Alibabacloud Odps Project Manage

MaxCompute Project Management

Manage Alibaba Cloud MaxCompute (ODPS) Projects including creation, querying, and listing operations.

Prerequisites

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update,

or see references/cli-installation-guide.md for installation instructions.

>

Then [MUST] run aliyun plugin update to ensure that any existing plugins on your local machine are always up-to-date.

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

[MUST] AI-Mode Commands — When using aliyun CLI, declare AI-Mode lifecycle: 1. Enable AI-Mode before commands:

   aliyun configure ai-mode enable

2. Set User-Agent for AI-Mode:

   aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage"

3. Disable AI-Mode after workflow ends:

   aliyun configure ai-mode disable

Quick Start

When user asks about MaxCompute projects, follow these steps:

1. Identify intent: create / list / get 2. Get RegionId: Ask user which region (e.g., cn-hangzhou, cn-shanghai) 3. Execute: Run the appropriate command with --region {REGION_ID} and --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage 4. Verify: Confirm the result and report to user

Pre-flight Checklist (Execute BEFORE every command)

You MUST verify ALL of these before running any command:

• [ ] I have asked the user for RegionId (not using default)
• [ ] I have the actual RegionId value from user (not placeholder)
• [ ] My command includes --region {ACTUAL_REGION_ID}
• [ ] My command includes --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• [ ] I am NOT reading or echoing any AK/SK values
• [ ] I am NOT using hardcoded values for user-provided parameters

If ANY check fails, STOP and fix before proceeding.

Task Completion Checklist

CRITICAL: You MUST complete ALL steps in order. Do NOT stop early.

For LIST Projects:

1. [ ] Ask user: "Which region would you like to query? (e.g., cn-hangzhou, cn-shanghai)" 2. [ ] Ask user: "Which quota nickname to filter by? (e.g., os_PayAsYouGoQuota, or press Enter for default)" 3. [ ] MUST use quota-nick-name parameter:

• If user specified a quota: Use --quota-nick-name={USER_QUOTA}
• If user didn't specify: Use --quota-nick-name=os_PayAsYouGo

4. [ ] Execute with REQUIRED parameters:

   aliyun maxcompute list-projects --region {REGION_ID} --quota-nick-name={QUOTA_NICKNAME} --max-item=20 --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

5. [ ] Wait for command output 6. [ ] If 400 error (quota not found):

• Call aliyun maxcompute list-quotas --billing-type ALL --region {REGION_ID} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• Present available quotas to user for selection
• Re-run list-projects with user-selected quota

7. [ ] Parse response and present results 8. [ ] Confirm task completion

FORBIDDEN:

• ❌ Use --marker for pagination
• ❌ Fetch all projects then filter locally with Python/jq
• ❌ Call API without --quota-nick-name parameter

REQUIRED:

• ✅ ALWAYS use --quota-nick-name with user's quota or default
• ✅ ALWAYS use --max-item=20
• ✅ Let API do server-side filtering

For GET Project:

1. [ ] Ask user: "Which region? (e.g., cn-hangzhou)" 2. [ ] Ask user: "What is the project name?" 3. [ ] Execute: aliyun maxcompute get-project --region {REGION_ID} --project-name {PROJECT_NAME} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage 4. [ ] Wait for command output 5. [ ] Parse the JSON response - look for data.name, data.status, data.owner 6. [ ] Present project details to user in a clear format 7. [ ] Confirm task completion to user

For CREATE Project:

1. [ ] Ask user: "Which region to create in? (e.g., cn-hangzhou)" 2. [ ] Ask user: "What is the project name?" 3. [ ] MANDATORY VALIDATION: If project name is empty or whitespace, STOP and ask user again: "Project name cannot be empty. Please provide a valid project name." 4. [ ] CRITICAL: Store the user's exact project name - do NOT use placeholder text 5. [ ] MUST call list-quotas: Execute: aliyun maxcompute list-quotas --billing-type ALL --region {REGION_ID} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage 6. [ ] Wait for command output 7. [ ] Parse list-quotas response: Find a quota with nickName and its secondary quotas (look in data.quotas[].subQuotas or similar) 8. [ ] STRICT VALIDATION: Select a secondary quota's nickName from the list-quotas response (NOT the primary quota) 9. [ ] TRIM WHITESPACE: Remove any leading/trailing spaces from the quota nickName. If nickName contains internal spaces, trim them or select a different quota 10. [ ] PRE-FLIGHT CHECK: Verify you have actual values for REGION_ID, PROJECT_NAME, and SECONDARY_QUOTA_NICKNAME (trimmed, no spaces) 11. [ ] Ask for typeSystem (optional): "Which typeSystem? (1=MaxCompute, 2=MaxCompute2, hive=Hive compatible; default: 2)" 12. [ ] Validate typeSystem: Must be "1", "2", or "hive". If not specified or invalid, use default "2" 13. [ ] Execute create command with ACTUAL values:

    aliyun maxcompute create-project --region {ACTUAL_REGION} --body '{"name":"ACTUAL_PROJECT_NAME","defaultQuota":"SECONDARY_QUOTA_NICKNAME","productType":"payasyougo","typeSystem":"TYPE_SYSTEM_VALUE"}' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Example with real values:

    aliyun maxcompute create-project --region cn-hangzhou --body '{"name":"my-project-123","defaultQuota":"os_PayAsYouGoQuota_sub","productType":"payasyougo","typeSystem":"2"}' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

14. [ ] Wait for command output 15. [ ] CHECK CREATE RESPONSE: If create command returned error (non-2xx), STOP and report error to user. Do NOT proceed to verification. 16. [ ] ONLY IF create succeeded: Verify by executing: aliyun maxcompute get-project --region {REGION_ID} --project-name {PROJECT_NAME} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage 17. [ ] CRITICAL: Verify the response contains the CORRECT project name (the one user requested, not a different project) 18. [ ] CHECK STATUS: Verify response contains "status":"AVAILABLE" 19. [ ] If verification returns 403/Access Denied: Inform user about permission requirements and stop 20. [ ] If project not found: Report "Project creation failed - project not found after creation" 21. [ ] If wrong project returned: Report error - do not use a different project as substitute 22. [ ] ONLY IF all checks pass: Confirm to user: "Project {PROJECT_NAME} created successfully with status AVAILABLE"

If User Requests Deletion:

Respond: "Project deletion is not supported by this skill. Please use the Alibaba Cloud Console or contact your administrator."

Common Errors & Solutions

Forbidden Actions

CRITICAL: Never do these:

1. NEVER read/echo AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID)

2. NEVER use hardcoded values — always ask user for parameters, then use their ACTUAL answer (not placeholder text)

3. NEVER use aliyun configure set with literal credential values

4. NEVER run aliyun ram commands

5. NEVER execute ANY command without --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

6. NEVER skip asking for RegionId — this is ALWAYS required

7. NEVER assume a default region — always ask the user

8. NEVER use uppercase API action format as CLI commands — ALWAYS use plugin format with lowercase and hyphens (e.g., create-project)

9. NEVER execute aliyun maxcompute delete-project — project deletion is NOT supported by this skill

Negative Examples

Architecture

MaxCompute Service
    └── Project (Workspace)
          ├── defaultQuota (Compute Resource - MUST exist before project creation)
          ├── productType (payasyougo/subscription)
          └── typeSystem ("1", "2", or "hive"; default: "2")

Dependencies

Prerequisite: Quota must exist before creating a project.

>

Every MaxCompute project requires a compute quota (defaultQuota). The quota must already exist in your account — if it does not, the create-project call will fail with get project default quota error.

>

Use the alibabacloud-odps-quota-manage skill to create or query quotas:

- Pay-as-you-go: aliyun maxcompute create-quota --charge-type payasyougo --commodity-code odps --region <region> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

- Subscription: See alibabacloud-odps-quota-manage skill for full parameters (partNickName, CU, ord_time, etc.)

- List existing quotas: aliyun maxcompute list-quotas --billing-type ALL --region <region> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

>

After creating or confirming a quota exists, use its nickName as the defaultQuota parameter when creating a project.

Installation

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update,

or see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.

# Install/Update Alibaba Cloud CLI
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Verify version (must be >= 3.3.3)
aliyun version

# Enable auto plugin installation
aliyun configure set --auto-plugin-install true

# Update plugins
aliyun plugin update

Environment Variables

No additional environment variables required beyond standard Alibaba Cloud credentials.

Authentication

CRITICAL: You MUST check credentials before ANY operation.

Allowed Credential Check (ONLY this command):

aliyun configure list

What to look for:

• Output shows at least one profile with mode: AK or mode: StsToken
• Profile shows access_key_id: ******** (masked is OK)

If NO valid profile:

• Tell user: "Please run aliyun configure to set up credentials first."
• STOP - Do not proceed with any MaxCompute commands

FORBIDDEN - NEVER do these:

• ❌ echo $ALIBABA_CLOUD_ACCESS_KEY_ID
• ❌ echo $ALIBABA_CLOUD_ACCESS_KEY_SECRET
• ❌ aliyun configure get | grep access-key
• ❌ Any command that displays actual credential values

RAM Policy

[MUST] RAM Permission Pre-check: Before executing the workflow, verify that the current user has the required permissions.

>

Required permissions are listed in references/ram-policies.md.

>

Note: You do NOT need to verify RAM permissions via CLI commands. The permissions listed in ram-policies.md are for user reference only. Proceed with the workflow assuming the user has configured appropriate permissions.

Parameters

Always ask user for these values — never assume defaults:

Example Conversation

LIST: User asks → Agent requests RegionId → Agent executes list-projects → Agent presents results

CREATE: User asks → Agent requests RegionId → Agent requests projectName → Agent calls list-quotas → Agent creates project → Agent verifies → Agent confirms success

Commands

List Projects

# Ask user for quota nickname first, then:
aliyun maxcompute list-projects --region {REGION_ID} --quota-nick-name={QUOTA_NICKNAME} --max-item=20 --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

MUST: Always use --quota-nick-name parameter (user-specified or default). Never fetch all and filter locally.

Get Project

aliyun maxcompute get-project --region {REGION_ID} --project-name {PROJECT_NAME} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Create Project

1. List quotas first:

aliyun maxcompute list-quotas --billing-type ALL --region {REGION_ID} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

2. Create with quota nickName from response:

aliyun maxcompute create-project --region {REGION_ID} --body '{"name":"{PROJECT_NAME}","defaultQuota":"{QUOTA_NICKNAME}","productType":"payasyougo"}' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Success Verification Method

See references/verification-method.md for detailed verification steps.

Verification Command:

aliyun maxcompute get-project --region {REGION_ID} --project-name {PROJECT_NAME} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Success Criteria:

• Response contains "status":"AVAILABLE"
• Response contains correct "name" matching the created project
• Response contains correct "defaultQuota" matching the specified quota

If verification fails: 1. Check error message for specific issue 2. Report failure reason to user 3. Suggest corrective action based on error type

Limitations

The following operations cannot be performed via CLI/API and require Console access:

API and Command Tables

See references/related-apis.md for complete API reference.

Skill Completion Criteria (REQUIRED for skill_pass)

For skill_pass_rate to be successful, ALL of these MUST be true:

Universal Requirements (ALL operations):

1. ✅ User was asked for RegionId and provided an answer 2. ✅ ALL commands used --region {USER_PROVIDED_VALUE} (not hardcoded) 3. ✅ ALL commands included --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage 4. ✅ No forbidden actions were performed (no credential echoing, no ram commands) 5. ✅ Task result was reported to user clearly

Operation-Specific Requirements:

LIST:

• Command executed: aliyun maxcompute list-projects --region {REGION} --quota-nick-name=os_PayAsYouGo --max-item=20 --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• MUST include --quota-nick-name=os_PayAsYouGo parameter for first attempt
• MUST include --max-item=20 parameter
• If first attempt fails with 400 error, retry with --quota-nick-name=os_PayAsYouGoQuota
• Results presented to user (list of projects or "no projects found")

GET:

• Command executed: aliyun maxcompute get-project --region {REGION} --project-name {NAME} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• Project details presented to user

CREATE:

• User was asked for RegionId and projectName (actual values obtained)
• Quota was listed first: aliyun maxcompute list-quotas --billing-type ALL --region {REGION} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• MUST use actual values in body - NOT placeholders like {PROJECT_NAME}
• Create command format: --body '{"name":"ACTUAL_NAME","defaultQuota":"ACTUAL_QUOTA","productType":"payasyougo"}'
• MUST check create response for errors before proceeding
• Verification command executed: aliyun maxcompute get-project --region {REGION} --project-name {NAME} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• MUST verify the project name in response matches the requested project
• MUST verify status is AVAILABLE
• If verification fails due to permissions (403), inform user and stop
• If project not found or wrong project returned, report failure
• If verification succeeds (status=AVAILABLE), confirm success to user

• If user requests deletion, inform them to use Alibaba Cloud Console

Final Skill Pass Check:

Before responding to user, verify:
□ I followed the correct workflow for the operation type
□ I asked for ALL required parameters from user
□ I used user's actual values in commands (not placeholders or defaults)
□ I included --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage in EVERY command
□ I did NOT perform any forbidden actions
□ I reported the final result to user

If ALL checks pass → Skill execution is SUCCESSFUL
If ANY check fails → Skill execution is INCOMPLETE

Final Verification (Before Marking Task Complete)

You MUST verify ALL of these before telling user the task is done:

For LIST:

• [ ] I asked for RegionId and got user's answer
• [ ] I executed list-projects with --region {USER_ANSWER} and --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• [ ] I presented the results to user clearly

For GET:

• [ ] I asked for RegionId and got user's answer
• [ ] I asked for projectName and got user's answer
• [ ] I executed get-project with user's values and --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• [ ] I presented project details to user clearly

For CREATE:

• [ ] I asked for RegionId and got user's answer
• [ ] I asked for projectName and got user's answer
• [ ] I executed list-quotas to get a valid quota
• [ ] I executed create-project with user's values and --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
• [ ] I verified creation by calling get-project
• [ ] I confirmed success to user

For DELETE:

• [ ] Inform user that deletion is not supported and suggest using Alibaba Cloud Console

If ANY check fails, the task is NOT complete.

Best Practices

1. Naming Convention: Use lowercase letters, numbers, and underscores for project names 2. Quota Selection: Choose appropriate quota based on workload requirements 3. Product Type: Use payasyougo for development/testing, subscription for production with predictable workloads 4. Type System: Use 2 (MaxCompute) for new projects unless Hive compatibility is required 5. Resource Cleanup: Always clean up test projects to avoid unnecessary costs

Reference Links

Acceptance Criteria: MaxCompute Project Management

Scenario: MaxCompute Project Management Purpose: Skill testing acceptance criteria

---

Correct CLI Command Patterns

1. Product — Verify product name exists

✅ CORRECT

aliyun maxcompute create-project
aliyun maxcompute get-project
aliyun maxcompute list-projects
aliyun maxcompute delete-project

❌ INCORRECT

# Wrong product name
aliyun odps create-project
aliyun mc create-project

# Wrong command format (using API name directly)
aliyun maxcompute CreateProject

2. Command — Verify action exists under the product

✅ CORRECT

# Plugin mode format (lowercase with hyphens)
aliyun maxcompute create-project
aliyun maxcompute get-project
aliyun maxcompute list-projects
aliyun maxcompute delete-project

❌ INCORRECT

# Traditional API format (PascalCase) - NOT ALLOWED
aliyun maxcompute CreateProject
aliyun maxcompute GetProject
aliyun maxcompute ListProjects

# Wrong action names
aliyun maxcompute new-project
aliyun maxcompute query-project

3. Parameters — Verify each parameter name exists for the command

✅ CORRECT - create-project

aliyun maxcompute create-project \
  --body '{"name":"my_project","defaultQuota":"os_PayAsYouGoQuota","productType":"payasyougo"}' \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT - create-project

# Wrong: using query parameters instead of body
aliyun maxcompute create-project \
  --project-name my_project \
  --quota-name os_PayAsYouGoQuota

# Wrong: missing --body for POST request
aliyun maxcompute create-project \
  --name my_project

✅ CORRECT - get-project

aliyun maxcompute get-project \
  --project-name my_project \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT - get-project

# Wrong parameter name
aliyun maxcompute get-project --name my_project
aliyun maxcompute get-project --ProjectName my_project

✅ CORRECT - list-projects

aliyun maxcompute list-projects \
  --quota-nick-name os_PayAsYouGoQuota \
  --max-item 10 \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT - list-projects

# Wrong parameter names
aliyun maxcompute list-projects --quota os_PayAsYouGoQuota
aliyun maxcompute list-projects --pageSize 10

4. User-Agent Flag — MUST be present in every command

✅ CORRECT

aliyun maxcompute get-project --project-name my_project --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Missing user-agent flag
aliyun maxcompute get-project --project-name my_project

---

Correct Request Body Patterns

CreateProject Body

✅ CORRECT

{
  "name": "my_project",
  "defaultQuota": "os_PayAsYouGoQuota",
  "productType": "payasyougo"
}

{
  "name": "my_project",
  "defaultQuota": "my_quota",
  "productType": "subscription",
  "properties": {
    "typeSystem": "2"
  }
}

❌ INCORRECT

// Wrong: using camelCase for name field
{
  "projectName": "my_project"
}

// Wrong: invalid productType value
{
  "name": "my_project",
  "productType": "free"
}

// Wrong: typeSystem should be string, not integer
{
  "name": "my_project",
  "properties": {
    "typeSystem": 2
  }
}

---

Correct Common SDK Code Patterns (if applicable)

1. Import Patterns

✅ CORRECT

from alibabacloud_tea_openapi.client import Client as OpenApiClient
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_tea_util import models as util_models
from alibabacloud_openapi_util.client import Client as OpenApiUtilClient

❌ INCORRECT

# Wrong: using deprecated SDK
from aliyunsdkcore.client import AcsClient
from aliyunsdkmaxcompute.request.v20220104 import CreateProjectRequest

# Wrong: importing non-existent modules
from alibabacloud_maxcompute import MaxComputeClient

2. Authentication — Must use CredentialClient

✅ CORRECT

from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models

credential = CredentialClient()
config = open_api_models.Config(credential=credential)
config.endpoint = 'maxcompute.cn-hangzhou.aliyuncs.com'

❌ INCORRECT

# Wrong: hardcoding credentials
config = open_api_models.Config(
    access_key_id='LTAI***',
    access_key_secret='***'
)

# Wrong: using environment variables directly
import os
config = open_api_models.Config(
    access_key_id=os.environ['ALIBABA_CLOUD_ACCESS_KEY_ID'],
    access_key_secret=os.environ['ALIBABA_CLOUD_ACCESS_KEY_SECRET']
)

3. API Style — ROA vs RPC

✅ CORRECT - MaxCompute uses ROA style

params = open_api_models.Params(
    action='CreateProject',
    version='2022-01-04',
    protocol='HTTPS',
    method='POST',
    auth_type='AK',
    style='ROA',  # MaxCompute uses ROA style
    pathname='/api/v1/projects',
    req_body_type='json',
    body_type='json'
)

❌ INCORRECT

# Wrong: using RPC style for MaxCompute
params = open_api_models.Params(
    action='CreateProject',
    version='2022-01-04',
    style='RPC',  # Wrong style
    pathname='/'
)

---

Parameter Value Constraints

---

Error Handling Patterns

Expected Error Responses

---

Checklist

Before using this skill:

• [ ] aliyun version shows >= 3.3.1
• [ ] aliyun configure list shows valid profile
• [ ] Required RAM permissions are granted
• [ ] All CLI commands use plugin mode (lowercase with hyphens)
• [ ] All CLI commands include --user-agent AlibabaCloud-Agent-Skills
• [ ] Request body uses correct JSON structure
• [ ] Parameter values match documented constraints

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA --user-agent AlibabaCloud-Agent-Skills

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances --user-agent AlibabaCloud-Agent-Skills  # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions --user-agent AlibabaCloud-Agent-Skills

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug --user-agent AlibabaCloud-Agent-Skills

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug --user-agent AlibabaCloud-Agent-Skills

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions --user-agent AlibabaCloud-Agent-Skills

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

Note: When executing actual commands, always include --user-agent AlibabaCloud-Agent-Skills

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies

Required RAM (Resource Access Management) permissions for MaxCompute Project Management operations.

Required Permissions

This Skill execution requires the following RAM permissions in {Product}:{Action} format:

• odps:CreateProject — Create MaxCompute project
• odps:GetProject — Query project details
• odps:ListProjects — List all projects
• odps:ListQuotas — List compute quotas (REQUIRED for project creation)

Summary Table

---

RAM Policy Document

Full Access Policy

Use this policy for users who need complete project management capabilities:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:CreateProject",
        "odps:GetProject",
        "odps:ListProjects",
        "odps:ListQuotas"
      ],
      "Resource": "*"
    }
  ]
}

Read-Only Policy

Use this policy for users who only need to view project information:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:GetProject",
        "odps:ListProjects"
      ],
      "Resource": "*"
    }
  ]
}

Create-Only Policy

Use this policy for automation that only needs to create projects:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:CreateProject",
        "odps:GetProject",
        "odps:ListProjects",
        "odps:ListQuotas"
      ],
      "Resource": "*"
    }
  ]
}

---

Resource Scope Examples

Restrict to Specific Project

To restrict permissions to a specific project:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:GetProject"
      ],
      "Resource": "acs:odps:*:*:projects/<project-name>"
    }
  ]
}

Restrict by Project Name Prefix

To allow operations on projects with a specific prefix:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:GetProject",
        "odps:ListProjects"
      ],
      "Resource": "acs:odps:*:*:projects/test_*"
    }
  ]
}

---

Permission Verification

Before running the skill, verify permissions using:

# Check current user identity
aliyun sts get-caller-identity --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

# List attached policies (requires RAM read permission)
aliyun ram list-policies-for-user --user-name <username> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

---

Pre-configured System Policies

Alibaba Cloud provides pre-configured policies that include MaxCompute permissions:

To attach a system policy:

aliyun ram attach-policy-to-user \
  --policy-type System \
  --policy-name AliyunODPSFullAccess \
  --user-name <username> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

---

Best Practices

1. Least Privilege: Grant only the minimum permissions required for the task 2. Resource Scoping: When possible, restrict resources to specific projects rather than using * 3. Separate Policies: Use different policies for different environments (dev, staging, prod) 4. Audit Regularly: Review and audit RAM policies periodically 5. Use Roles: For cross-account or service access, use RAM roles instead of long-term credentials

Related APIs

Complete API reference for MaxCompute Project Management operations.

API Overview

---

CreateProject

API Endpoint: https://maxcompute.{regionId}.aliyuncs.com

API Documentation: CreateProject

CLI Command

aliyun maxcompute create-project \
  --body '{"name":"<project-name>","defaultQuota":"os_PayAsYouGoQuota","productType":"payasyougo"}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Request Body Parameters

Response

{
  "requestId": "0bc1ec92-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "data": "project_name"
}

---

GetProject

API Documentation: GetProject

CLI Command

aliyun maxcompute get-project \
  --project-name <project-name> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Request Parameters

Response

{
  "requestId": "0bc1ec92-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "data": {
    "name": "project_name",
    "owner": "ALIYUN$account@aliyun.com",
    "status": "AVAILABLE",
    "type": "managed",
    "defaultQuota": "os_PayAsYouGoQuota",
    "productType": "payasyougo",
    "regionId": "cn-hangzhou",
    "createdTime": 1234567890000,
    "properties": {
      "typeSystem": "2"
    }
  }
}

Response Fields

---

ListProjects

API Documentation: ListProjects

CLI Command

# List all projects
aliyun maxcompute list-projects \
  --max-item 10 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

# Filter by quota
aliyun maxcompute list-projects \
  --quota-nick-name <quota-name> \
  --max-item 10 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Request Parameters

Response

{
  "requestId": "0bc1ec92-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "data": {
    "projects": [
      {
        "name": "project1",
        "owner": "ALIYUN$account@aliyun.com",
        "status": "AVAILABLE",
        "defaultQuota": "os_PayAsYouGoQuota"
      },
      {
        "name": "project2",
        "owner": "ALIYUN$account@aliyun.com",
        "status": "AVAILABLE",
        "defaultQuota": "my_quota"
      }
    ],
    "nextToken": "next_page_marker"
  }
}

---

DeleteProject

API Documentation: DeleteProject

⚠️ Warning: This operation is irreversible. All data in the project will be permanently deleted.

CLI Command

aliyun maxcompute delete-project \
  --project-name <project-name> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Request Parameters

Prerequisites

1. Project must be in AVAILABLE status 2. All tables and resources in the project should be deleted first 3. User must have odps:DeleteProject permission

Response

{
  "requestId": "0bc1ec92-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "data": "project_name"
}

---

Error Codes

---

SDK Code Example (Python)

If CLI is not suitable for your use case, use the Python Common SDK:

from alibabacloud_tea_openapi.client import Client as OpenApiClient
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_tea_util import models as util_models
from alibabacloud_openapi_util.client import Client as OpenApiUtilClient
import json

# User-Agent identifier for Alibaba Cloud Agent Skills
USER_AGENT = 'AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage'

def create_maxcompute_project(project_name, quota_nickname, product_type="payasyougo"):
    """Create a MaxCompute project using Python Common SDK."""
    
    # Initialize credentials
    credential = CredentialClient()
    config = open_api_models.Config(credential=credential)
    config.endpoint = 'maxcompute.cn-hangzhou.aliyuncs.com'
    # [MUST] Set User-Agent for tracking
    config.user_agent = USER_AGENT
    client = OpenApiClient(config)
    
    # Configure API parameters
    params = open_api_models.Params(
        action='CreateProject',
        version='2022-01-04',
        protocol='HTTPS',
        method='POST',
        auth_type='AK',
        style='ROA',
        pathname='/api/v1/projects',
        req_body_type='json',
        body_type='json'
    )
    
    # Build request body
    body = {
        'name': project_name,
        'defaultQuota': quota_nickname,
        'productType': product_type
    }
    
    request = open_api_models.OpenApiRequest(
        body=OpenApiUtilClient.parse_to_map(body)
    )
    
    # Execute request with timeout settings
    runtime = util_models.RuntimeOptions(
        connect_timeout=10000,  # 10 seconds connection timeout
        read_timeout=30000      # 30 seconds read timeout
    )
    return client.call_api(params, request, runtime)

Required Dependencies:

pip install alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util alibabacloud_openapi_util

Success Verification Method

Verification steps to confirm successful execution of MaxCompute Project Management operations.

---

1. Create Project Verification

Expected Outcome

A new MaxCompute project is created and available for use.

Verification Steps

Step 1: Verify project creation response

# The create-project command should return the project name
aliyun maxcompute create-project \
  --body '{"name":"test_project","defaultQuota":"os_PayAsYouGoQuota","productType":"payasyougo"}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

# Expected response:
# {
#   "requestId": "xxx",
#   "data": "test_project"
# }

Step 2: Query the created project

aliyun maxcompute get-project \
  --project-name test_project \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Success Indicators:

Common Issues

---

2. Get Project Verification

Expected Outcome

Project details are returned with accurate information.

Verification Steps

Step 1: Query project details

aliyun maxcompute get-project \
  --project-name <project-name> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Success Indicators:

Validation Script

#!/bin/bash
PROJECT_NAME="your_project_name"

# Get project and extract status
RESPONSE=$(aliyun maxcompute get-project --project-name $PROJECT_NAME --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage 2>&1)

# Check if response contains expected fields
if echo "$RESPONSE" | grep -q '"status"'; then
  echo "✅ Get project successful"
  echo "$RESPONSE" | jq '.data | {name, status, owner, productType}'
else
  echo "❌ Get project failed"
  echo "$RESPONSE"
  exit 1
fi

---

3. List Projects Verification

Expected Outcome

A list of projects is returned, optionally filtered by quota.

Verification Steps

Step 1: List all projects

aliyun maxcompute list-projects \
  --max-item 10 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Step 2: List with quota filter (optional)

aliyun maxcompute list-projects \
  --quota-nick-name os_PayAsYouGoQuota \
  --max-item 10 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Success Indicators:

Validation Script

#!/bin/bash

# List projects
RESPONSE=$(aliyun maxcompute list-projects --max-item 10 --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage 2>&1)

# Check if response contains projects array
if echo "$RESPONSE" | grep -q '"projects"'; then
  echo "✅ List projects successful"
  PROJECT_COUNT=$(echo "$RESPONSE" | jq '.data.projects | length')
  echo "Found $PROJECT_COUNT projects"
  echo "$RESPONSE" | jq '.data.projects[] | {name, status}'
else
  echo "❌ List projects failed"
  echo "$RESPONSE"
  exit 1
fi

---

4. Delete Project Verification

Expected Outcome

Project is deleted and no longer accessible.

⚠️ Warning: This operation is irreversible. Use with caution.

Verification Steps

Step 1: Delete the project

aliyun maxcompute delete-project \
  --project-name <project-name> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

Step 2: Verify deletion

# Attempting to get the deleted project should fail
aliyun maxcompute get-project \
  --project-name <project-name> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage

# Expected: ProjectNotFound error

Success Indicators:

---

End-to-End Verification Script

Complete verification of all operations:

#!/bin/bash
set -e

# Configuration
PROJECT_NAME="test_project_$(date +%s)"
QUOTA_NAME="os_PayAsYouGoQuota"

echo "=== MaxCompute Project Management Verification ==="
echo "Test Project: $PROJECT_NAME"
echo ""

# Step 1: Create Project
echo "1. Creating project..."
CREATE_RESULT=$(aliyun maxcompute create-project \
  --body "{\"name\":\"$PROJECT_NAME\",\"defaultQuota\":\"$QUOTA_NAME\",\"productType\":\"payasyougo\"}" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage)
echo "✅ Project created"

# Step 2: Wait for project to be available
echo "2. Waiting for project to be available..."
sleep 5

# Step 3: Get Project
echo "3. Getting project details..."
GET_RESULT=$(aliyun maxcompute get-project \
  --project-name $PROJECT_NAME \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage)
STATUS=$(echo $GET_RESULT | jq -r '.data.status')
echo "✅ Project status: $STATUS"

# Step 4: List Projects
echo "4. Listing projects..."
LIST_RESULT=$(aliyun maxcompute list-projects \
  --max-item 10 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage)
echo "✅ Projects listed"

# Step 5: Cleanup (Optional - uncomment to delete)
# echo "5. Cleaning up..."
# aliyun maxcompute delete-project \
#   --project-name $PROJECT_NAME \
#   --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage
# echo "✅ Project deleted"

echo ""
echo "=== Verification Complete ==="
echo "All operations successful for project: $PROJECT_NAME"

---

Quick Reference