Alibabacloud Openclaw Ecs Dingtalk

Deploy OpenClaw on ECS with DingTalk Integration

Deploy OpenClaw AI agent platform on an Alibaba Cloud ECS instance with one click, configure Alibaba Cloud Bailian LLM, and connect to a DingTalk group via a DingTalk bot, enabling users to chat with AI directly in DingTalk.

Source: This Skill is based on Alibaba Cloud official documentation and OpenClaw open-source project documentation. See reference links at the end.

>

Version: This Skill is written for OpenClaw March 2026 release and the @dingtalk-real-ai/dingtalk-connector plugin, verified on 2026-03-11.

Parameter Collection

Before execution, prompt the user to provide all required parameters in a single message. Do not proceed until all required parameters are received and confirmed.

Input Validation

Validate all user inputs before use to prevent command injection. Reject inputs containing shell special characters (;, |, &, $, \, ', ", backticks, parentheses, brackets, newlines). Parameters must match expected formats:

• region: cn-[a-z]+, ap-[a-z]+, us-[a-z]+ etc.
• instance_type: ecs.[a-z0-9]+.[a-z0-9]+
• vpc_id/vswitch_id/security_group_id: vpc-/vsw-/sg-[a-z0-9]+
• dingtalk_client_id: ding[a-z0-9]+
• dingtalk_client_secret: 16-64 alphanumeric chars

When passing parameters to Cloud Assistant RunCommand, use base64 encoding for sensitive values.

ECS Instance Parameters

OpenClaw and Bailian Parameters

The Bailian API Key (bailian_api_key) is automatically obtained via CLI during deployment (see Step 2). No manual console operation is needed. The Skill uses aliyun modelstudio commands (ListWorkspaces + CreateApiKey) to retrieve or create an API Key programmatically.

Prerequisites: The user's Alibaba Cloud account must have the Bailian (Model Studio) service activated. If not activated, guide the user to visit Bailian Console to activate it first.

DingTalk Integration Parameters

If the user has not created a DingTalk app, guide them to refer to the DingTalk App Setup Guide to create an app, configure the bot, add permissions, publish the app, and obtain credentials.

Execution Constraints

• Sensitive information masking: Mask middle portion of passwords, keys, tokens, IPs, instance IDs (e.g., ak****3d, i-bp1****7f2z)
• Input validation: Reject shell special characters (;, |, &, $, backticks, etc.). Use parameterized API calls
• Command injection prevention: Encode sensitive values for Cloud Assistant RunCommand using base64
• Network timeout: All curl/wget operations must include --connect-timeout and --max-time parameters
• Execute steps in order; verify success after each step; inform user of current step
• If any step fails, ask user for confirmation before continuing
• Cloud Assistant RunCommand results: poll DescribeInvocations every 15+ seconds
• Destructive operations: Confirm with user and verify resource state before deletion

---

Step 1: Create ECS Instance

1.1 Verify Alibaba Cloud Account

aliyun sts GetCallerIdentity \
  --user-agent AlibabaCloud-Agent-Skills

1.2 Check Zone Availability

Query which availability zones have stock for the target instance type to avoid creating resources in an unavailable zone:

aliyun ecs DescribeAvailableResource \
  --RegionId ${region} \
  --DestinationResource InstanceType \
  --InstanceChargeType PostPaid \
  --InstanceType ${instance_type} \
  --user-agent AlibabaCloud-Agent-Skills

Select a zone where StatusCategory is WithStock from the result, record as ${zone_id}.

1.3 Create VPC and VSwitch (if not provided by user)

# Create VPC
aliyun vpc CreateVpc \
  --RegionId ${region} \
  --VpcName openclaw-vpc \
  --CidrBlock 172.16.0.0/16 \
  --user-agent AlibabaCloud-Agent-Skills

# Create VSwitch (use the zone with stock found in the previous step)
aliyun vpc CreateVSwitch \
  --RegionId ${region} \
  --VpcId ${vpc_id} \
  --VSwitchName openclaw-vswitch \
  --CidrBlock 172.16.0.0/24 \
  --ZoneId ${zone_id} \
  --user-agent AlibabaCloud-Agent-Skills

1.4 Create Security Group and Configure Rules

# Create security group
aliyun ecs CreateSecurityGroup \
  --RegionId ${region} \
  --VpcId ${vpc_id} \
  --SecurityGroupName openclaw-sg \
  --Description "Security group for OpenClaw" \
  --user-agent AlibabaCloud-Agent-Skills

# Allow SSH (port 22)
aliyun ecs AuthorizeSecurityGroup \
  --RegionId ${region} \
  --SecurityGroupId ${security_group_id} \
  --IpProtocol tcp \
  --PortRange 22/22 \
  --SourceCidrIp 0.0.0.0/0 \
  --user-agent AlibabaCloud-Agent-Skills

# Allow HTTP (port 80) and HTTPS (port 443)
aliyun ecs AuthorizeSecurityGroup \
  --RegionId ${region} \
  --SecurityGroupId ${security_group_id} \
  --IpProtocol tcp \
  --PortRange 80/80 \
  --SourceCidrIp 0.0.0.0/0 \
  --user-agent AlibabaCloud-Agent-Skills

aliyun ecs AuthorizeSecurityGroup \
  --RegionId ${region} \
  --SecurityGroupId ${security_group_id} \
  --IpProtocol tcp \
  --PortRange 443/443 \
  --SourceCidrIp 0.0.0.0/0 \
  --user-agent AlibabaCloud-Agent-Skills

1.5 Create ECS Instance

First, query the latest Ubuntu 22.04 system image ID in the target region:

aliyun ecs DescribeImages \
  --RegionId ${region} \
  --OSType linux \
  --ImageOwnerAlias system \
  --ImageName "ubuntu_22_04*" \
  --Status Available \
  --PageSize 1 \
  --user-agent AlibabaCloud-Agent-Skills

Get the latest ImageId from the result, then create the instance (note: do not set InternetMaxBandwidthOut; public network access will be configured via EIP later):

aliyun ecs RunInstances \
  --RegionId ${region} \
  --InstanceType ${instance_type} \
  --ImageId ${image_id} \
  --SecurityGroupId ${security_group_id} \
  --VSwitchId ${vswitch_id} \
  --SystemDisk.Category cloud_essd \
  --SystemDisk.Size 40 \
  --InstanceChargeType PostPaid \
  --InstanceName openclaw-server \
  --Amount 1 \
  --user-agent AlibabaCloud-Agent-Skills

1.6 Configure Public Network Access (EIP)

Create an Elastic IP Address and bind it to the ECS instance with 100 Mbps bandwidth (OpenClaw installation requires downloading many npm packages):

# Create EIP (100 Mbps bandwidth)
aliyun vpc AllocateEipAddress \
  --RegionId ${region} \
  --Bandwidth 100 \
  --InternetChargeType PayByTraffic \
  --user-agent AlibabaCloud-Agent-Skills

# Bind EIP to ECS instance
aliyun vpc AssociateEipAddress \
  --RegionId ${region} \
  --AllocationId ${eip_allocation_id} \
  --InstanceId ${instance_id} \
  --InstanceType EcsInstance \
  --user-agent AlibabaCloud-Agent-Skills

Record the EIP address for subsequent SSH connections and Cloud Assistant command execution.

1.7 Start Instance and Wait for Running State

# Start instance
aliyun ecs StartInstance \
  --InstanceId ${instance_id} \
  --user-agent AlibabaCloud-Agent-Skills

# Query instance status, confirm it is Running
aliyun ecs DescribeInstances \
  --RegionId ${region} \
  --InstanceIds '["${instance_id}"]' \
  --user-agent AlibabaCloud-Agent-Skills

---

Step 2: Obtain Bailian API Key via CLI

Use the aliyun modelstudio CLI plugin to automatically retrieve or create a Bailian API Key, eliminating the need for manual console operations.

2.1 Install the Model Studio CLI Plugin

The aliyun modelstudio commands require the aliyun-cli-modelstudio plugin:

aliyun plugin install --names aliyun-cli-modelstudio \
  --user-agent AlibabaCloud-Agent-Skills

2.2 List Workspaces (must run first)

`workspace-id` is a required parameter for CreateApiKey, so you must obtain it via ListWorkspaces first. Every Alibaba Cloud account with Bailian activated has a default workspace:

aliyun modelstudio list-workspaces \
  --user-agent AlibabaCloud-Agent-Skills

Record the WorkspaceId from the result as ${workspace_id}. If the result is empty (no workspaces), the user has not activated the Bailian service yet — guide them to activate it at the Bailian Console.

2.3 Create API Key

Create a new API Key using the ${workspace_id}:

aliyun modelstudio create-api-key \
  --workspace-id ${workspace_id} \
  --description "OpenClaw deployment API Key" \
  --user-agent AlibabaCloud-Agent-Skills

Record the ApiKeyValue (in sk-xxx format) from the response as ${bailian_api_key}.

Important: The full API Key value is only returned at creation time. list-api-keys always returns masked values (sk-***), so it cannot be used to retrieve a usable key. Make sure to record the complete key here. If the key is lost, delete the old one and create a new one.

---

Step 3: Install Base Environment via Cloud Assistant

Use Alibaba Cloud Cloud Assistant to remotely execute commands on the ECS instance without manual SSH connection.

Combine Git installation, Node.js 22.x installation, and npm China mirror configuration into a single command to reduce waiting time:

aliyun ecs RunCommand \
  --RegionId ${region} \
  --Type RunShellScript \
  --CommandContent "apt-get update -y && apt-get install -y git curl wget && curl -fsSL --connect-timeout 30 --max-time 300 https://deb.nodesource.com/setup_22.x | bash - && apt-get install -y nodejs && npm config set registry https://registry.npmmirror.com && node -v && npm -v" \
  --InstanceId.1 ${instance_id} \
  --Timeout 600 \
  --user-agent AlibabaCloud-Agent-Skills

Use DescribeInvocations to query the command execution result and confirm success:

aliyun ecs DescribeInvocations \
  --RegionId ${region} \
  --InvokeId ${invoke_id} \
  --user-agent AlibabaCloud-Agent-Skills

Confirm Node.js version is v22.x.x in the output.

Polling tip: This command typically takes 2-5 minutes to complete. When querying DescribeInvocations, poll every 15-30 seconds to avoid excessive polling. The command is finished when InvocationStatus changes from Running to Success or Failed.

---

Step 4: One-Click OpenClaw Installation

Use the installation script to complete OpenClaw setup, Bailian API configuration, and DingTalk plugin installation.

Security: Sensitive parameters are passed via base64 encoding to prevent command injection.

# Encode sensitive parameters
BAILIAN_KEY_B64=$(echo -n "${bailian_api_key}" | base64)
DINGTALK_ID_B64=$(echo -n "${dingtalk_client_id}" | base64)
DINGTALK_SECRET_B64=$(echo -n "${dingtalk_client_secret}" | base64)

aliyun ecs RunCommand \
  --RegionId ${region} \
  --Type RunShellScript \
  --CommandContent "curl -fsSL --connect-timeout 30 --max-time 300 https://openclaw-install-scripts.oss-cn-hangzhou.aliyuncs.com/install.sh -o /tmp/openclaw-install.sh && BAILIAN_API_KEY=\$(echo '${BAILIAN_KEY_B64}' | base64 -d) DINGTALK_CLIENT_ID=\$(echo '${DINGTALK_ID_B64}' | base64 -d) DINGTALK_CLIENT_SECRET=\$(echo '${DINGTALK_SECRET_B64}' | base64 -d) bash /tmp/openclaw-install.sh --api-key \"\$BAILIAN_API_KEY\" --api-region '${region}' --dingtalk-client-id \"\$DINGTALK_CLIENT_ID\" --dingtalk-client-secret \"\$DINGTALK_CLIENT_SECRET\"" \
  --InstanceId.1 ${instance_id} \
  --Timeout 600 \
  --user-agent AlibabaCloud-Agent-Skills

The script auto-completes: OpenClaw npm install, Bailian API config, DingTalk plugin install, gateway startup. Query DescribeInvocations to confirm Gateway started (poll every 30s, 3-8 min).

---

Step 5: Acceptance Testing

5.1 Verify Gateway Status

aliyun ecs RunCommand \
  --RegionId ${region} \
  --Type RunShellScript \
  --CommandContent "openclaw gateway status" \
  --InstanceId.1 ${instance_id} \
  --Timeout 60 \
  --user-agent AlibabaCloud-Agent-Skills

Confirm the gateway status is running and the DingTalk channel plugin is loaded.

5.2 Test in DingTalk

Guide the user: 1. Confirm they have completed app creation, permission configuration, publishing, and added the bot to a group per the DingTalk App Setup Guide 2. In the DingTalk group where the bot was added, @mention the bot and send a message (e.g., "Hello, please introduce yourself") 3. Wait for the bot to reply

Acceptance criteria: The bot replies normally in the DingTalk group with content generated by the Bailian LLM. This confirms successful deployment.

5.3 Deployment Completion Report

After confirming all components are running normally, provide the user with a deployment summary:

• ECS instance ID and EIP public IP
• OpenClaw version and service status
• Bailian model configuration (model name, API endpoint)
• DingTalk app name and bot status
• Cost information

---

Resource Cleanup

Warning: Resource deletion is irreversible. Always confirm with user before executing.

Pre-Deletion Checks

Before deletion, prompt user: "The following resources will be permanently deleted: ${instance_id}, ${eip_allocation_id}, ${security_group_id}, ${vswitch_id}, ${vpc_id}. This action is irreversible. Confirm with 'yes' to continue."

Only proceed after explicit "yes" confirmation.

Deletion Sequence

Delete in dependency order (instance → EIP → security group → VSwitch → VPC):

# 1. Stop instance if running, then delete
aliyun ecs StopInstance --InstanceId ${instance_id} --user-agent AlibabaCloud-Agent-Skills
# Poll DescribeInstances until Status='Stopped'
aliyun ecs DeleteInstance --InstanceId ${instance_id} --user-agent AlibabaCloud-Agent-Skills

# 2. Release EIP (after confirming unassociated)
aliyun vpc ReleaseEipAddress --RegionId ${region} --AllocationId ${eip_allocation_id} --user-agent AlibabaCloud-Agent-Skills

# 3. Delete security group (after confirming no instances)
aliyun ecs DeleteSecurityGroup --RegionId ${region} --SecurityGroupId ${security_group_id} --user-agent AlibabaCloud-Agent-Skills

# 4. Delete VSwitch then VPC (after confirming empty)
aliyun vpc DeleteVSwitch --VSwitchId ${vswitch_id} --user-agent AlibabaCloud-Agent-Skills
aliyun vpc DeleteVpc --VpcId ${vpc_id} --user-agent AlibabaCloud-Agent-Skills

Cost Impact

• ECS instance: 2 vCPU 4 GB (ecs.c6.large) pay-as-you-go, approximately 0.3-0.5 CNY/hour (subject to actual console pricing)
• EIP bandwidth: 100 Mbps pay-by-traffic
• Bailian model calls: New users have a free quota; charges apply per token usage after exceeding the quota

Note: The above costs are for reference only. Please refer to the actual pricing and bills shown in the Alibaba Cloud console.

Common Troubleshooting

Reference Links

Bailian API Key Guide

1. Activate Bailian Service

1. Log in to the Bailian Console 2. If not activated, follow the on-screen prompts to activate the Model Studio (Bailian) service 3. New users may enjoy a free token quota (specific quota and validity period subject to the latest official promotions)

2. Obtain an API Key via CLI

The Bailian API Key can be fully obtained via aliyun modelstudio CLI commands — no console operation needed.

2.1 Install Model Studio CLI Plugin

aliyun plugin install --names aliyun-cli-modelstudio

2.2 List Workspaces (must run first)

workspace-id is a required parameter for creating API Keys, so you must obtain it first:

aliyun modelstudio list-workspaces

Record the WorkspaceId from the result (e.g., ws-xxxxxxxx).

2.3 Create a New API Key

Use the workspace-id obtained in the previous step:

aliyun modelstudio create-api-key --workspace-id ${workspace_id} --description "My API Key"

Record the ApiKeyValue (in sk-xxx format) from the response. The full API Key value is only returned at creation time — list-api-keys always returns masked values (sk-***), so it cannot be used to retrieve a usable key. If you lose the key, delete the old one and create a new one.

DingTalk Bot Creation and Configuration Guide

Reference: https://open.dingtalk.com/document/dingstart/build-dingtalk-ai-employees

1. One-Click Create OpenClaw Bot

1.1 Log in to Developer Console

1. Visit the DingTalk Developer Console and log in by scanning the QR code with DingTalk 2. Select an organization where you have developer permissions 3. If no organization is available, create a new one using the DingTalk mobile app

1.2 Create Bot

1. Under "App Development", click Create Now to one-click create an OpenClaw bot 2. In the "Create OpenClaw" dialog, fill in the bot info (name, description, icon), or use the defaults directly 3. Click OK

1.3 Obtain Client ID and Client Secret

After successful creation, the Client ID and Client Secret are displayed automatically. Save them for later use.

Security reminder: Client ID and Client Secret are core credentials of the app. Keep them secure and never share them.

You can also find them later in the app's "Credentials & Basic Info" page.

Important: The auto-created OpenClaw bot comes with the following permissions pre-granted — no manual application needed:

- Card.Streaming.Write — AI Card streaming update

- Card.Instance.Write — Interactive card instance write

- qyapi_robot_sendmsg — Internal bot send message

2.How Use the DingTalk Bot

Option A: Direct Chat

1. In the DingTalk search bar at the top, search for the bot name 2. Send a message to start chatting with the bot

Option B: Group Chat

1. Open any DingTalk group chat (ensure the group's organization matches the bot's organization) 2. Go to Group Settings (top right) > Bots 3. Click Add Bot, search for your bot name, and add it 4. @mention the bot in the group to interact

Note: Only published bots can be found when adding to a group. Make sure the app version is published first.

Troubleshooting

If the bot does not respond to messages, check:

1. Confirm the OpenClaw DingTalk plugin is installed (openclaw plugins install @dingtalk-real-ai/dingtalk-connector) 2. Verify Client ID and Client Secret are configured correctly 3. Confirm permissions Card.Streaming.Write, Card.Instance.Write, and qyapi_robot_sendmsg are granted 4. Check that the bot message receiving address is correctly configured 5. Ensure port 18789 is open on the server 6. Ensure the app version is published

Bot not found when adding to group?

1. The group's organization may differ from the bot's organization — use the correct group 2. The group may not be an internal group — convert it to an internal group

RAM Policies for OpenClaw ECS DingTalk Deployment

This document lists all RAM permissions required for deploying OpenClaw on Alibaba Cloud ECS with DingTalk integration.

Required RAM Permissions

Overview

This skill requires permissions across multiple Alibaba Cloud products:

• ECS: Instance, security group, and image management
• VPC: Virtual network and VSwitch management
• VPC (EIP): Elastic IP address management
• STS: Identity verification
• Model Studio (Bailian): Workspace and API Key management for Bailian LLM service

System Policies (Not Recommended for Production)

Warning: These FullAccess policies grant broad permissions that exceed the minimum required for this Skill. Using them in production environments violates the principle of least privilege. For production use, please use the custom policy in the "Detailed API-Level Permissions" section below.

Detailed API-Level Permissions (Recommended)

For production environments following the least-privilege principle, create a custom policy with these specific permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeAvailableResource",
        "ecs:DescribeImages",
        "ecs:RunInstances",
        "ecs:StartInstance",
        "ecs:DescribeInstances",
        "ecs:DeleteInstance",
        "ecs:CreateSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:RunCommand",
        "ecs:DescribeInvocations"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "vpc:CreateVpc",
        "vpc:CreateVSwitch",
        "vpc:DeleteVpc",
        "vpc:DeleteVSwitch",
        "vpc:AllocateEipAddress",
        "vpc:AssociateEipAddress",
        "vpc:ReleaseEipAddress"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "modelstudio:ListWorkspaces",
        "modelstudio:ListApiKeys",
        "modelstudio:CreateApiKey"
      ],
      "Resource": "*"
    }
  ]
}

Permission Details by Step

Step 1: ECS Instance Creation

Step 2: Bailian API Key Retrieval

Step 3: Cloud Assistant Commands

Resource Cleanup

How to Attach Policies

Option 1: Creating Custom Policy (Recommended - Least Privilege)

1. Log in to RAM Console 2. Navigate to Permissions > Policies 3. Click Create Policy 4. Select Script mode 5. Copy and paste the JSON policy from "Detailed API-Level Permissions" section above 6. Name the policy: OpenClawDeploymentPolicy 7. Click OK to create 8. Navigate to Identities > Users 9. Find your RAM user and click Add Permissions 10. Select Custom Policy and choose OpenClawDeploymentPolicy 11. Click OK to attach

Option 2: Using System Policies (Not Recommended for Production)

Warning: This option uses FullAccess policies that grant more permissions than necessary. Only use this for quick testing or development environments, not for production.

1. Log in to RAM Console 2. Navigate to Identities > Users 3. Find your RAM user and click Add Permissions 4. Select the following policies:

• AliyunECSFullAccess
• AliyunVPCFullAccess
• AliyunEIPFullAccess
• AliyunSTSAssumeRoleAccess

5. Click OK to attach

Permission Verification

After attaching permissions, verify access using the CLI:

# Verify STS access
aliyun sts get-caller-identity --user-agent AlibabaCloud-Agent-Skills

# Verify ECS access
aliyun ecs describe-regions --user-agent AlibabaCloud-Agent-Skills

# Verify VPC access
aliyun vpc describe-vpcs --region-id cn-hangzhou --user-agent AlibabaCloud-Agent-Skills

If any command returns a Forbidden error, the corresponding permission is missing.

Common Permission Errors

Security Best Practices

1. Use RAM users instead of root account: Never use the Alibaba Cloud root account for API access 2. Apply least privilege principle: Use custom policies instead of FullAccess policies in production 3. Rotate access keys regularly: Change access keys every 90 days 4. Enable MFA: Add multi-factor authentication to RAM users 5. Audit API calls: Enable ActionTrail to track all API operations 6. Scope permissions by resource: Use resource-level permissions when possible (requires ARN specification)

Additional Resources

• RAM Policy Syntax
• ECS API Permissions
• VPC API Permissions
• RAM Console