Alibabacloud Odps Quota Manage

MaxCompute Quota Management

Manage MaxCompute (ODPS) Quota resources using Alibaba Cloud CLI and SDK. This skill covers pay-as-you-go quota creation, quota query, and quota listing operations.

Limitations and Notes

Important:

- Create Subscription Quota is temporarily NOT supported in this skill. For subscription quota creation, please use the Alibaba Cloud Console.

- Delete Quota operation is NOT available through CLI or SDK. You must use the Alibaba Cloud Console to delete quotas.

- query-quota is preferred - get-quota is deprecated but acceptable if it returns success

- ⚠️ CRITICAL: When checking if quota exists, ALWAYS use list-quotas, NEVER use get-quota

- 🚨 MANDATORY: Before create-quota, MUST call list-quotas first - NEVER skip this step

Architecture

Alibaba Cloud Account → MaxCompute Service → Quota Resources (CU)
                                           ├── Pay-as-you-go Quota (后付费) ← **Creation Supported**
                                           └── Subscription Quota (预付费) ← Query/List only

Installation

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update,

or see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin setup required

[MUST] Install the maxcompute plugin manually: aliyun plugin install maxcompute

[MUST] Update the plugin to latest version: aliyun plugin update maxcompute

# Verify CLI version
aliyun version

# Install maxcompute plugin (confirm when prompted)
aliyun plugin install maxcompute

# Update maxcompute plugin to latest version
aliyun plugin update maxcompute

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

At the start of the Core Workflow (before any CLI invocation): [MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage"

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

aliyun configure ai-mode disable

Environment Variables

This skill relies on the aliyun CLI default credential chain. No explicit credential configuration is needed.

• Run aliyun configure to set up credentials before first use
• Do NOT explicitly handle or pass credential values in commands

Timeout Configuration:

• ALIBABA_CLOUD_CONNECT_TIMEOUT: Connection timeout (default: 10s)
• ALIBABA_CLOUD_READ_TIMEOUT: Read timeout (default: 10s)
• These defaults are sufficient for quota operations; no explicit configuration required

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., RegionId, quota nicknames, billing types, etc.)

MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

Input Validation

Security Note: All user inputs are passed to aliyun CLI which handles parameter sanitization. Do NOT construct commands using string concatenation with raw user input.

Commodity Codes (for Pay-as-you-go)

Authentication

Security: Never expose credentials

• Don't print AK/SK values
• Don't ask user to type AK/SK in chat
• Don't use aliyun configure set with hardcoded values

Check credentials:

aliyun configure list

If no credentials, ask user to run aliyun configure first, then continue.

Core Workflow

🚨 STEP 0 - CONFIRM PARAMETERS WITH USER BEFORE ANY EXECUTION:

Before running any CLI command, you MUST confirm all required parameters with the user:

• For LIST: Confirm region and billing-type (payasyougo / subscription / ALL)
• For QUERY: Confirm region and nickname
• For CREATE: Confirm region, charge-type, and commodity-code

Do NOT assume or use default values. Ask the user explicitly and wait for confirmation before proceeding.

🚨 CRITICAL RULE FOR ALL OPERATIONS:

⚠️ CREATE without list-quotas first = ERROR

---

FORBIDDEN COMMANDS - NEVER USE:

• ❌ aliyun quotas commands - WRONG SERVICE (Quota Center), use MaxCompute instead
• ❌ Any BssOpenApi commands for quota operations - use MaxCompute instead
• ❌ get-quota - DEPRECATED, use query-quota instead

MUST USE (plugin mode, kebab-case):

• ✅ aliyun maxcompute list-quotas - For listing/checking quotas
• ✅ aliyun maxcompute query-quota - For querying quota details
• ✅ aliyun maxcompute create-quota - For creating quota

⚠️ IMPORTANT: Use aliyun maxcompute commands (MaxCompute service), NOT aliyun quotas commands (Quota Center service).

Command Rules:

• ALL CLI commands use plugin mode (kebab-case): create-quota, list-quotas, query-quota
• Parameters also use kebab-case: --charge-type, --commodity-code, --billing-type

---

CREATE Quota (CHECK FIRST - THEN CREATE):

🚨 PREPAID/SUBSCRIPTION QUOTAS ARE FORBIDDEN: This skill ONLY supports pay-as-you-go quota creation.

• If user wants prepaid/subscription quota → Tell them to use Alibaba Cloud Console
• Do NOT attempt to create prepaid quotas

🚨 FOR CREATE: FIRST RUN LISTQUOTAS - NEVER SKIP THIS:

STEP 1 - MANDATORY: Call list-quotas FIRST

aliyun maxcompute list-quotas --billing-type payasyougo --region <R>

DO NOT proceed to Step 2 until you get list-quotas result

Use MaxCompute service (`aliyun maxcompute`), NOT Quota Center (`aliyun quotas`).

AFTER list-quotas result (STEP 2):

STEP 3 - ONLY IF LIST WAS EMPTY:

PRE-CREATE CHECKLIST - ALL MUST BE TRUE:

• [ ] User wants pay-as-you-go (NOT prepaid/subscription)
• [ ] list-quotas was called and returned empty list
• [ ] No existing pay-as-you-go quota in the region
• [ ] User confirmed they want to create

aliyun maxcompute create-quota --charge-type payasyougo --commodity-code odps --region <R> --client-token <UNIQUE_TOKEN>

For International Site:

aliyun maxcompute create-quota --charge-type payasyougo --commodity-code odps_intl --region <R> --client-token <UNIQUE_TOKEN>

CRITICAL:

• Use plugin mode (kebab-case): create-quota
• Use MaxCompute service, NOT BssOpenApi
• client-token: Generate a unique token (e.g., UUID) for idempotency on retries
• commodityCode values:
• China site: odps or odpsplus
• International site: odps_intl or odpsplus_intl
• NEVER use maxcompute as commodityCode
• Note: When chargeType=payasyougo is set, commodityCode validation is not strict

⚠️ OUTPUT HANDLING:

• Do NOT pipe command output to files (e.g., | tee ... or > file.json) — if the target directory does not exist, the command will return a non-zero exit code even when the API call succeeds.
• Let the CLI print output directly to stdout, then parse the result inline.
• When saving output files (e.g., existing_quotas.json, actions_log.txt), ALWAYS mkdir -p <directory> first before writing any file to ensure the target directory exists.

FINALLY:

• Parse result
• Show user
• Done

⚠️ NEVER call create-quota before list-quotas. This causes errors.

Note: If quota already exists, DO NOT create. Only create when list-quotas returns empty list.

QUERY Quota (when user provides nickname):

PRIORITY: Use query-quota as the primary API for querying specific quota details by nickname.

CHECKLIST:

• [ ] User provided quota nickname
• [ ] Use query-quota (NOT get-quota)

USE THIS COMMAND:

aliyun maxcompute query-quota --nickname <N> --region <R>

IMPORTANT: If nickname contains Chinese characters, URL-encode it first before passing to the command.

FORBIDDEN: get-quota is deprecated - use query-quota instead.

• Parse JSON
• Extract: nickName, name, id, status
• Show all fields → Done

LIST Quotas:

⚠️ FOR LISTING QUOTAS: ONLY use MaxCompute list-quotas, NOT BssOpenApi

When checking for existing pay-as-you-go quotas (before creation):

aliyun maxcompute list-quotas --billing-type payasyougo --region <R>

MUST include `--billing-type payasyougo` to filter at API level.

When listing all quotas (user request):

aliyun maxcompute list-quotas --billing-type ALL --region <R>

billingType parameter:

• Valid values: payasyougo, subscription, ALL
• If not set, defaults to ALL
• Use payasyougo when checking for existing pay-as-you-go quotas

• Parse JSON
• Extract quotaInfoList array
• Show list → Done

Response field `odpsSpecCode` enum values:

---

Quick Reference

See references/related-apis.md for complete CLI command reference and response format details.

Key Points:

• Use list-quotas --billing-type payasyougo before creating
• Use query-quota (not get-quota) for querying
• Use create-quota (kebab-case plugin mode) for creating
• Always include --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

---

Task Completion

Output Files — MUST create before finishing: 1. mkdir -p outputs ran_scripts — ensure directories exist first 2. Save quota query/list results to outputs/existing_quotas.json 3. Save a log of all actions performed to ran_scripts/actions_log.txt

IMPORTANT: Always run mkdir -p for any target directory BEFORE writing files. Never assume directories already exist.

Finish with:

• Summary of what was done
• Key results (nickname, region, status)
• Confirm output files were written (outputs/existing_quotas.json, ran_scripts/actions_log.txt)
• "✅ Complete"

---

Error Handling

---

Cleanup

No Delete API - Must use Console to delete quotas

API Reference

See references/related-apis.md for complete API reference, CLI commands, and response formats.

Best Practices

1. Always confirm region with user before any operation 2. For creation: First list to check if quota exists (one per region limit) 3. If quota exists: Query it for user instead of trying to create 4. Use query-quota (NOT get-quota) for quota details 5. For subscription quotas: Direct user to Alibaba Cloud Console

Reference Links

Related Documentation

• MaxCompute Product
• create-quota API
• get-quota API
• list-quotas API
• Java SDK Documentation
• Credential Management

Acceptance Criteria: MaxCompute Quota Management

Scenario: MaxCompute Quota Management Purpose: Skill testing acceptance criteria

---

API Coverage and Limitations

---

Correct CLI Command Patterns

1. Product Name Verification

✅ CORRECT — Use maxcompute as product name:

aliyun maxcompute list-quotas
aliyun maxcompute query-quota --nickname xxx
aliyun maxcompute create-quota --charge-type payasyougo

❌ INCORRECT — Wrong product names:

aliyun odps list-quotas           # Wrong: use maxcompute, not odps
aliyun MaxCompute list-quotas     # Wrong: must be lowercase
aliyun mc list-quotas             # Wrong: no abbreviation

2. Command Name Verification

✅ CORRECT — Use kebab-case (plugin mode) for all commands:

aliyun maxcompute create-quota     # Plugin mode
aliyun maxcompute get-quota       # Deprecated
aliyun maxcompute query-quota     # Recommended
aliyun maxcompute list-quotas

❌ INCORRECT — Wrong command formats:

aliyun maxcompute createQuota     # Wrong: camelCase
aliyun maxcompute create_quota    # Wrong: underscore
aliyun maxcompute delete-quota    # Wrong: No such API exists

3. Parameter Name Verification

✅ CORRECT — Use kebab-case for all parameters:

aliyun maxcompute create-quota \
  --charge-type payasyougo \
  --commodity-code odps \
  --part-nick-name "myQuotaNick"    # Only letters and numbers allowed

aliyun maxcompute list-quotas \
  --billing-type payasyougo \
  --max-item 10

aliyun maxcompute query-quota \      # Recommended
  --nickname "quota-name"

aliyun maxcompute get-quota \        # Deprecated
  --nickname "quota-name"

❌ INCORRECT — Wrong parameter formats:

aliyun maxcompute create-quota --chargeType payasyougo    # Wrong: camelCase
aliyun maxcompute create-quota --charge_type payasyougo   # Wrong: underscore
aliyun maxcompute create-quota --ChargeType payasyougo    # Wrong: PascalCase

4. User-Agent Verification

✅ CORRECT — Every command includes user-agent:

aliyun maxcompute list-quotas --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT — Missing user-agent:

aliyun maxcompute list-quotas    # Wrong: missing --user-agent

5. Region Parameter Verification

✅ CORRECT — Include region when needed:

aliyun maxcompute list-quotas --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills
aliyun maxcompute query-quota --nickname xxx --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills

6. Charge Type Values Verification

✅ CORRECT — Valid charge type values (for CreateQuota):

--chargeType payasyougo     # Pay-as-you-go
--chargeType subscription   # Subscription

❌ INCORRECT — Invalid charge type values:

--chargeType PayAsYouGo      # Wrong: must be lowercase
--chargeType pay-as-you-go   # Wrong: no hyphens
--chargeType postpaid        # Wrong: not the correct value
--chargeType prepaid         # Wrong: not the correct value

7. Billing Type Values Verification (for list-quotas)

✅ CORRECT — Valid billing type values:

--billing-type payasyougo    # Filter pay-as-you-go quotas
--billing-type subscription  # Filter subscription quotas

8. Commodity Code Values Verification

✅ CORRECT — Valid commodity codes (for CreateQuota):

# China site
--commodityCode odps        # Pay-as-you-go
--commodityCode odpsplus    # Subscription

# International site
--commodityCode odps_intl       # Pay-as-you-go
--commodityCode odpsplus_intl   # Subscription

❌ INCORRECT — Invalid commodity codes:

--commodityCode maxcompute      # Wrong: not valid
--commodityCode odps-plus       # Wrong: hyphen instead of no separator
--commodityCode ODPS            # Wrong: must be lowercase

9. Commodity Data Format Verification (for subscription)

✅ CORRECT — Valid JSON format (for CreateQuota):

--commodityData '{"CU":50,"ord_time":"1:Month","autoRenew":false}'
--commodityData '{"CU":100,"ord_time":"1:Year","autoRenew":true}'

❌ INCORRECT — Invalid formats:

--commodity-data '{CU:50}'                    # Wrong: missing quotes around keys
--commodity-data '{"cu":50}'                  # Wrong: CU must be uppercase
--commodity-data '{"CU":"50"}'                # Wrong: CU value must be integer
--commodity-data '{"CU":50,ord_time:"1:Month"}'  # Wrong: missing quotes

---

Authentication Patterns

1. Credential Verification

✅ CORRECT — Check credentials without exposing values:

aliyun configure list

❌ INCORRECT — Never expose credentials:

echo $ALIBABA_CLOUD_ACCESS_KEY_ID        # Wrong: exposes AK
cat ~/.aliyun/config.json                 # Wrong: may expose credentials
aliyun configure set --access-key-id xxx  # Wrong: hardcoded credentials

---

Response Verification Patterns

1. Create Quota Success

✅ CORRECT — Check for RequestId and NickName:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "Data": {
    "NickName": "quota-nickname"
  }
}

2. Get Quota Success

✅ CORRECT — Response contains quota details:

{
  "RequestId": "xxxxxxxx",
  "NickName": "quota-nickname",
  "Name": "quota-name",
  "Id": "quota-id",
  "Status": "ON"
}

3. List Quotas Success

✅ CORRECT — Response contains QuotaInfoList:

{
  "RequestId": "xxxxxxxx",
  "QuotaInfoList": [...],
  "NextToken": "..."
}

---

Error Handling Patterns

1. Check for Common Errors

---

Test Scenarios

Scenario 1: List Quotas (Read-Only)

# Should succeed with valid credentials
aliyun maxcompute list-quotas \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

Scenario 2: Query Non-Existent Quota

# Should return QuotaNotFound error
aliyun maxcompute query-quota \
  --nickname "non-existent-quota" \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

Scenario 3: Create Pay-as-you-go Quota

# Should succeed and return NickName
aliyun maxcompute create-quota \
  --charge-type payasyougo \
  --commodity-code odps \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

Scenario 4: Delete Quota (NOT TESTABLE)

⚠️ LIMITATION: There is no DeleteQuota API.

>

This scenario cannot be tested via CLI or SDK.

Delete operations must be performed through the MaxCompute Console.

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.1+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

MaxCompute Quota Management - RAM Policies

Overview

This document lists the required RAM (Resource Access Management) permissions for MaxCompute Quota management operations.

API to Permission Mapping

Note: Delete Quota permission is not applicable as there is no DeleteQuota API. Quota deletion must be performed through the Console.

Recommended Policy

Full Quota Management Policy

This policy grants all permissions needed for quota management:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:CreateQuota",
        "odps:GetQuota",
        "odps:QueryQuota",
        "odps:ListQuotas"
      ],
      "Resource": "acs:odps:*:<your-account-id>:quota/*"
    }
  ]
}

Note: Replace <your-account-id> with your Alibaba Cloud account ID. This scopes permissions to quota resources only.

Read-Only Quota Policy

For users who only need to view quota information:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:GetQuota",
        "odps:QueryQuota",
        "odps:ListQuotas"
      ],
      "Resource": "acs:odps:*:<your-account-id>:quota/*"
    }
  ]
}

Minimal Create Quota Policy

For users who need to create quotas:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:CreateQuota",
        "odps:QueryQuota",
        "odps:ListQuotas"
      ],
      "Resource": "acs:odps:*:<your-account-id>:quota/*"
    }
  ]
}

How to Attach Policy

Via Alibaba Cloud Console

1. Log in to the RAM Console 2. Navigate to Identities > Users 3. Select the target user 4. Click Add Permissions 5. Select or create custom policy with above permissions 6. Confirm and save

Via Aliyun CLI

# Create custom policy
aliyun ram create-policy \
  --policy-name MaxComputeQuotaManagement \
  --policy-document '{
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "odps:CreateQuota",
          "odps:QueryQuota",
          "odps:ListQuotas"
        ],
        "Resource": "*"
      }
    ]
  }' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

# Attach policy to user
aliyun ram attach-policy-to-user \
  --policy-name MaxComputeQuotaManagement \
  --policy-type Custom \
  --user-name <your-username> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

System Policies

Alternatively, you can use the following system policies:

Notes

1. Principle of Least Privilege: Grant only the minimum permissions required for the task 2. Resource Scope: Consider limiting Resource to specific regions or quota IDs if needed 3. Billing Permissions: Creating subscription quotas may require additional billing permissions 4. Audit Trail: Enable ActionTrail for auditing quota management operations 5. Delete Operations: Since there is no DeleteQuota API, no delete permission is needed for API access

MaxCompute Quota Management - Related APIs

API Availability Summary

CLI Commands Reference

API Details

1. CreateQuota

Endpoint: maxcompute.{regionId}.aliyuncs.com

CLI Command:

aliyun maxcompute create-quota \
  --charge-type <payasyougo|subscription> \
  --commodity-code <odps|odpsplus|odps_intl|odpsplus_intl> \
  --part-nick-name <nickname> \
  --commodity-data '<json-data>' \
  --region <regionId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Parameters:

CommodityData Format (for subscription):

{
  "CU": 50,
  "ord_time": "1:Month",
  "autoRenew": false
}

Response:

{
  "RequestId": "xxx-xxx-xxx",
  "Data": {
    "NickName": "quota-nickname"
  }
}

---

2. GetQuota (⚠️ Deprecated)

Warning: This API is deprecated and will be removed after 2024-07-31. Please use QueryQuota instead.

CLI Command:

aliyun maxcompute get-quota \
  --nickname <quota-nickname> \
  --region <regionId> \
  --user-agent AlibabaCloud-Agent-Skills

Parameters:

---

3. QueryQuota (✅ Recommended)

CLI Command:

aliyun maxcompute query-quota \
  --nickname <quota-nickname> \
  --region <regionId> \
  --user-agent AlibabaCloud-Agent-Skills

Parameters:

Response:

{
  "RequestId": "xxx-xxx-xxx",
  "NickName": "quota-nickname",
  "Name": "quota-name",
  "Id": "quota-id",
  "Status": "ON"
}

---

4. ListQuotas

CLI Command:

aliyun maxcompute list-quotas \
  --billing-type <payasyougo|subscription> \
  --max-item <number> \
  --marker <token> \
  --region <regionId> \
  --user-agent AlibabaCloud-Agent-Skills

Parameters:

Response:

{
  "RequestId": "xxx-xxx-xxx",
  "NextToken": "token-for-next-page",
  "QuotaInfoList": [
    {
      "NickName": "quota-nickname",
      "Name": "quota-name",
      "Id": "quota-id"
    }
  ]
}

---

5. DeleteQuota (❌ Not Available)

⚠️ LIMITATION: MaxCompute does NOT provide a DeleteQuota API.

>

To delete a quota, you must use:

1. Alibaba Cloud MaxCompute Console

2. For subscription quotas, cancel the subscription and wait for expiration

>

This is a platform limitation.

---

Commodity Codes Reference

API Documentation Links

• CreateQuota API
• GetQuota API
• ListQuotas API
• MaxCompute API Overview

MaxCompute Quota Management - Verification Method

Overview

This document provides step-by-step verification methods to confirm successful execution of MaxCompute Quota management operations.

API Limitations

---

1. Create Pay-as-you-go Quota Verification

Step 1: Execute Create Command

aliyun maxcompute create-quota \
  --charge-type payasyougo \
  --commodity-code odps \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Step 2: Check Response

Success Indicators:

• Response contains RequestId
• Response contains Data.NickName (the created quota nickname)

Expected Response Structure:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "Data": {
    "NickName": "created-quota-nickname"
  }
}

Step 3: Verify via List

aliyun maxcompute list-quotas \
  --billing-type payasyougo \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Verification:

• The newly created quota should appear in QuotaInfoList
• Check that NickName matches the expected value

---

2. Create Subscription Quota Verification

Step 1: Execute Create Command

aliyun maxcompute create-quota \
  --charge-type subscription \
  --commodity-code odpsplus \
  --part-nick-name "my-test-quota" \
  --commodity-data '{"CU":50,"ord_time":"1:Month","autoRenew":false}' \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Step 2: Check Response

Success Indicators:

• Response contains RequestId
• Response contains Data.NickName matching the specified part-nick-name

Step 3: Verify via List or Query

Using QueryQuota (Recommended):

aliyun maxcompute query-quota \
  --nickname "my-test-quota" \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Or using ListQuotas:

aliyun maxcompute list-quotas \
  --billing-type subscription \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Verification:

• NickName matches my-test-quota
• Status is ON or similar active status
• Id is populated

---

3. Query Quota Verification

⚠️ Note: GetQuota API is deprecated. Always use QueryQuota (query-quota) instead.

Step 1: Execute Query Command

aliyun maxcompute query-quota \
  --nickname "quota-nickname" \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Step 2: Check Response

Success Indicators:

• Response contains RequestId
• Response contains quota details: NickName, Name, Id, Status

Expected Response Structure:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "NickName": "quota-nickname",
  "Name": "quota-system-name",
  "Id": "quota-unique-id",
  "Status": "ON"
}

Failure Indicators:

• Error message: QuotaNotFound - The specified quota does not exist
• Error message: InvalidParameter - Invalid nickname format

---

4. List Quotas Verification

Step 1: Execute List Command

aliyun maxcompute list-quotas \
  --billing-type payasyougo \
  --max-item 10 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Step 2: Check Response

Success Indicators:

• Response contains RequestId
• Response contains QuotaInfoList (may be empty if no quotas exist)

Expected Response Structure:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "NextToken": "pagination-token-or-empty",
  "QuotaInfoList": [
    {
      "NickName": "quota-nickname-1",
      "Name": "quota-name-1",
      "Id": "quota-id-1"
    },
    {
      "NickName": "quota-nickname-2",
      "Name": "quota-name-2",
      "Id": "quota-id-2"
    }
  ]
}

Step 3: Pagination Verification

If NextToken is returned, fetch next page:

aliyun maxcompute list-quotas \
  --billing-type payasyougo \
  --max-item 10 \
  --marker "<NextToken-value>" \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

---

5. Delete Quota Verification

⚠️ LIMITATION: MaxCompute does NOT provide a DeleteQuota API.

>

Quota deletion cannot be verified programmatically because it must be performed through:

1. Alibaba Cloud MaxCompute Console

2. For subscription quotas, cancel the subscription and wait for expiration

Manual Verification Steps

1. Log in to MaxCompute Console 2. Navigate to Quota Management 3. Find the quota you want to delete 4. Click Delete or Unsubscribe (for subscription quotas) 5. Verify deletion by running:

aliyun maxcompute query-quota \
  --nickname "deleted-quota-nickname" \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

Expected Result: Should return QuotaNotFound error if quota was successfully deleted.

---

Common Error Codes

---

Quick Verification Script

#!/bin/bash

# Verify credentials
echo "Checking credentials..."
aliyun configure list

# List all quotas
echo "Listing all quotas..."
aliyun maxcompute list-quotas \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

# Query specific quota (using recommended QueryQuota)
echo "Querying specific quota..."
aliyun maxcompute query-quota \
  --nickname "your-quota-nickname" \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

echo "Verification complete!"
echo ""
echo "NOTE: Delete quota verification cannot be automated."
echo "      Use MaxCompute Console: https://maxcompute.console.aliyun.com/"