Alibabacloud Pai Dsw Manage

PAI DSW Instance Management

Manage the full lifecycle of Alibaba Cloud PAI DSW (Data Science Workshop) instances — from provisioning through configuration changes, status monitoring, and start/stop operations. Also supports querying available ECS compute specs.

Architecture: PAI Workspace + DSW Instance + ECS Spec + Image + VPC + Dataset

API Version: pai-dsw/2022-01-01

---

Installation

Pre-check: Aliyun CLI >= 3.3.3 required

>

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update,

or see `references/cli-installation-guide.md` for installation instructions.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.

# macOS (recommended)
brew install aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

# Enable automatic plugin installation
aliyun configure set --auto-plugin-install true

# Update existing plugins
aliyun plugin update

# Install pai-dsw plugin
aliyun plugin install --names pai-dsw

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

---

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in a terminal or environment variables in a shell profile)

3. Return and retry after aliyun configure list shows a valid profile

---

RAM Permissions

See `references/ram-policies.md` for the complete permission list and minimum-privilege policy.

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

1. Read references/ram-policies.md to get the full list of permissions required by this skill

2. Use the ram-permission-diagnose skill to guide the user through requesting the necessary permissions

3. Pause and wait until the user confirms that the required permissions have been granted

---

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks, passwords, domain names, resource specifications, etc.) MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

How to get WorkspaceId: If the user doesn't know their workspace ID, run:

```bash

aliyun aiworkspace list-workspaces --region <region> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

```

This returns all workspaces the user has access to. Select the appropriate one based on WorkspaceName or ask the user to confirm.

>

Reference: Create and Manage Workspaces

---

Core Workflow

Full command syntax and parameter details: `references/related-commands.md`.

1. Query Available ECS Specs

Run aliyun pai-dsw list-ecs-specs --accelerator-type <CPU|GPU> --region <region> to list available compute specs.

[MUST] Region confirmation: The --region parameter is required. Spec availability varies by region — always confirm the region with the user before querying.

[MUST] Determine accelerator type correctly:

- User mentions a spec name (e.g., ecs.hfc6.10xlarge): Query BOTH CPU and GPU types, then match InstanceType in results. Use the returned AcceleratorType field to confirm the classification.

- User specifies image type: GPU image URL (contains -gpu- or cu) → query GPU specs; CPU image URL → query CPU specs.

- User describes use case only: GPU for 大模型训练/深度学习, CPU for 数据分析/轻量任务. Always confirm with user if ambiguous.

- [IMPORTANT] Do NOT guess from spec name prefix — the naming convention is unreliable. Always verify via API response.

[MUST] Choose accelerator type based on user requirements:

- Default recommendation: GPU for 大模型训练/深度学习, CPU for 数据分析/轻量任务

- Match image type (strong indicator): If user specifies a GPU image URL (contains -gpu- or cu), query GPU specs. If CPU image, query CPU specs.

- Spec name requires verification: If user mentions a spec name, query both types and find the match in results

- Always confirm with user before querying if the use case is ambiguous and no spec name is provided

Key response fields:

• InstanceType: Spec name (e.g., ecs.hfc6.10xlarge)
• AcceleratorType: CPU or GPU — the actual classification from API
• IsAvailable: PRIMARY indicator — true means the spec is available for pay-as-you-go/subscription
• SpotStockStatus: SECONDARY indicator — only for spot instances: WithStock (available) or NoStock (unavailable)
• CPU / Memory / GPU / GPUType: Hardware details
• Price: Hourly price in CNY

[MUST] Availability check logic:

- For pay-as-you-go/subscription: Check IsAvailable == true

- For spot instances: Check IsAvailable == true AND SpotStockStatus == "WithStock"

- DO NOT use SpotStockStatus alone to judge availability — many specs have IsAvailable: true but SpotStockStatus: "NoStock"

- Example: ecs.hfc6.10xlarge with IsAvailable: true, SpotStockStatus: "NoStock" → Available for pay-as-you-go

2. Create Instance (check-then-act)

[MUST] Idempotency guarantee: The CreateInstance API does not support ClientToken, so idempotency is ensured via a check-then-act pattern. Before creating, you must call list-instances --instance-name <name> to check if the name already exists.

Step 2.1 — Check existence

aliyun pai-dsw list-instances \
  --instance-name <name> \
  --region <region> \
  --resource-id ALL \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Decision logic:

• TotalCount == 0 → Name is available, proceed to Step 2.2 to create
• TotalCount >= 1 → [MUST] Verify exact name match:

1. Iterate through the returned Instances array 2. For each instance, compare its InstanceName field with the target name character by character (case-sensitive, exact string match) 3. Exact match found (instance.InstanceName === targetName) → Name already exists:

• Extract the InstanceId from the matching instance
• Call get-instance --instance-id <id> to get full details
• Compare key parameters (EcsSpec, ImageUrl, Accessibility, etc.)
• Match → Return the existing InstanceId, do not recreate
• Mismatch → Ask user to choose a different name

4. No exact match found (no instance has InstanceName === targetName) → Name is available, proceed to Step 2.2 to create

[WARNING] Critical: Exact name match required

>

The --instance-name filter may return partial matches. For example:

- Query: --instance-name llm_train_001

- Response may include: llm_train_001, llm_train_001_v2, llm_train_001_backup

>

You MUST verify exact match by checking:

```

for instance in response.Instances:

if instance.InstanceName == targetName: # EXACT string equality

# Name already exists - DO NOT create

```

>

Do NOT assume name is available just because TotalCount > 0 but you "think" no exact match. If TotalCount >= 1, carefully check each instance's InstanceName field.

Step 2.2 — Provision

Run aliyun pai-dsw create-instance with required args: --workspace-id, --instance-name, --ecs-spec, --region, and either --image-url or --image-id.

[MUST] Region confirmation: The --region parameter is required and must be confirmed with the user. Do NOT use CLI default region without explicit user approval. Spec availability and pricing vary by region.

[MUST] Match EcsSpec with image type:

- GPU image URL (contains -gpu- or cu) → Must select a GPU spec (e.g., ecs.gn6v-c4g1.xlarge)

- CPU image URL (contains -cpu-) → Must select a CPU spec (e.g., ecs.c6.large)

- The spec type MUST match the image type, otherwise the instance will fail to start

- Use case (大模型训练/数据分析) is only a recommendation, image type is the definitive indicator

Dataset mounting (optional): If the user specifies a dataset to mount, use the --datasets parameter in CLI list format:

```bash

--datasets DatasetId=<dataset-id> MountPath=<mount-path> MountAccess=RO

```

[MUST] Dataset parameters require explicit user confirmation — do NOT assume or auto-generate dataset configurations.

>

Official images: `references/common-images.md`.

>

Advanced usage (VPC, datasets): `references/related-commands.md`.

Response: {"InstanceId": "dsw-xxxxx", ...}

[IMPORTANT] Return immediately after creation: After create-instance returns InstanceId, do NOT block waiting for `Running` status. Instead:

1. Return the InstanceId and current status (Creating) to the user immediately

2. Provide the user with a command to check status later:

```bash

aliyun pai-dsw get-instance --instance-id <instance-id> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

```

3. Inform the user that instance startup typically takes 2–5 minutes

>

Why this matters: Blocking polling prevents the agent from responding to other user requests. DSW instance creation is a long-running operation; the agent should return control to the user promptly.

3. List Instances

Run aliyun pai-dsw list-instances. Filter by --workspace-id or --status; paginate with --page-number / --page-size.

4. Get Instance Details

Run aliyun pai-dsw get-instance --instance-id <id> to check instance status and details.

When to poll: Only poll when the user explicitly asks to wait for a status change (e.g., "wait until it's running"). Otherwise, return the current status immediately.

>

Timeout limits: Maximum 60 polls (30 minutes total). If exceeded, stop and prompt user to check manually.

>

Polling interval: 10–30 seconds between calls.

>

CLI timeout: For long-running operations, increase read timeout:

```bash

aliyun pai-dsw get-instance --instance-id <id> --read-timeout 30 --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

```

>

Once Status == "Running", access the instance via InstanceUrl.

>

For complete status transitions, see Instance Status Values in `references/related-commands.md`.

5. Stop Instance

Run aliyun pai-dsw stop-instance --instance-id <id>.

Status transition: Running → Stopping → Stopped

>

Save environment image: To save the environment as a custom image before stopping, use the PAI Console. See Create a DSW Instance Image for instructions.

6. Update Instance

Run aliyun pai-dsw update-instance --instance-id <id> to modify --instance-name, --ecs-spec, --image-id, --accessibility, --datasets, etc.

[MUST] Before updating:

1. Call get-instance to check current status and configuration

2. Check if update is needed:

- For --ecs-spec: Compare current EcsSpec with target spec. If already equal, skip update and inform user

- For --image-id/--image-url: Compare current ImageId/ImageUrl with target

- For --instance-name: Compare current InstanceName with target

3. If already at target configuration, return current instance info — do not call update-instance

4. If update is needed, use --start-instance true to auto-start after update

>

[IMPORTANT] Always update the specified instance by its InstanceId. Do NOT substitute with another instance that already has the target spec — the user's request is to upgrade the specific instance, not to find an alternative.

7. Start Instance

Run aliyun pai-dsw start-instance --instance-id <id>, then poll (Step 4) until Running.

Prerequisite: Instance must be in Stopped or Failed state. Call get-instance to confirm before starting.

---

Success Verification

Full verification steps: `references/verification-method.md`.

Quick check: get-instance should return Status == "Running" with a non-empty InstanceUrl.

---

Cleanup

This skill does not expose instance deletion (irreversible operation — use the console).

>

To stop incurring charges, stop the instance via Step 5 (stop-instance).

---

Best Practices

1. Always run check-then-act before creation — use list-instances --instance-name <name> to avoid duplicate-instance errors. 2. Prefer `PRIVATE` visibility — prevents accidental operations by other workspace users. 3. Check instance status before update — call get-instance first; some parameters require Stopped state, others can be updated while Running. 4. Use `--resource-id ALL` with `list-instances` — the default only returns post-paid instances. 5. Observe polling timeout limits — see Step 4 for timeout and interval guidance. 6. Verify spec availability before provisioning — run list-ecs-specs to confirm the spec is available in the target region. 7. Tag instances with Labels — simplifies batch queries and lifecycle management.

---

References

Acceptance Criteria: alibabacloud-pai-dsw-manage

Scenario: PAI DSW Instance Lifecycle Management Purpose: Test acceptance criteria for the skill

---

1. Get Workspace ID (Required for CreateInstance)

See SKILL.md "Parameter Confirmation" section for WorkspaceId requirements and list-workspaces command.

✅ CORRECT

aliyun aiworkspace list-workspaces \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Assuming workspace ID without confirming with user
aliyun pai-dsw create-instance --workspace-id 12345 ...
# WRONG: Must confirm workspace with user first

---

2. Product Name

✅ CORRECT

aliyun pai-dsw create-instance ...
aliyun pai-dsw list-instances ...
aliyun pai-dsw get-instance ...

❌ INCORRECT

aliyun paidsw CreateInstance ...   # Traditional API format
aliyun pai_dsw create-instance ... # Underscore in product name
aliyun PAI-DSW create-instance ... # Uppercase

---

3. Command Format (kebab-case)

✅ CORRECT

aliyun pai-dsw create-instance
aliyun pai-dsw update-instance
aliyun pai-dsw get-instance
aliyun pai-dsw list-instances
aliyun pai-dsw list-ecs-specs
aliyun pai-dsw start-instance
aliyun pai-dsw stop-instance

❌ INCORRECT

aliyun pai-dsw CreateInstance     # PascalCase (traditional API)
aliyun pai-dsw createinstance     # No separator
aliyun pai-dsw create_instance    # Underscore separator

---

4. Parameter Names

Check Instance Existence (before CreateInstance)

✅ CORRECT

# Step 1: Query by instance name
aliyun pai-dsw list-instances \
  --instance-name my_instance \
  --region cn-shanghai \
  --resource-id ALL \
  --user-agent AlibabaCloud-Agent-Skills

# Step 2: Verify exact name match in response
# Parse the JSON response and check EACH instance:
#
# Response example:
# {
#   "TotalCount": 3,
#   "Instances": [
#     {"InstanceName": "my_instance_v2", "InstanceId": "dsw-xxx"},
#     {"InstanceName": "my_instance_backup", "InstanceId": "dsw-yyy"},
#     {"InstanceName": "my_instance", "InstanceId": "dsw-zzz"}  ← EXACT MATCH!
#   ]
# }
#
# Algorithm:
# found = false
# for instance in Instances:
#     if instance.InstanceName == "my_instance":  # EXACT string equality
#         found = true
#         break
#
# if found:
#     # Name already exists - DO NOT create, return existing instance
# else:
#     # Name is available - proceed to create

❌ INCORRECT

# Wrong pattern 1: Relying solely on TotalCount > 0
if TotalCount > 0:
    print("Name already exists")  # May miss partial matches

# Wrong pattern 2: Assuming no exact match without checking
# Response: TotalCount=2, Instances=[{"InstanceName":"my_instance_v2"}, {"InstanceName":"my_instance"}]
# Agent incorrectly concludes: "ExactNameMatch: false"
# This is WRONG - must verify by iterating through ALL instances

# Wrong pattern 3: Not checking case-sensitivity
if instanceName.lower() == targetName.lower():  # WRONG - case sensitive comparison
    # DSW instance names are case-sensitive

[CRITICAL] Common failure pattern:

>

The --instance-name filter returns all instances whose name contains the query string.

>

Example failure scenario:

- Query: --instance-name llm_train_001

- Response: TotalCount: 1, Instances: [{InstanceName: "llm_train_001"}]

- Agent incorrectly reports: "ExactNameMatch: false, proceeding with creation"

- Result: CreateInstance returns HTTP 400 "instance name already exists"

>

Root cause: Agent did not properly compare instance.InstanceName === "llm_train_001".

CreateInstance

✅ CORRECT

# With image URL (recommended)
aliyun pai-dsw create-instance \
  --workspace-id 12345 \
  --instance-name my_instance \
  --ecs-spec ecs.g6.xlarge \
  --image-url dsw-registry-vpc.cn-shanghai.cr.aliyuncs.com/pai/modelscope:1.34.0-pytorch2.3.1-cpu-py311-ubuntu22.04 \
  --region cn-shanghai \
  --accessibility PRIVATE \
  --user-agent AlibabaCloud-Agent-Skills

# With image ID
aliyun pai-dsw create-instance \
  --workspace-id 12345 \
  --instance-name my_instance \
  --ecs-spec ecs.g6.xlarge \
  --image-id image-xxxxx \
  --region cn-shanghai \
  --accessibility PRIVATE \
  --user-agent AlibabaCloud-Agent-Skills

[IMPORTANT] Non-blocking creation: After create-instance returns InstanceId, immediately return the ID and status to the user. Do NOT block waiting for Running status. Instance startup takes 2–5 minutes; the agent should remain responsive.

❌ INCORRECT

# Blocking after creation (WRONG approach)
aliyun pai-dsw create-instance ...
# Then polling until Running - WRONG: Agent blocks and cannot respond to other requests

# Missing --region parameter
aliyun pai-dsw create-instance \
  --workspace-id 12345 \
  --instance-name my_instance \
  --ecs-spec ecs.g6.xlarge \
  --image-url <image-url>
  # WRONG: --region must be specified and confirmed with user

# Cannot specify both image-id and image-url
aliyun pai-dsw create-instance \
  --image-id image-xxxxx \
  --image-url dsw-registry-vpc.cn-shanghai.cr.aliyuncs.com/pai/xxx

# PascalCase parameter names
aliyun pai-dsw create-instance \
  --WorkspaceId 12345 \
  --InstanceName my_instance \
  --EcsSpec ecs.g6.xlarge

[IMPORTANT] Region is required: The --region parameter must be explicitly specified and confirmed with the user. Do NOT rely on CLI default region.

UpdateInstance

✅ CORRECT

# Step 1: Check current instance configuration
aliyun pai-dsw get-instance \
  --instance-id dsw-730xxxxxxxxxx \
  --user-agent AlibabaCloud-Agent-Skills
# Response: {"EcsSpec": "ecs.g7.xlarge", ...}

# Step 2: Compare with target and decide
# - If current.EcsSpec === targetSpec: Already at target, skip update
# - If current.EcsSpec !== targetSpec: Proceed with update

# Step 3a: Skip update (already at target)
# Return current instance info to user

# Step 3b: Update EcsSpec with auto-start (if change needed)
aliyun pai-dsw update-instance \
  --instance-id dsw-730xxxxxxxxxx \
  --ecs-spec ecs.g6.xlarge \
  --start-instance true \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Updating to the same spec (no actual change)
aliyun pai-dsw update-instance \
  --instance-id dsw-730xxxxxxxxxx \
  --ecs-spec ecs.g7.xlarge \  # Same as current, API returns 400
  --user-agent AlibabaCloud-Agent-Skills

aliyun pai-dsw update-instance \
  --id dsw-730xxxxxxxxxx \      # Wrong parameter name
  --name new_name               # Wrong parameter name

[IMPORTANT] Check before update: Calling update-instance with the same value as current configuration will cause API error (HTTP 400). Always compare current value with target value first and skip update if already at target.

StopInstance

✅ CORRECT

aliyun pai-dsw stop-instance \
  --instance-id dsw-730xxxxxxxxxx \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

aliyun pai-dsw stop-instance \
  --id dsw-730xxxxxxxxxx    # Wrong parameter name

Note: To save the environment as a custom image, use the PAI Console. See Create a DSW Instance Image.

StartInstance

✅ CORRECT

aliyun pai-dsw start-instance \
  --instance-id dsw-730xxxxxxxxxx \
  --user-agent AlibabaCloud-Agent-Skills

Prerequisite: Instance must be in Stopped or Failed state.

❌ INCORRECT

aliyun pai-dsw start-instance \
  --id dsw-730xxxxxxxxxx    # Wrong parameter name

ListInstances

✅ CORRECT

# List running instances with sorting by creation time (newest first)
aliyun pai-dsw list-instances \
  --workspace-id 512607 \
  --status Running \
  --page-number 1 \
  --page-size 20 \
  --sort-by GmtCreateTime \
  --order DESC \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Using only --sort-by without --order (causes API validation error)
aliyun pai-dsw list-instances \
  --status Running \
  --sort-by GmtCreateTime \
  --user-agent AlibabaCloud-Agent-Skills

# Using only --order without --sort-by (causes API validation error)
aliyun pai-dsw list-instances \
  --status Running \
  --order DESC \
  --user-agent AlibabaCloud-Agent-Skills

[IMPORTANT] Sorting parameters: --sort-by and --order must be used together. Using only one will cause API validation error.

ListEcsSpecs

[MUST] Choose accelerator type based on user requirements:

- Default recommendation: GPU for 大模型训练/深度学习, CPU for 数据分析/轻量任务

- Match image type (strong indicator): GPU image URL (contains -gpu- or cu) → GPU specs

- Always confirm with user if the use case is ambiguous

✅ CORRECT

# User specified GPU image URL → query GPU specs
aliyun pai-dsw list-ecs-specs \
  --accelerator-type GPU \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

# User specified CPU image URL → query CPU specs
aliyun pai-dsw list-ecs-specs \
  --accelerator-type CPU \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# User specified GPU image but queried CPU specs
aliyun pai-dsw list-ecs-specs \
  --accelerator-type CPU \
  --region cn-hangzhou
  # WRONG: User specified GPU image URL (contains -gpu-), must use GPU

# Missing --region parameter
aliyun pai-dsw list-ecs-specs \
  --accelerator-type CPU
  # WRONG: --region must be specified and confirmed with user

# Missing required --accelerator-type
aliyun pai-dsw list-ecs-specs --user-agent AlibabaCloud-Agent-Skills

# PascalCase parameter
aliyun pai-dsw list-ecs-specs --AcceleratorType CPU

# Lowercase enum value
aliyun pai-dsw list-ecs-specs --accelerator-type cpu

# Traditional API format
aliyun pai-dsw ListEcsSpecs --accelerator-type CPU

Enum Constraints

---

5. User-Agent Flag

✅ CORRECT

aliyun pai-dsw get-instance \
  --instance-id dsw-730xxxxxxxxxx \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

aliyun pai-dsw get-instance --instance-id dsw-730xxxxxxxxxx
# Missing --user-agent

---

6. Parameter Value Formats

InstanceId

InstanceName

Accessibility

JSON Parameters (UserVpc)

✅ CORRECT

--user-vpc '{"VpcId":"vpc-xxx","VSwitchId":"vsw-xxx","SecurityGroupId":"sg-xxx"}'

❌ INCORRECT

--user-vpc vpc-xxx    # Must be a JSON object
--user-vpc '{"vpc_id":"vpc-xxx","vswitch_id":"vsw-xxx"}'  # Wrong: snake_case field names

Dataset Mount Parameters

[MUST] User confirmation required: The --datasets parameter requires explicit user confirmation. Do NOT assume or auto-generate dataset configurations.

✅ CORRECT

# Use CLI list format (NOT JSON array)
--datasets DatasetId=d-xxx MountPath=/mnt/data MountAccess=RO

❌ INCORRECT

--datasets '[{"dataset_id":"d-xxx","mount_path":"/mnt/data","mount_access":"RO"}]'  # Wrong: JSON format
--datasets DatasetId=d-xxx MountPath=/mnt/data MountAccess=ro  # Wrong: MountAccess must be uppercase
--datasets d-xxx      # Wrong: Must use key=value format

---

7. Non-Blocking Workflow (IMPORTANT)

Problem: DSW instance creation takes 2–5 minutes. If the agent blocks waiting for Running status, it cannot respond to other user requests during this time.

>

Solution: Return immediately after creation, let the user check status later.

✅ CORRECT: Non-blocking Creation Flow

User: "Create a DSW instance..."

Agent: 1. Call list-workspaces (if needed)
       2. Call list-ecs-specs to show available specs
       3. Call create-instance
       4. Immediately return:
          "Instance created!
           InstanceId: dsw-xxx
           Current Status: Creating

           Instance startup typically takes 2–5 minutes. Run this command to check status:
           aliyun pai-dsw get-instance --instance-id dsw-xxx --user-agent AlibabaCloud-Agent-Skills"

❌ INCORRECT: Blocking Flow

User: "Create a DSW instance..."

Agent: 1. Call create-instance
       2. Start polling get-instance every 10 seconds...
       3. [BLOCKED - cannot respond to other requests]
       4. ... waiting ...
       5. ... waiting ...
       6. Finally return after 3 minutes
          "Instance is Running, access URL: ..."

When to Poll

---

Manual Verification Only

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open a new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority — overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "China (Hangzhou)"
      }
    ]
  },
  "RequestId": "xxx-xxx-xxx"
}

Note: Response may include additional regions.

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound — Wrong Access Key ID
• SignatureDoesNotMatch — Wrong Access Key Secret
• InvalidSecurityToken.Expired — STS token expired (for StsToken mode)
• Forbidden.RAM — Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

Common Images — alibabacloud-pai-dsw-manage

Official preset images for PAI DSW. Pass the image URL via --image-url when creating an instance.

The pai-dsw CLI plugin has no list-images subcommand. Browse the full catalog on the PAI Console during instance creation, or use the images listed below. Versions are updated regularly — verify the latest in the console.

---

URL Format

dsw-registry-vpc.{region}.cr.aliyuncs.com/pai/{framework}:{tag}

Tag format: {version}-pytorch{ver}-{cpu|gpu}-py{pyVer}[-cu{cudaVer}]-ubuntu{ver}

---

CPU Images

GPU Images

---

Usage

1. Replace the region — match the {region} segment to your workspace location. 2. Match CPU/GPU — use cpu images for CPU specs and gpu images for GPU specs. 3. Choose one image parameter:

• --image-url — direct URL (official presets or custom ACR images)
• --image-id — PAI-assigned image ID (e.g., image-xxxxx), from the console

4. Custom ACR images — use a private registry URL and supply --image-auth (base64-encoded credentials).

Not Available via CLI

• List images — no list-images subcommand. Use the PAI Console > Create Instance page.
• Image metadata — framework version, Python version, CUDA version, etc. are not queryable via CLI.

RAM Policies — alibabacloud-pai-dsw-manage

RAM permissions required for all PAI DSW APIs used by this skill.

Permission List

Minimum-Privilege Policy

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "paidsw:CreateInstance",
        "paidsw:UpdatePostPaidInstance",
        "paidsw:GetInstance",
        "paidsw:ListInstances",
        "paidsw:ListEcsSpecs",
        "paidsw:StartInstance",
        "paidsw:StopInstance"
      ],
      "Resource": "*"
    }
  ]
}

Notes

1. CreateInstance authorization undocumented — The official docs state "no authorization info available." The inferred Action is paidsw:CreateInstance. If permission is denied:

• Try paidsw:CreateInstance first.
• Contact Alibaba Cloud support to confirm the canonical Action name.
• This cannot be auto-verified — confirm manually in the RAM console.

2. Workspace operations (e.g., resolving WorkspaceId) require additional permissions:

• aiworkspace:ListWorkspaces
• aiworkspace:GetWorkspace

3. Dataset mounting requires additional permissions:

• paidataset:ListDatasets
• paidataset:GetDataset

Note: Dataset mounting is optional and requires explicit user confirmation. Do NOT assume or auto-generate dataset configurations.

Links

• RAM Console
• PAI DSW API Overview

Related CLI Commands — alibabacloud-pai-dsw-manage

All PAI DSW instance management commands in plugin mode (kebab-case).

Every command must include --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Workspace Commands

# List all workspaces in a region
aliyun aiworkspace list-workspaces \
  --region <region> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# With verbose output (shows full details)
aliyun aiworkspace list-workspaces \
  --region <region> \
  --verbose true \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

See SKILL.md "Parameter Confirmation" for WorkspaceId requirements.

---

Instance Lifecycle Commands

---

Command Examples

Check Instance Existence

Use list-instances --instance-name <name> to check if an instance exists.

>

[WARNING] The --instance-name filter may return partial matches. See SKILL.md "Exact name match required" for details.

aliyun pai-dsw list-instances \
  --instance-name <instance-name> \
  --region <region> \
  --resource-id ALL \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

---

CreateInstance

# With image URL (recommended — official preset images)
aliyun pai-dsw create-instance \
  --workspace-id <workspace-id> \
  --instance-name <instance-name> \
  --ecs-spec <ecs-spec> \
  --image-url <image-url> \
  --region <region> \
  --accessibility PRIVATE \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# With image ID
aliyun pai-dsw create-instance \
  --workspace-id <workspace-id> \
  --instance-name <instance-name> \
  --ecs-spec <ecs-spec> \
  --image-id <image-id> \
  --region <region> \
  --accessibility PRIVATE \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# With VPC configuration
aliyun pai-dsw create-instance \
  --workspace-id <workspace-id> \
  --instance-name <instance-name> \
  --ecs-spec <ecs-spec> \
  --image-url <image-url> \
  --region <region> \
  --user-vpc '{"VpcId":"<vpc-id>","VSwitchId":"<vswitch-id>","SecurityGroupId":"<sg-id>","ExtendedCIDRs":["<cidr>"]}' \
  --accessibility PRIVATE \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# With dataset mounts
aliyun pai-dsw create-instance \
  --workspace-id <workspace-id> \
  --instance-name <instance-name> \
  --ecs-spec <ecs-spec> \
  --image-url <image-url> \
  --region <region> \
  --datasets DatasetId=<dataset-id> MountPath=/mnt/data MountAccess=RO \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

See SKILL.md for parameter requirements (Region, Dataset confirmation, etc.).

>

Dataset mount parameters (use CLI list format, NOT JSON):

- DatasetId — Dataset ID (required)

- MountPath — Mount path in container (required)

- MountAccess — Access mode: RO or RW

- DatasetVersion, Dynamic, OptionType, Options, Uri — Optional

---

UpdateInstance

See SKILL.md Step 6 for pre-update check requirements (compare current vs target configuration).

# Rename instance
aliyun pai-dsw update-instance \
  --instance-id <instance-id> \
  --instance-name <new-name> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# Change image
aliyun pai-dsw update-instance \
  --instance-id <instance-id> \
  --image-id <new-image-id> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# Change compute spec and auto-start after update
aliyun pai-dsw update-instance \
  --instance-id <instance-id> \
  --ecs-spec <new-ecs-spec> \
  --start-instance true \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

---

GetInstance

aliyun pai-dsw get-instance \
  --instance-id <instance-id> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

---

ListInstances

# All instances
aliyun pai-dsw list-instances \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# Filter by status
aliyun pai-dsw list-instances \
  --status Running \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# By workspace, paginated with sorting
# Note: --sort-by and --order must be used together
aliyun pai-dsw list-instances \
  --workspace-id <workspace-id> \
  --status Running \
  --page-number 1 \
  --page-size 20 \
  --sort-by GmtCreateTime \
  --order DESC \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# All workspaces, all billing types
aliyun pai-dsw list-instances \
  --workspace-id ALL \
  --resource-id ALL \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Sorting parameters:

• --sort-by: Sort field — Priority, GmtCreateTime, GmtModifiedTime
• --order: Sort direction — ASC or DESC
• Note: --sort-by and --order must be used together. Using only one will cause API validation error.

---

StartInstance

Prerequisite: Instance must be in Stopped or Failed state.

aliyun pai-dsw start-instance \
  --instance-id <instance-id> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

---

StopInstance

aliyun pai-dsw stop-instance \
  --instance-id <instance-id> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

To save the environment as a custom image, see SKILL.md Step 5.

---

Helper Commands

ListEcsSpecs

[MUST] Choose accelerator type based on user requirements:

- Default recommendation: GPU for 大模型训练/深度学习, CPU for 数据分析/轻量任务

- Match image type (strong indicator): GPU image URL (contains -gpu- or cu) → GPU specs; CPU image → CPU specs

- Always confirm with user if the use case is ambiguous

# CPU specs in a specific region
aliyun pai-dsw list-ecs-specs \
  --accelerator-type CPU \
  --region <region> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# GPU specs in a specific region
aliyun pai-dsw list-ecs-specs \
  --accelerator-type GPU \
  --region <region> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# Paginated with sort
aliyun pai-dsw list-ecs-specs \
  --accelerator-type CPU \
  --region <region> \
  --page-number 1 \
  --page-size 20 \
  --order ASC \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

# Filter by resource type
aliyun pai-dsw list-ecs-specs \
  --accelerator-type GPU \
  --region <region> \
  --resource-type ECS \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

See SKILL.md Step 1 for key response fields (InstanceType, IsAvailable, etc.).

---

Help & Plugin Management

# List all pai-dsw subcommands
aliyun pai-dsw --help

# Command-specific help
aliyun pai-dsw create-instance --help
aliyun pai-dsw update-instance --help
aliyun pai-dsw get-instance --help
aliyun pai-dsw list-instances --help
aliyun pai-dsw start-instance --help
aliyun pai-dsw stop-instance --help

# Install pai-dsw plugin (if missing)
aliyun plugin install --names pai-dsw

---

Instance Status Values

Verification Method — alibabacloud-pai-dsw-manage

Step-by-step verification commands and success criteria for each operation.

1. Verify Credentials

aliyun configure list

Expected: A valid profile with a non-empty AccessKey.

---

2. Verify Plugin Installation

aliyun pai-dsw --help --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Expected: Help output listing available pai-dsw subcommands.

---

3. Verify ListWorkspaces (Required before CreateInstance)

aliyun aiworkspace list-workspaces \
  --region <region> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Success criteria:

• TotalCount >= 1 (user has at least one workspace)
• Workspaces array contains workspace objects with WorkspaceId, WorkspaceName, Status
• At least one workspace has Status == "ENABLED"

See SKILL.md "Parameter Confirmation" section for how to get WorkspaceId.

---

4. Verify ListEcsSpecs

aliyun pai-dsw list-ecs-specs \
  --accelerator-type CPU \
  --region <region> \
  --page-number 1 \
  --page-size 5 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

aliyun pai-dsw list-ecs-specs \
  --accelerator-type GPU \
  --region <region> \
  --page-number 1 \
  --page-size 5 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Success criteria:

• TotalCount >= 0
• EcsSpecs array present (may be empty)
• Success is true
• Each entry contains InstanceType, IsAvailable, CPU, Memory
• CPU results: AcceleratorType == "CPU", GPU == 0
• GPU results: AcceleratorType == "GPU", GPU >= 1, GPUType non-empty

---

5. Verify Instance Existence Check

See SKILL.md Section 2.1 for check-then-act pattern and decision logic.

[WARNING] The --instance-name filter may return partial matches. See SKILL.md "Exact name match required" for details.

---

6. Verify CreateInstance

aliyun pai-dsw list-instances \
  --instance-name <your-instance-name> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Success criteria:

• Instance appears in results
• InstanceId is non-empty (dsw-xxxxx format)
• Status is Creating, Starting, or Running

See SKILL.md "Return immediately after creation" for non-blocking workflow.

---

7. Verify Instance State (On-Demand)

aliyun pai-dsw get-instance \
  --instance-id <instance-id> \
  --read-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Key fields:

• .Status — Current lifecycle state
• .InstanceUrl — Accessible when Running
• .ReasonCode / .ReasonMessage — Failure diagnostics

See SKILL.md Step 4 for polling guidance (when to poll, timeout limits, intervals).

State transitions: See `related-commands.md`.

---

8. Verify UpdateInstance

aliyun pai-dsw get-instance \
  --instance-id <instance-id> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Success criteria:

• Modified fields (InstanceName, EcsSpec, ImageId) reflect new values
• Status is Running or Stopped (not Updating)

---

9. Verify ListInstances

aliyun pai-dsw list-instances \
  --page-number 1 \
  --page-size 10 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Success criteria:

• TotalCount >= 0
• Instances array present (may be empty)
• Success is true

---

10. Verify StartInstance

aliyun pai-dsw get-instance \
  --instance-id <instance-id> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Success criteria:

• Status eventually reaches Running
• InstanceUrl is populated

---

11. Verify StopInstance

aliyun pai-dsw get-instance \
  --instance-id <instance-id> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-dsw-manage

Success criteria:

• Status eventually reaches Stopped

To save the environment as a custom image, use the PAI Console. See SKILL.md Step 5.

---

Manual Verification Only