Alibabacloud Rds Copilot

Alibaba Cloud RDS Copilot Intelligent Operations Assistant

This skill serves as an intelligent agent for Alibaba Cloud RDS Copilot in conversations, helping users with RDS-related intelligent Q&A, SQL optimization, instance operations, and troubleshooting.

Scenario Description

Architecture: Alibaba Cloud CLI + RdsAi OpenAPI

Main features:

• Understand user's natural language requests (Chinese or English), identify if related to RDS Copilot
• Directly call Alibaba Cloud CLI to execute aliyun rdsai chat-messages command for real-time RDS Copilot queries
• When receiving results or user-pasted error messages, further explain, diagnose, and provide recommendations

---

Agent Execution Contract

Before calling RDS Copilot, the agent must make the local environment ready by itself whenever command execution is available. Do not ask the user to install CLI or plugins first if the agent can install or upgrade them directly. If install or upgrade needs network access, sudo, or tool approval, request that approval with the concrete command and continue after approval.

Hard gate: Do not execute aliyun rdsai chat-messages until all readiness checks pass:

1. Alibaba Cloud CLI exists and aliyun version is >= 3.3.3. 2. Plugin auto-install is enabled and the rdsai product plugin/command is available. 3. Alibaba Cloud CLI credentials are configured and the selected profile is valid.

If any gate fails:

• Missing or old CLI: install or upgrade Alibaba Cloud CLI, then re-run aliyun version.
• Missing rdsai plugin: enable plugin auto-install and install or trigger installation of rdsai, then re-check the command.
• Missing/invalid credentials: stop before the RDS Copilot API call and guide the user to configure credentials. If the user asks the agent to configure them, request only the required fields, then configure through aliyun configure; never ask the user to paste secrets into environment variables.

Default region: If the user does not explicitly provide a region, always use cn-hangzhou. Natural language "Hangzhou" maps to cn-hangzhou. Keep this default in both --inputs RegionId=cn-hangzhou and any credential setup guidance unless the user specifies another region.

---

Installation

Agent preflight: Alibaba Cloud CLI must be installed or installed by the agent

>

This skill uses Alibaba Cloud CLI to call RdsAi OpenAPI. The agent must first check whether the CLI is present and usable. If the CLI is missing and command execution is available, install it before asking the user to take manual action.

Pre-check: Aliyun CLI >= 3.3.3 required

Run command -v aliyun and aliyun version to verify >= 3.3.3.

If not installed or version is too low, install or update it before proceeding.

CLI versions below 3.3.0 do not support the aliyun plugin command; upgrade the CLI first instead of running plugin commands repeatedly.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] verify the rdsai plugin capability with aliyun plugin list, aliyun plugin search rdsai, or aliyun rdsai --help.

[MUST] if rdsai is not installed, run aliyun plugin install --names rdsai and re-check.

[MUST] run aliyun plugin update --name rdsai when the plugin is already installed; if the CLI only supports aliyun plugin update, use that and continue.

[MUST] CLI User-Agent — Every aliyun rdsai chat-messages invocation must include a per-command --user-agent value in this format: AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}. See the Observability section for session-id generation rules. Do not pass --user-agent to system commands such as aliyun configure, aliyun plugin, aliyun version, or install/upgrade commands.

macOS Installation

# Option 1: Install via Homebrew (recommended)
brew install aliyun-cli

# Option 2: Install via PKG package
curl -O https://aliyuncli.alicdn.com/aliyun-cli-latest.pkg
sudo installer -pkg aliyun-cli-latest.pkg -target /

# Option 3: Install via one-click script
/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

Linux Installation

# Install via one-click script
/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

# Or download TGZ package for manual installation
curl https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz -o aliyun-cli.tgz
tar xzvf aliyun-cli.tgz
sudo mv aliyun /usr/local/bin/

Verify Installation

command -v aliyun
aliyun version

---

Credential Configuration

Option 1: Interactive Configuration (Recommended)

aliyun configure --mode AK --profile rdsai

Follow the prompts to enter:

• Access Key Id: Your AccessKey ID
• Access Key Secret: Your AccessKey Secret
• Default Region Id: cn-hangzhou unless the user specifies another region

Before asking the user for secrets, explain that the recommended interactive command keeps the secret inside Alibaba Cloud CLI's credential store. Do not print or store the secret in chat history longer than needed.

Option 2: Non-interactive Configuration

aliyun configure set \
  --profile rdsai \
  --mode AK \
  --access-key-id <yourAccessKeyID> \
  --access-key-secret <yourAccessKeySecret> \
  --region cn-hangzhou

---

Command Format

Basic Command Structure

aliyun rdsai chat-messages \
  --query '<query content>' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai [CustomAgentId=<custom agent ID>] \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' \
  [--conversation-id '<conversation ID>']

Parameter Description

IMPORTANT: Parameter Confirmation — Before executing any command,

Determine user intent: SQL writing/optimization, SQL diagnosis, instance parameter tuning, troubleshooting, performance analysis, query instance list, etc.

Collect necessary parameters (use default values if not specified).

---

RAM Permissions

This skill requires the following RAM permissions. See references/ram-policies.md for details.

---

Core Workflow

0. Environment Readiness Preflight (Before Calling RDS Copilot)

Run this preflight once at the start of every RDS Copilot task. Do not skip it because the user only asked a simple query.

# 0.1 Check Alibaba Cloud CLI existence and version
command -v aliyun
aliyun version

If aliyun is missing, install it by choosing the safest available local method:

# macOS, when Homebrew is available
brew install aliyun-cli

# macOS/Linux fallback
/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

If aliyun version is lower than 3.3.3, upgrade it before running plugin commands:

# CLI 3.3.5+ non-Homebrew install
aliyun upgrade --yes

# macOS Homebrew install
brew update
brew upgrade aliyun-cli

# Fallback for old CLI versions such as 3.0.x that do not support plugin commands
/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

After install or upgrade, re-run aliyun version.

# 0.2 Enable and verify plugin support. These are system commands; do not add --user-agent.
aliyun configure set --auto-plugin-install true
aliyun plugin list
aliyun plugin search rdsai

# Run only if the previous checks do not show the rdsai plugin/command.
aliyun plugin install --names rdsai

# Final capability check. This may also trigger auto-install after auto-plugin-install is enabled.
aliyun rdsai --help

If aliyun plugin returns an error such as 'plugin' is not a valid command or product, the CLI is too old. Upgrade the CLI first; do not keep retrying plugin commands.

# 0.4 Check credentials before the first API call
aliyun configure list

Treat these credential states as not ready:

• No profile is listed.
• The selected or default profile has empty Credential.
• Valid is Invalid or not shown as valid.
• The command reports unknown profile, InvalidAccessKeyId, SignatureDoesNotMatch, missing AccessKey, expired STS token, or similar authentication errors.

When credentials are not ready, stop before aliyun rdsai chat-messages and answer with credential guidance:

# Recommended interactive setup
aliyun configure --mode AK --profile rdsai

# Non-interactive setup if the user explicitly asks the agent to configure credentials
aliyun configure set \
  --profile rdsai \
  --mode AK \
  --access-key-id <AccessKeyId> \
  --access-key-secret <AccessKeySecret> \
  --region cn-hangzhou

If the user wants the agent to configure credentials, ask for:

• Credential mode: default to AK unless the user says OAuth, STS, RAM role, EcsRamRole, or another supported mode.
• Profile name: default to rdsai.
• AccessKeyId and AccessKeySecret for AK mode, or the mode-specific fields for STS/RAM-role modes.
• STS token if using temporary credentials.
• RegionId: default cn-hangzhou if not specified.

Never use export ALIBABA_CLOUD_ACCESS_KEY_ID=... or export ALIBABA_CLOUD_ACCESS_KEY_SECRET=... as the normal setup path. Use aliyun configure so credentials stay in the CLI credential store.

1. Confirm Task Type and Parameters

Determine user intent: SQL writing/optimization, SQL diagnosis, instance parameter tuning, troubleshooting, performance analysis, query instance list, etc.

Collect necessary parameters (use default values if not specified):

• RegionId: Region ID (default cn-hangzhou; use this if omitted)
• Language: Language (default zh-CN)
• Timezone: Timezone (default Asia/Shanghai)
• CustomAgentId: Custom Agent ID (optional)
• --conversation-id: Conversation ID for multi-turn dialogue (optional)

2. Construct Command and Call CLI

Only run this step after the environment readiness preflight succeeds. Always include RegionId; if the user does not provide a region, use cn-hangzhou. Before the first business API call, generate one session-id using the Observability rules below and reuse it for all aliyun rdsai chat-messages calls in this RDS Copilot task.

# Basic query
aliyun rdsai chat-messages \
  --query 'List RDS MySQL instances in Hangzhou region' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

# Troubleshooting example
aliyun rdsai chat-messages \
  --query 'RDS instance rm-bp1xxx connection timeout, error Too many connections, please help troubleshoot. Instance is in Hangzhou region.' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

# Query with Beijing region
aliyun rdsai chat-messages \
  --query 'Optimize this SQL: SELECT * FROM users WHERE name LIKE "%test%"' \
  --inputs RegionId=cn-beijing Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

# Multi-turn dialogue (using ConversationId from previous response)
aliyun rdsai chat-messages \
  --query 'Continue analyzing the above issue' \
  --conversation-id '<ConversationId from previous response>' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

# Using custom Agent
aliyun rdsai chat-messages \
  --query 'Analyze database performance' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai CustomAgentId=your-custom-agent-id \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

3. Parse Results and Follow-up Processing

• Only when the response or user-pasted error contains No valid order found, stop normal result analysis and directly return this guidance to the user:
• The current call did not find a valid RDS AI Assistant Professional Edition order. Enable RDS AI Assistant Professional Edition for the current Alibaba Cloud account, then retry the failed call.
• Activation page: https://rdsnext.console.aliyun.com/rdsCopilotProfessional/cn-hangzhou
• Operation guide: https://help.aliyun.com/zh/rds/apsaradb-rds-for-mysql/manage-rds-colipot-professional-edition
• According to the operation guide, create RDS AI Assistant Professional Edition from the RDS console by choosing RDS AI Assistant > Professional Edition and clicking Activate Now. After activation succeeds, retry the failed call with the enabled account.
• Explain RDS Copilot's response to the user in natural language
• If the response contains SQL or operational steps, assess risks and warn:
• Avoid executing high-risk statements directly in production (e.g., large table DELETE / UPDATE / schema changes)
• Recommend validating in test environment or adding backup/condition restrictions
• If continuing the conversation, record the ConversationId from the response for the next query

---

Observability

Generate one session-id per RDS Copilot task/session before the first business API call. The session-id must be a 32-character lowercase hexadecimal string, generated once and reused for every aliyun rdsai chat-messages command in the same task, including multi-turn follow-ups.

Recommended generation methods:

openssl rand -hex 16

Fallback:

python3 -c 'import secrets; print(secrets.token_hex(16))'

User-Agent template:

AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}

Apply this User-Agent only as a per-command --user-agent argument on business API commands:

aliyun rdsai chat-messages \
  --query '<query content>' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Do not use deprecated global User-Agent configuration mechanisms. Do not add --user-agent to system commands such as aliyun configure, aliyun plugin, aliyun version, command -v aliyun, install commands, or upgrade commands.

---

Output Format

Alibaba Cloud CLI returns JSON format responses (streaming multiple JSON events):

{"data":{"ConversationId":"8227be22-xxxx-xxxx-xxxx-xxxxxxxxxxxx","Event":"workflow_started","MessageId":"a79c881c-xxxx-xxxx-xxxx-xxxxxxxxxxxx",...}}
{"data":{"Answer":"<partial answer content>","Event":"message",...}}
{"data":{"Event":"workflow_finished",...}}

Key fields:

• ConversationId: Conversation ID (for multi-turn dialogue)
• Answer: AI assistant's response content
• Event: Event type (workflow_started, message, workflow_finished)

---

Success Verification

1. CLI installation successful: aliyun version shows version number 2. Credential configured correctly: aliyun configure list shows configured credentials 3. Observability configured correctly: Business API calls include --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' with a 32-character hex session-id 4. API call successful: Response contains ConversationId and Answer in JSON format 5. Response content valid: Answer is relevant to the query content

See references/verification-method.md for detailed verification steps.

---

Cleanup

This skill only performs read-only query operations, does not create any cloud resources, no cleanup required.

---

API and Command List

See references/related-apis.md for details.

---

Best Practices

1. Use multi-turn dialogue: For complex issues, use --conversation-id for context-aware multi-turn conversations 2. Specify correct region: Set RegionId parameter based on the RDS instance's region 3. Be cautious in production: SQL recommendations from RDS Copilot should be validated in test environment first 4. Save conversation ID: Save the returned ConversationId if you need to follow up or continue analysis 5. Use configuration file: Recommend using aliyun configure to configure credentials, avoid exposing sensitive information in command line 6. Use --profile: You can configure multiple credential profiles and switch between accounts using --profile

---

Reference Links

Acceptance Criteria: alibabacloud-rds-copilot

Scenario: RDS Copilot Intelligent Operations Assistant Purpose: Skill Test Acceptance Criteria

---

0. Environment Readiness Gate

✅ CORRECT - Preflight Before RDS Copilot API Calls

command -v aliyun
aliyun version
aliyun configure set --auto-plugin-install true
aliyun plugin list
aliyun plugin search rdsai
# Run only if the previous checks do not show the rdsai plugin/command.
aliyun plugin install --names rdsai
aliyun rdsai --help
aliyun configure list

Expected handling:

• If Alibaba Cloud CLI is missing or lower than 3.3.3, install or upgrade it first.
• If aliyun plugin is unavailable, treat it as an old CLI and upgrade before plugin operations.
• If the rdsai plugin/command is missing, install it or trigger auto-install before calling ChatMessages.
• If CLI credentials are missing or invalid, stop before aliyun rdsai chat-messages and guide credential setup.
• If the user does not specify a region, use cn-hangzhou.
• System commands in this preflight must not use --user-agent; only aliyun rdsai chat-messages business API commands use per-command --user-agent.

❌ INCORRECT - Calling ChatMessages Before Preflight

# Wrong: skips CLI/plugin/credential readiness checks
aliyun rdsai chat-messages \
  --query 'List RDS instances' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

---

1. Environment Configuration Verification

✅ CORRECT - Using Alibaba Cloud CLI to Configure Credentials

# Correct: Use aliyun configure to configure credentials (relies on default credential chain)
aliyun configure --mode AK --profile rdsai

❌ INCORRECT - Hardcoded Credentials

# Wrong: Explicitly setting AK/SK environment variables
export ALIBABA_CLOUD_ACCESS_KEY_ID="LTAI5txxxxxxxxxx"  # Do not set explicitly
export ALIBABA_CLOUD_ACCESS_KEY_SECRET="xxxxxxxxxxxxxxxx"  # Do not set explicitly

---

2. CLI Command Verification

✅ CORRECT - Using Alibaba Cloud CLI

# Correct: Use aliyun CLI to call RDS AI API
aliyun rdsai chat-messages \
  --query 'List RDS instances' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

❌ INCORRECT - Missing Required Parameters

# Wrong: Missing endpoint or user-agent
aliyun rdsai chat-messages \
  --query 'List RDS instances'

---

3. CLI Command Format Verification

✅ CORRECT - Contains Required Parameters

aliyun rdsai chat-messages \
  --query 'List RDS instances' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

❌ INCORRECT - Wrong Endpoint

# Wrong: Using incorrect endpoint
aliyun rdsai chat-messages \
  --endpoint rds.aliyuncs.com  # Should be rdsai.aliyuncs.com

---

4. Multi-turn Dialogue Verification

✅ CORRECT - Using conversation_id

# First turn
aliyun rdsai chat-messages \
  --query 'Analyze this SQL performance' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'
# Output: ConversationId: conv-xxxx-xxxx

# Second turn (using conversation ID from first turn)
aliyun rdsai chat-messages \
  --query 'Continue optimization' \
  --conversation-id 'conv-xxxx-xxxx' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

---

5. Error Handling Verification

✅ CORRECT - Check Credential Configuration

# Check if CLI credentials are configured
aliyun configure list

Expected handling when no valid credential is configured:

• Do not call aliyun rdsai chat-messages.
• Tell the user the CLI credential is not ready.
• Provide aliyun configure --mode AK --profile rdsai for interactive setup.
• If the agent is asked to configure credentials, request AccessKeyId, AccessKeySecret, optional SecurityToken/Profile, and RegionId defaulting to cn-hangzhou.

✅ CORRECT - Error Output to stderr

# If credentials are not configured, CLI will output error message
aliyun rdsai chat-messages --query 'Test' ... 2>&1 | grep -i error

✅ CORRECT - No Valid Order Error

No valid order found

Expected handling:

• Explain that this failed call did not find a valid RDS AI Assistant Professional Edition order, and the current Alibaba Cloud account needs to enable Professional Edition before retrying this failed call.
• Return the Professional Edition activation page directly: https://rdsnext.console.aliyun.com/rdsCopilotProfessional/cn-hangzhou
• Return the operation guide: https://help.aliyun.com/zh/rds/apsaradb-rds-for-mysql/manage-rds-colipot-professional-edition

---

6. Observability Verification

✅ CORRECT - Session User-Agent Format

session-id: 32-character lowercase hex generated once per RDS Copilot task
User-Agent: AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}

Expected handling:

• Generate the session-id once before the first business API call.
• Reuse the same session-id for every aliyun rdsai chat-messages command in the same task.
• Do not use deprecated global User-Agent configuration mechanisms.
• Do not add --user-agent to system commands such as aliyun configure, aliyun plugin, aliyun version, install commands, or upgrade commands.

❌ INCORRECT - Missing Session Id Segment

A User-Agent value that omits the trailing /{session-id} segment fails this check.

---

7. User-Agent Verification

✅ CORRECT - User-Agent Configured

# Correct: Include --user-agent parameter
aliyun rdsai chat-messages \
  --query 'Test' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

❌ INCORRECT - Missing User-Agent

# Wrong: Missing --user-agent parameter
aliyun rdsai chat-messages \
  --query 'Test' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com

---

Acceptance Checklist

• [ ] Alibaba Cloud CLI installed and version >= 3.3.3 (aliyun version)
• [ ] rdsai plugin/command is available before ChatMessages (aliyun plugin search rdsai / aliyun rdsai --help)
• [ ] CLI credentials configured and valid (aliyun configure list)
• [ ] Missing credentials stop the workflow before API calls and return setup guidance
• [ ] Region defaults to cn-hangzhou when omitted
• [ ] Basic query successful (aliyun rdsai chat-messages --query 'Test' ...)
• [ ] Streaming output works correctly
• [ ] Multi-turn dialogue works (--conversation-id)
• [ ] Observability chapter declares 32-character hex session-id generation and UA template AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}
• [ ] User-Agent configured only on business API commands (--user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}')
• [ ] Error messages output to stderr
• [ ] Response content output to stdout

RAM Policies - RDS Copilot

Required Permissions

Using the RDS Copilot skill requires the following RAM permissions:

Custom Policy

Create a custom RAM policy to grant RDS Copilot access:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rdsai:ChatMessages"
      ],
      "Resource": "*"
    }
  ]
}

Policy Description

Least Privilege Principle

The above policy contains only the minimum permissions required to call the RDS AI Assistant API. If recommendations returned by RDS Copilot require executing other operations (such as querying instances, modifying parameters, etc.), additional RDS permissions need to be granted.

Extended Permissions (Optional)

If you need RDS Copilot to execute RDS operations mentioned in query recommendations, you can add the following permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rdsai:ChatMessages"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeDBInstanceAttribute",
        "rds:DescribeDBInstancePerformance",
        "rds:DescribeSlowLogRecords",
        "rds:DescribeParameters"
      ],
      "Resource": "*",
      "Condition": {}
    }
  ]
}

Credential Configuration

This skill uses Alibaba Cloud CLI for authentication. Please ensure:

1. The RAM user or role associated with the AccessKey has been granted the above permissions 2. Configure credentials via aliyun configure (relies on default credential chain):

   aliyun configure --profile rdsai

Security Recommendations

1. Use RAM User: Avoid using root account AccessKey, recommend creating a dedicated RAM user 2. Least Privilege: Only grant necessary permissions 3. Regular Rotation: Regularly rotate AccessKey 4. Use CLI Configuration: Configure credentials via aliyun configure, rely on default credential chain

Related APIs - RDS Copilot

API List

API Details

ChatMessages

• Product: rdsai
• API Version: 2025-05-07
• Endpoint: rdsai.aliyuncs.com
• CLI Command: aliyun rdsai chat-messages
• Description: Call RDS AI Assistant for dialogue, returns streaming response

CLI Parameters:

--inputs Supported Parameters:

Response Fields:

Alibaba Cloud CLI Usage Examples

Basic Query

aliyun rdsai chat-messages \
  --query 'List RDS instances' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Troubleshooting

aliyun rdsai chat-messages \
  --query 'RDS instance rm-bp1pjojb0k8vi8p6j suddenly had connection timeout this morning, logs keep showing ERROR 1040 (HY000): Too many connections, users cannot access the system. Please help troubleshoot and provide solutions. Instance is in Hangzhou region.' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Query Specific Region

aliyun rdsai chat-messages \
  --query 'List MySQL instances in Beijing region' \
  --inputs RegionId=cn-beijing Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Multi-turn Dialogue

# First turn
aliyun rdsai chat-messages \
  --query 'Analyze SELECT * FROM users WHERE id = 1' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

# Second turn (using ConversationId from previous response)
aliyun rdsai chat-messages \
  --query 'How to optimize this SQL' \
  --conversation-id '8227be22-5c94-4f6d-9b9e-a5f639a3740c' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Using Custom Agent

aliyun rdsai chat-messages \
  --query 'Analyze database performance' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai CustomAgentId=your-custom-agent-id \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Using Specific Credential Profile

aliyun rdsai chat-messages \
  --query 'Query instance information' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' \
  --profile rdsai

Response Example

{"data":{"ConversationId":"8227be22-5c94-4f6d-9b9e-a5f639a3740c","CreatedAt":1775143912,"Event":"workflow_started","MessageId":"a79c881c-0c3e-525d-b9fd-97829880d"}}
{"data":{"Answer":"Based on your description, the RDS instance has exceeded the connection limit...","Event":"message"}}
{"data":{"Event":"workflow_finished"}}

CLI Command Line Options

Reference Links

Verification Method - RDS Copilot

This document describes how to verify that the RDS Copilot skill is correctly configured and running.

Prerequisites Verification

1. Verify Alibaba Cloud CLI Installation and Version

command -v aliyun
aliyun version

Expected Result: Outputs CLI version number, e.g., 3.3.3 (must be >= 3.3.3)

If not installed:

# macOS - Install via Homebrew
brew install aliyun-cli

# macOS/Linux - Install via one-click script
/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

If installed but lower than 3.3.3:

# CLI 3.3.5+ non-Homebrew install
aliyun upgrade --yes

# macOS Homebrew install
brew update
brew upgrade aliyun-cli

# Fallback for old 3.0.x CLI versions that do not support plugin commands
/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

2. Verify RdsAi Plugin Readiness

aliyun configure set --auto-plugin-install true
aliyun plugin list
aliyun plugin search rdsai
# Run only if the previous checks do not show the rdsai plugin/command.
aliyun plugin install --names rdsai
aliyun rdsai --help

Expected Result:

• aliyun plugin is available. If it is not available, upgrade Alibaba Cloud CLI first.
• The rdsai product plugin/command is available before any aliyun rdsai chat-messages call.
• These system commands do not use --user-agent; User-Agent is only passed on business API commands.

3. Verify Credential Configuration

# View configured credentials list
aliyun configure list

Expected Result: Outputs configured credential information

If not configured:

# Interactive configuration
aliyun configure --mode AK --profile rdsai

# Or non-interactive configuration
aliyun configure set \
  --profile rdsai \
  --mode AK \
  --access-key-id <yourAccessKeyID> \
  --access-key-secret <yourAccessKeySecret> \
  --region cn-hangzhou

Stop here until credentials are configured. Do not run aliyun rdsai chat-messages with empty or invalid credentials.

4. Verify Observability Session Id

openssl rand -hex 16

Expected Result: Generates one 32-character lowercase hex session-id, for example 0123456789abcdef0123456789abcdef.

Use this User-Agent template for every business API call in the same task:

AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}

Do not use deprecated global User-Agent configuration mechanisms. Do not add --user-agent to system commands such as aliyun configure, aliyun plugin, aliyun version, install commands, or upgrade commands.

Functionality Verification

5. Verify Basic Query Functionality

aliyun rdsai chat-messages \
  --query 'Hello, please introduce yourself' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Expected Result:

• Returns JSON format response (streaming multiple JSON events)
• Contains ConversationId field
• Contains Answer field with RDS Copilot's self-introduction
• Contains Event field

Example Output:

{"data":{"ConversationId":"8227be22-xxxx-xxxx-xxxx-xxxxxxxxxxxx","Event":"workflow_started",...}}
{"data":{"Answer":"I am Alibaba Cloud RDS Copilot, an intelligent assistant designed for database operations...","Event":"message",...}}
{"data":{"Event":"workflow_finished",...}}

6. Verify Troubleshooting Functionality

aliyun rdsai chat-messages \
  --query 'RDS instance rm-bp1xxx connection timeout, error Too many connections, please help troubleshoot.' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Expected Result: Returns response with troubleshooting recommendations

7. Verify Default Region Behavior

When the user does not specify a region, the agent must still pass RegionId=cn-hangzhou:

aliyun rdsai chat-messages \
  --query 'List RDS instances' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Expected Result: The command uses cn-hangzhou; no placeholder region remains in the final command.

8. Verify Region-specific Query Functionality

aliyun rdsai chat-messages \
  --query 'List instances' \
  --inputs RegionId=cn-beijing Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Expected Result: Returns query results related to Beijing region

9. Verify Multi-turn Dialogue Functionality

# First turn
RESULT=$(aliyun rdsai chat-messages \
  --query 'Analyze SELECT * FROM users WHERE id = 1' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' 2>&1)
echo "$RESULT"

# Extract ConversationId
CONV_ID=$(echo "$RESULT" | grep -oP '"ConversationId":"[^"]+' | head -1 | cut -d'"' -f4)
echo "ConversationId: $CONV_ID"

# Second turn
aliyun rdsai chat-messages \
  --query 'How to optimize this SQL' \
  --conversation-id "$CONV_ID" \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}'

Expected Result: Second turn understands context and provides recommendations related to first turn

Error Handling Verification

10. Verify Missing Credentials Error Handling

# Use non-existent profile
aliyun rdsai chat-messages \
  --query 'Test' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' \
  --profile nonexistent

Expected Result: Outputs error message indicating profile does not exist

Agent handling must stop before retrying the RDS Copilot API repeatedly and should guide:

aliyun configure --mode AK --profile rdsai

If the user asks the agent to configure credentials, request these fields:

• AccessKeyId
• AccessKeySecret
• Optional SecurityToken for temporary credentials
• Profile name, default rdsai
• RegionId, default cn-hangzhou

Verification Checklist

Common Issues

Q1: Error "command not found: aliyun"

Solution: Install Alibaba Cloud CLI

brew install aliyun-cli

Q2: Error "InvalidAccessKeyId" or "SignatureDoesNotMatch"

Solution: Check if credentials are configured correctly

aliyun configure --mode AK --profile rdsai

Q3: Error "ServiceUnavailable" or connection timeout

Solution: Check network connection, ensure access to rdsai.aliyuncs.com

Q4: How to view complete request and response

Solution: Use --dryrun option to simulate the call

aliyun rdsai chat-messages \
  --query 'Test' \
  --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \
  --event-mode separate \
  --endpoint rdsai.aliyuncs.com \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' \
  --dryrun

Q5: Error "No valid order found"

Solution: Only handle this as Professional Edition activation guidance when the actual CLI response or user-pasted error contains No valid order found. This error means the current call did not find a valid RDS AI Assistant Professional Edition order. Return the Professional Edition activation page directly and ask the user to enable Professional Edition before retrying this failed call.

• Activation page: https://rdsnext.console.aliyun.com/rdsCopilotProfessional/cn-hangzhou
• Operation guide: https://help.aliyun.com/zh/rds/apsaradb-rds-for-mysql/manage-rds-colipot-professional-edition

The guide describes opening the RDS console, choosing RDS AI Assistant > Professional Edition, clicking Activate Now, configuring the purchase, and retrying after the Professional Edition instance is available.