Alibabacloud Tair Ai Assistant

Tair Database AI Assistant

This Skill focuses on Alibaba Cloud Tair (Redis OSS-Compatible) database intelligent O&M, invoking the get-yao-chi-agent API through the aliyun CLI DAS plugin for diagnostics and analysis.

Architecture: Aliyun CLI → DAS Plugin (Signature V3) → get-yao-chi-agent API → Tair Intelligent Diagnostics

Supported Capabilities

Installation

Pre-check: Aliyun CLI >= 3.3.1 required

Run aliyun version to verify >= 3.3.1. If not installed or version too low,

see references/cli-installation-guide.md for installation instructions.

Then [MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

# Install aliyun CLI
curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash
aliyun version  # Verify >= 3.3.1

# Enable automatic plugin installation
aliyun configure set --auto-plugin-install true

# Install DAS plugin (get-yao-chi-agent requires plugin for Signature V3 support)
aliyun plugin install --names aliyun-cli-das

# Update all installed plugins to latest version
aliyun plugin update

# Install jq (for JSON response parsing)
# macOS:
brew install jq
# Ubuntu/Debian:
# sudo apt-get install jq

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks,

passwords, domain names, resource specifications, etc.) MUST be confirmed with the

user. Do NOT assume or use default values without explicit user approval.

Authentication

This Skill relies on the aliyun CLI default credential chain for authentication — no explicit AK/SK handling is required in the Skill workflow.

The CLI automatically resolves credentials in the following priority order: 1. --profile flag on the command line 2. ALIBABA_CLOUD_PROFILE environment variable 3. ALIBABA_CLOUD_ACCESS_KEY_ID / ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables 4. Configuration file ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role (if running on ECS)

For credential setup and configuration modes (OAuth, AK, StsToken, RamRoleArn, EcsRamRole, etc.), see references/cli-installation-guide.md.

RAM Policy

See references/ram-policies.md

Core Workflow

All intelligent O&M operations are invoked through scripts/call_yaochi_agent.sh, which wraps aliyun das get-yao-chi-agent (DAS plugin kebab-case command, supports Signature V3) with streaming response parsing.

Before executing any CLI command, AI-Mode must be enabled; after workflow ends, it must be disabled:

# [MUST] Enable AI-Mode before executing CLI commands
aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-tair-ai-assistant"

# Instance management
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List Tair instances in Hangzhou region"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Show detailed configuration of instance r-xxx"

# Performance diagnostics
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Analyze instance r-xxx performance in the last hour"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Show slow commands of instance r-xxx"

# Memory analysis
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Analyze memory usage of instance r-xxx"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Detect big keys in instance r-xxx"

# Hotspot key detection
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Find hotspot keys in instance r-xxx"

# Parameter tuning
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "How to tune maxmemory-policy for instance r-xxx"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Explain hz parameter"

# Connection and session
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "How to troubleshoot high connection count in instance r-xxx"

# Backup recovery
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Show backup status of instance r-xxx"

# Multi-turn conversation (use session ID from previous response)
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Continue analysis" --session-id "<session-id>"

# Specify profile
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List instances" --profile myprofile

# Read from stdin
echo "List instances" | bash $SKILL_DIR/scripts/call_yaochi_agent.sh -

# [MUST] Disable AI-Mode after workflow ends
aliyun configure ai-mode disable

Example Questions

Success Verification

See references/verification-method.md

Cleanup

This Skill focuses on query and diagnostics capabilities, does not create any resources, no cleanup required.

The following operations are NOT within the scope of this Skill:

• Create/delete Tair instances
• Change instance specifications
• Purchase/renew instances

API and Command Tables

See references/related-apis.md

Best Practices

1. Instance ID Format: Tair/Redis instance IDs typically start with r-, include the full instance ID in queries 2. Region Specification: Explicitly specify region in natural language queries (e.g., "Hangzhou region", "Beijing region") to improve query accuracy 3. Multi-turn Conversation: Use --session-id for complex diagnostic scenarios to maintain context continuity 4. Concurrency Limit: Maximum 2 concurrent sessions per account, avoid initiating multiple parallel calls 5. High-risk Operations: For operations involving parameter changes, master-replica switchover, always remind users to verify in test environment first 6. Throttling Handling: If encountering Throttling.UserConcurrentLimit error, wait for previous query to complete and retry 7. Credential Security: Use aliyun configure to manage credentials, never hardcode AK/SK in scripts

Reference Links

Acceptance Criteria: alibabacloud-tair-ai-assistant

Scenario: Tair Database AI Assistant Purpose: Skill testing acceptance criteria

---

Correct CLI Command Patterns

1. Product — DAS (Database Autonomy Service)

CORRECT

aliyun das GetYaoChiAgent --Query "List instances" --Source "tair-console" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills

INCORRECT

# Error: Product name spelling error
aliyun DAS GetYaoChiAgent --Query "List instances"

# Error: Using non-existent plugin mode command
aliyun das get-yao-chi-agent --query "List instances"

Note: DAS product uses traditional API format (PascalCase), not plugin mode (kebab-case).

2. Command — GetYaoChiAgent

CORRECT

aliyun das GetYaoChiAgent --Query "Hello" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills

INCORRECT

# Error: API name spelling error
aliyun das GetYaochiAgent --Query "Hello"

# Error: Using non-existent API
aliyun das YaoChiAgent --Query "Hello"

3. Parameters — Parameter Validation

GetYaoChiAgent Parameters

CORRECT

# Required parameter --Query
aliyun das GetYaoChiAgent --Query "List Tair instances in Hangzhou region" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills

# Optional parameter --Source
aliyun das GetYaoChiAgent --Query "List instances" --Source "tair-console" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills

# Optional parameter --SessionId (multi-turn conversation)
aliyun das GetYaoChiAgent --Query "Continue analysis" --SessionId "sess-xxx" --Source "tair-console" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills

# Optional parameter --ExtraInfo
aliyun das GetYaoChiAgent --Query "Show instance" --ExtraInfo "{}" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills

INCORRECT

# Error: Missing required parameter --Query
aliyun das GetYaoChiAgent --Source "tair-console"

# Error: Parameter name in lowercase (CLI parameter names are case-sensitive)
aliyun das GetYaoChiAgent --query "List instances"

# Error: Parameter name spelling error
aliyun das GetYaoChiAgent --Query "List instances" --Session-Id "sess-xxx"

# Error: Using non-existent parameter
aliyun das GetYaoChiAgent --Query "List instances" --RegionId "cn-hangzhou"

4. Endpoint — Endpoint Validation

CORRECT

# GetYaoChiAgent uses cn-shanghai endpoint uniformly
aliyun das GetYaoChiAgent --Query "List instances" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills

INCORRECT

# Error: Using wrong endpoint
aliyun das GetYaoChiAgent --Query "List instances" --endpoint das.cn-beijing.aliyuncs.com

# Error: Endpoint not specified, may use wrong default endpoint
aliyun das GetYaoChiAgent --Query "List instances"

5. --user-agent Flag — Must Include

CORRECT

aliyun das GetYaoChiAgent --Query "List instances" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills

INCORRECT

# Error: Missing --user-agent flag
aliyun das GetYaoChiAgent --Query "List instances" --endpoint das.cn-shanghai.aliyuncs.com

6. Timeout — Timeout Settings

CORRECT

# SSE streaming API requires longer read timeout (180 seconds)
aliyun das GetYaoChiAgent --Query "List instances" --endpoint das.cn-shanghai.aliyuncs.com --read-timeout 180 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills

INCORRECT

# Error: Read timeout too short, streaming API may timeout
aliyun das GetYaoChiAgent --Query "List instances" --endpoint das.cn-shanghai.aliyuncs.com --read-timeout 10 --user-agent AlibabaCloud-Agent-Skills

---

Correct Bash Script Patterns

1. Script Invocation

CORRECT

bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List Tair instances in Hangzhou region"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Analyze instance r-xxx memory usage" --session-id "sess-xxx"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List instances" --profile myprofile
echo "List instances" | bash $SKILL_DIR/scripts/call_yaochi_agent.sh -

INCORRECT

# Error: Using old Python script
uv run $SKILL_DIR/scripts/call_yaochi_agent.py "List instances"

# Error: Using Python interpreter to run bash script
python $SKILL_DIR/scripts/call_yaochi_agent.sh "List instances"

# Error: Parameter name using old format
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List instances" --role-arn acs:ram::xxx:role/xxx

2. SSE Response Parsing

CORRECT — Script automatically parses SSE response

# Input: SSE format response body
data: {"Content":"Tair instance list:","SessionId":"sess-abc123","ReasoningContent":""}
data: {"Content":"\n1. r-xxx (cn-hangzhou)","SessionId":"sess-abc123","ReasoningContent":""}
data: [DONE]

# Output: Concatenated Content
Tair instance list:
1. r-xxx (cn-hangzhou)

3. Credential Management

CORRECT

# Use existing aliyun CLI configuration
aliyun configure --mode OAuth
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List instances"

# Use specified profile
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List instances" --profile myprofile

INCORRECT3

# Error: Hardcoding AK/SK in script
export ALIBABA_CLOUD_ACCESS_KEY_ID="LTAI5tXXXXXXXX"
export ALIBABA_CLOUD_ACCESS_KEY_SECRET="8dXXXXXXXXXXXX"

# Error: Using custom credential variables from old script
export YAOCHI_ACCESS_KEY_ID="xxx"
export YAOCHI_ACCESS_KEY_SECRET="xxx"

---

Authentication Patterns

CORRECT — Use aliyun CLI configuration

# OAuth mode (Recommended)
aliyun configure --mode OAuth

# AK mode
aliyun configure set --mode AK --access-key-id <AK> --access-key-secret <SK> --region cn-hangzhou

# Cross-account RamRoleArn mode
aliyun configure set --mode RamRoleArn --access-key-id <AK> --access-key-secret <SK> --ram-role-arn <ARN> --role-session-name yaochi-session --region cn-hangzhou

INCORRECT — Managing credentials in script

# Error: Using Python SDK to manage credentials
from alibabacloud_das20200116.client import Client as DAS20200116Client

# Error: Parsing credentials from .env file
# Error: Parsing credentials from ~/.alibabacloud/credentials

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.1+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.1 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.1)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "China East 1 (Hangzhou)"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.1+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies

Required Permissions

Tair AI Assistant (YaoChi Agent) requires the following RAM permissions.

Standard Edition

RAM sub-accounts must have:

• AliyunKvstoreReadOnlyAccess - Tair/Redis read-only access
• AliyunYaoChiAgentAccess - YaoChi Agent access

For authorization instructions, see Grant permissions to RAM users.

Professional Edition

RAM sub-accounts must have the service-linked role created:

• AliyunServiceRolePolicyForTairAgent - Tair Agent service-linked role

Custom Policy (Minimum Permissions)

If you need to create a custom policy with minimum required permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "das:GetYaoChiAgent",
        "das:GetDasAgentSSE"
      ],
      "Resource": "*"
    }
  ]
}

Cross-Account Access - STS AssumeRole

For cross-account access, configure trust policy on the target account's RAM role:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Principal": {
        "RAM": [
          "acs:ram::<caller-account-id>:root"
        ]
      }
    }
  ]
}

System Policy Reference

Permission Mapping

Related APIs

DAS (Database Autonomy Service) - Core API

GetYaoChiAgent API Parameters

GetDasAgentSSE API Parameters

SSE Response Format

GetYaoChiAgent returns SSE (Server-Sent Events) streaming response in the following format:

data: {"Content":"Response text chunk 1","SessionId":"sess-xxx","ReasoningContent":""}
data: {"Content":"Response text chunk 2","SessionId":"sess-xxx","ReasoningContent":""}
...
data: [DONE]

Response Fields

API Endpoint

Note: GetYaoChiAgent API uses das.cn-shanghai.aliyuncs.com endpoint uniformly, regardless of the region where the user's Tair instance is located.

Verification Method

How to Verify Skill Execution Success

Step 1: Verify aliyun CLI Installation and Configuration

# Check CLI version
aliyun version
# Expected output: 3.3.1 or higher

# Check authentication configuration
aliyun configure get
# Expected output: Display current profile configuration

# Test basic connectivity
aliyun das describe-instance-das-pro --instance-id "r-test" --endpoint das.cn-shanghai.aliyuncs.com --user-agent AlibabaCloud-Agent-Skills 2>&1
# Expected: Return JSON response (even if instance doesn't exist, should return API error not connection error)

Step 2: Verify jq Installation

echo '{"Content":"test"}' | jq -r '.Content'
# Expected output: test

Step 3: Verify call_yaochi_agent.sh Script

# Verify script is executable
bash $SKILL_DIR/scripts/call_yaochi_agent.sh --help
# Expected: Display help information

# Verify error prompt without parameters
bash $SKILL_DIR/scripts/call_yaochi_agent.sh
# Expected: Display usage prompt and exit

Step 4: Verify Actual Invocation (requires valid credentials)

# Simple query test
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Hello"
# Expected: Return YaoChi Agent response content

# With debug mode
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Hello" --debug
# Expected: Return response content, also output debug info to stderr

Step 5: Verify Multi-turn Conversation

# First round query - note the session ID output to stderr
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List Tair instances in Hangzhou region"
# Expected: Return instance list, stderr outputs [SessionID] sess-xxx

# Second round query - use session ID from previous round
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Continue analyzing the first instance" --session-id "sess-xxx"
# Expected: Continue analysis based on context

Common Errors and Solutions