• MongoDB requires --SourceEndpointDatabaseName
• Wrap passwords in single quotes, never display in output
• If SSL is enabled, add SSL configuration JSON in the --Reserved parameter
• Never display certificate content and keys in output

Kafka Destination: Reserve Parameter

When the destination is Kafka, the --Reserve parameter is required and carries Kafka-specific configuration as a JSON string:

{
  "targetTableMode": "0",
  "kafkaRecordFormat": "canal_json",
  "destKafka.compression.type": "lz4",
  "destKafkaPartitionKey": "none",
  "destKafka.acks": "1",
  "dbListCaseChangeMode": "default",
  "maxRetryTime": 43200,
  "retry.blind.seconds": 600,
  "destTopic": "<topic-name>",
  "destSSL": "0",
  "destSchemaRegistry": "no",
  "a2aFlag": "2.0",
  "autoStartModulesAfterConfig": "none"
}

Key fields:

Complete Example: PolarDB to Kafka Sync

8a. Create DTS instance:

aliyun dts CreateDtsInstance \
  --RegionId cn-hangzhou \
  --Type SYNC \
  --SourceEndpointEngineName POLARDB \
  --DestinationEndpointEngineName KAFKA \
  --SourceRegion cn-hangzhou \
  --DestinationRegion cn-hangzhou \
  --InstanceClass small \
  --PayType PostPaid \
  --ClientToken "$(uuidgen)" \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

8b. Configure task:

aliyun dts ConfigureDtsJob \
  --RegionId cn-hangzhou \
  --DtsInstanceId <instance-id> \
  --DtsJobId <job-id> \
  --DtsJobName "sync-polardb-kafka-20260402" \
  --JobType SYNC \
  --SourceEndpointInstanceType POLARDB \
  --SourceEndpointEngineName POLARDB \
  --SourceEndpointRegion cn-hangzhou \
  --SourceEndpointInstanceID "<polardb-cluster-id>" \
  --SourceEndpointUserName "dts" \
  --SourceEndpointPassword '<password>' \
  --DestinationEndpointInstanceType KAFKA \
  --DestinationEndpointEngineName KAFKA \
  --DestinationEndpointRegion cn-hangzhou \
  --DestinationEndpointInstanceID "<kafka-instance-id>" \
  --StructureInitialization false \
  --DataInitialization true \
  --DataSynchronization true \
  --DbList '{"dts":{"name":"dts_dts1","all":true}}' \
  --Reserve '{"targetTableMode":"0","kafkaRecordFormat":"canal_json","destKafka.compression.type":"lz4","destKafkaPartitionKey":"none","destKafka.acks":"1","dbListCaseChangeMode":"default","maxRetryTime":43200,"retry.blind.seconds":600,"destTopic":"dts_dts1","destSSL":"0","destSchemaRegistry":"no","a2aFlag":"2.0","autoStartModulesAfterConfig":"none"}' \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

Key points of this example:

• Source InstanceType is POLARDB (not RDS), EngineName is POLARDB (uppercase)
• Destination InstanceType is KAFKA, EngineName is KAFKA (uppercase)
• Kafka destination uses InstanceID only — no IP/Port, no username/password
• StructureInitialization must be false for Kafka
• --Reserve carries all Kafka-specific settings (topic, format, compression, acks, etc.)
• DbList maps source database dts to destination name dts_dts1, which matches destTopic
• Password is wrapped in single quotes, never displayed in output

8c. Start task:

aliyun dts StartDtsJob \
  --RegionId <region> \
  --DtsInstanceId <instance-id> \
  --DtsJobId <job-id> \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

8d. Output results: Display DTS instance ID, task ID, and the command to check status.

If creation or configuration fails, display the error message and release the created instance (to avoid charges).

Release (Delete) Task

Safety Warning

Dangerous operation, double confirmation required! Releasing a task is irreversible.

Protective Pre-check

Before deleting, you must first query the current task status:

aliyun dts DescribeDtsJobDetail \
  --DtsJobId <job-id> \
  --RegionId <region> \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

Evaluate based on the returned Status field:

If the task is in an active state (Synchronizing/Migrating/InitializingDataLoad), you must clearly inform the user of the current status and risks before proceeding.

Command

After pre-check passes and user confirms:

aliyun dts DeleteDtsJob \
  --RegionId <region> \
  --DtsInstanceId <instance-id> \
  --DtsJobId <job-id> \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

Notes

• The parameter name is --DtsInstanceId (lowercase d), not --DtsInstanceID
• If the task has no DtsInstanceID (may be empty for some tasks), you can pass only --DtsJobId:

aliyun dts DeleteDtsJob --DtsJobId <job-id> --RegionId <region> --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills

ID Handling

If the user provides only one ID, first try it as DtsJobId to look up the corresponding DtsInstanceId via DescribeDtsJobs.

View Task List

Query Method

Important: The --JobType parameter defaults to MIGRATION, so omitting it only returns migration tasks. Query by type separately:

# Query migration tasks
aliyun dts DescribeDtsJobs --RegionId <region> --PageSize 50 --PageNumber 1 --JobType MIGRATION --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills
# Query sync tasks
aliyun dts DescribeDtsJobs --RegionId <region> --PageSize 50 --PageNumber 1 --JobType SYNC --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills
# Query subscription tasks
aliyun dts DescribeDtsJobs --RegionId <region> --PageSize 50 --PageNumber 1 --JobType SUBSCRIBE --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills

Note: Do not pass the --Type parameter (confirmed to cause InvalidParameter error). The correct parameter name is --JobType.

Multi-Region Query

If querying across multiple Regions, query common regions such as cn-beijing, cn-hangzhou, cn-shanghai sequentially and consolidate the results.

Output Format

Output in table format: Task ID, Task Name, Type, Status, Source, Destination, Delay(ms)

RAM Permission Configuration

Recommended: Use System Policy

Grant the RAM user or role the system policy AliyunDTSFullAccess for full DTS operation permissions.

Least Privilege

For least privilege control, grant the following permissions:

Core DTS Permissions

• dts:CreateDtsInstance — Create a DTS instance
• dts:ConfigureDtsJob — Configure a DTS task (source, destination, migration objects, etc.)
• dts:StartDtsJob — Start or resume a DTS task
• dts:SuspendDtsJob — Suspend a DTS task
• dts:DeleteDtsJob — Release (delete) a DTS task
• dts:DescribeDtsJobs — Query DTS task list
• dts:DescribeDtsJobDetail — Query DTS task details

Required Permissions by Operation Mode

Additional Permissions for Querying Cloud Instances

When creating tasks, if you need to list RDS/MongoDB/Redis/PolarDB instances for selection, the following read-only permissions are also required:

• rds:DescribeDBInstances — Query RDS instance list (MySQL/PostgreSQL/SQL Server/MariaDB)
• dds:DescribeDBInstances — Query MongoDB instance list
• r-kvstore:DescribeInstances — Query Redis/Tair instance list
• polardb:DescribeDBClusters — Query PolarDB cluster list
• alikafka:GetInstanceList — Query Kafka instance list

Or directly grant the corresponding product system read-only policies: AliyunRDSReadOnlyAccess, AliyunMongoDBReadOnlyAccess, AliyunKvstoreReadOnlyAccess, AliyunPolardbReadOnlyAccess, AliyunKafkaReadOnlyAccess.

Environment Setup

Setup Workflow

1. Check aliyun CLI Installation

which aliyun

If not installed, prompt the user:

• macOS: brew install aliyun-cli
• Or download from https://github.com/aliyun/aliyun-cli/releases
• After installation, run aliyun configure to set up authentication

2. Check Authentication Configuration

aliyun configure list

If not configured, guide the user through setup:

aliyun configure --mode AK

Requires: AccessKey ID, AccessKey Secret, Region Id

Important: Never display the user's AccessKey Secret in the conversation. Protect sensitive information.

3. Test Connectivity

aliyun dts DescribeDtsJobs --RegionId <region> --PageSize 1 --read-timeout 30 --connect-timeout 10 --user-agent AlibabaCloud-Agent-Skills

Verify that the API call succeeds and confirm the environment is properly configured.

Start/Resume Task

Command

aliyun dts StartDtsJob \
  --RegionId <region> \
  --DtsInstanceId <instance-id> \
  --DtsJobId <job-id> \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

ID Handling

If the user provides only one ID, first try it as DtsJobId to look up the corresponding DtsInstanceId via DescribeDtsJobs. If the task has no DtsInstanceID field (may be empty for some tasks), you can pass only --DtsJobId.

Suspend (Stop) Task

Workflow

Display task information first, then execute after confirmation:

aliyun dts SuspendDtsJob \
  --RegionId <region> \
  --DtsInstanceId <instance-id> \
  --DtsJobId <job-id> \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

ID Handling

If the user provides only one ID, first try it as DtsJobId to look up the corresponding DtsInstanceId via DescribeDtsJobs. If the task has no DtsInstanceID field (may be empty for some tasks), you can pass only --DtsJobId.

View Task Status

Query Command

aliyun dts DescribeDtsJobDetail \
  --RegionId <region> \
  --DtsInstanceID <from-user-parameter> \
  --DtsJobId <from-user-parameter> \
  --read-timeout 30 --connect-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

API Parameter Case Sensitivity

• DescribeDtsJobDetail uses --DtsInstanceID (uppercase ID)
• DeleteDtsJob / ConfigureDtsJob etc. use --DtsInstanceId (lowercase d)
• API parameter casing is inconsistent; verify with aliyun dts <API-name> help before calling

ID Handling

If the user provides only one ID, first try it as DtsJobId to look up the corresponding DtsInstanceId via DescribeDtsJobs. If the task has no DtsInstanceID field (may be empty for some tasks), you can pass only --DtsJobId.

Delay Unit

The Delay field returned by the API is in milliseconds (ms). Convert to a more readable format for display (e.g., 518ms, 1.2s).

Output Content

Display detailed status including task information, migration progress, synchronization delay, etc.