Alibabacloud Tech Solution Animation Creation Auto Deploy

Build AI Animation Story Creation App — Auto Deploy

Automatically deploy the Alibaba Cloud "Build AI Animation Story Creation App" solution. Deployment stops once the application is accessible — the hands-on experience is left to the user.

Architecture: OSS Bucket + DashScope (Bailian API Key) + FC App (ComfyUI + WebUI — two functions deployed via Devs template) ---

Installation

Prerequisites (scripts/ runtime dependencies):

>

| Dependency | Min Version | Check Command | Purpose |

|-----------|-------------|---------------|---------|

| bash | 4.0+ | bash --version | Script runtime |

| aliyun CLI | >= 3.3.7 | aliyun version | Alibaba Cloud resource operations (3.3.7+ required for ai-mode subcommand) |

| python3 | 3.6+ | python3 --version | JSON parsing |

| curl | any | curl --version | HTTP API calls |

>

If Aliyun CLI is not installed or version too low,

see references/cli-installation-guide.md for installation instructions.

Then [MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

---

CLI Initialization (MUST run before Core Workflow)

Enable AI-Mode, set the dedicated User-Agent, and update plugins so all subsequent CLI calls are tagged correctly and run on the latest plugin versions:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy"
aliyun plugin update

---

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, or print AK/SK values

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session

3. Return and re-run after aliyun configure list shows a valid profile

---

RAM Policy

See references/ram-policies.md for full permission list.

Required system policies: AliyunFCFullAccess, AliyunOSSFullAccess

Additional permissions: Devs-related permissions (devs:CreateProject, devs:RenderServicesByTemplate, devs:UpdateEnvironment, devs:DeployEnvironment, devs:ListEnvironments, devs:GetEnvironment)

Before the Core Workflow, automatically check and attach required policies:

bash scripts/attach-policies.sh

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

1. Read references/ram-policies.md to get the full list of permissions required by this SKILL

2. Use ram-permission-diagnose skill to guide the user through requesting the necessary permissions

3. Pause and wait until the user confirms that the required permissions have been granted

---

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

all parameters are either fixed values or auto-generated/created — no manual user input required.

Before starting the Core Workflow, set the following variables in the shell (all subsequent commands reference them directly):

# Generate random names
BUCKET_NAME="animation-story-$(cat /dev/urandom | LC_ALL=C tr -dc 'a-z' | head -c 6)"
PROJECT_NAME="animation-creation-$(cat /dev/urandom | LC_ALL=C tr -dc 'a-z' | head -c 6)"
echo "BUCKET_NAME=$BUCKET_NAME, PROJECT_NAME=$PROJECT_NAME"

---

Core Workflow

Step 1: Create Bailian API Key (CLI)

Automatically obtain the workspace and create an API Key via aliyun modelstudio CLI:

source scripts/create-api-key.sh

Note: Use source to ensure the API_KEY variable is exported to the current shell. The script automatically fetches the default workspace (or creates one if none exists), creates an API Key, and prints the full value.

Step 2: Enable OSS Service and Create Bucket (CLI)

Note: The OSS CLI plugin uses the --ua flag (not --user-agent) to set the User-Agent.

First enable OSS service (returns ORDER.OPEND if already enabled — can be ignored):

aliyun ossadmin open-oss-service --endpoint oss-admin.aliyuncs.com --force --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy 2>&1 || true

Create Bucket:

aliyun oss mb "oss://$BUCKET_NAME" --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Verify:

aliyun oss stat "oss://$BUCKET_NAME" --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Step 3: Create Devs Project (CLI)

Use the CreateProject API to create a project. Specify the template name and parameters via templateConfig — Devs will automatically create a production environment.

Note: CreateProject only creates the project and an empty environment — it does NOT trigger deployment automatically. You must follow up with RenderServicesByTemplate + UpdateEnvironment + DeployEnvironment to complete deployment.

aliyun devs create-project --body "{
  \"name\": \"$PROJECT_NAME\",
  \"spec\": {
    \"templateConfig\": {
      \"templateName\": \"animation-creation\",
      \"parameters\": {
        \"region\": \"cn-hangzhou\",
        \"bailian_api_key\": \"$API_KEY\",
        \"ossBucket\": \"$BUCKET_NAME\"
      }
    }
  }
}" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Template parameter notes (confirmed — do not modify):

- region: Fixed cn-hangzhou

- bailian_api_key: Bailian API Key auto-created in Step 1

- ossBucket: OSS Bucket name created in Step 2 (without oss:// prefix)

- All parameters are passed via parameters, not variableValues

Step 4: Render Template and Configure Environment (CLI)

All commands in this step use shell variables `MY_UID`, `PROJECT_NAME`, `BUCKET_NAME`, `API_KEY` — make sure Step 1 and Parameter Confirmation have been executed.

First obtain the current user UID and check the role trust policy:

source scripts/setup-role.sh

Note: Use source to ensure the MY_UID variable is exported to the current shell. The script automatically checks whether the role exists and creates it if not. This role is the standard Devs role, typically auto-created when using the FC console's application feature for the first time.

4a. Render Template → Build JSON → Update Environment (all-in-one script)

The following script automatically: renders the template → filters out custom-domain → adds roleArn → calls UpdateEnvironment. The agent does not need to handle JSON manually.

bash scripts/render-and-update.sh

Key notes (built into the script — no manual handling needed):

- custom-domain service is automatically filtered out (causes "Unknown service type" error)

- roleArn is automatically added

- Uses --body to pass data (--spec cannot correctly pass deeply nested JSON)

4b. Trigger Deployment

Built-in rate-limit protection: The script retries up to 3 times with 60-second intervals, and stops immediately on 404. Run the script directly — do not call `deploy-environment` manually.

bash scripts/deploy-environment.sh

Step 5: Poll Deployment Status

Deployment is asynchronous — poll until complete (typically takes 5–15 minutes). Run the following script directly:

bash scripts/poll-deploy-status.sh

Step 6: Create Custom Domain

Why is a custom domain needed? FC trigger URLs (*.fcapp.run) force a Content-Disposition: attachment response header, causing the browser to download the HTML instead of rendering it. A custom domain (*.devsapp.net) is required for the application to work properly.

Must use FC 2.0 API (`aliyun fc-open`) to create the helper function: FC 3.0 does not support $ in function names. The fc-open plugin will be auto-installed via the --auto-plugin-install true configuration.

Run the following complete script directly (only `MY_UID` and `PROJECT_NAME` variables need to be set):

bash scripts/create-custom-domain.sh

Step 7: Get Access URL (stop here)

The access URL is automatically printed at the end of the Step 6 script. Format:

http://${PROJECT_NAME}-web.fcv3.${MY_UID}.cn-hangzhou.fc.devsapp.net/

Stop here. Provide the access URL from Step 6 output to the user and let them experience the app on their own. Do not operate the application on behalf of the user.

⚠️ 安全提醒 — 展示访问 URL 时必须告知用户：

该 URL 可通过公网直接访问，请勿随意分享给不信任的人。未经授权的访问可能导致：

- 云资源被消耗： 每次访问都会消耗函数计算资源和百炼 API 调用额度，可能产生额外费用。

- 隐私信息泄露： 生成的动画故事、上传的图片等内容可能包含个人或敏感信息。

---

Cleanup

To clean up deployed resources, delete in the following order (requires PROJECT_NAME, MY_UID, BUCKET_NAME, API_KEY_ID variables):

# 1. Delete FC custom domain
aliyun fc delete-custom-domain --domain-name "${PROJECT_NAME}-web.fcv3.${MY_UID}.cn-hangzhou.fc.devsapp.net" --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

# 2. Delete Devs project (also deletes associated FC functions; --force true skips environment resource check)
aliyun devs delete-project --name "$PROJECT_NAME" --force true --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

# 3. Delete OSS Bucket (recursively delete all objects first, then delete the Bucket)
aliyun oss rm "oss://$BUCKET_NAME" -r -f --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy
aliyun oss rm "oss://$BUCKET_NAME" -b -f --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

# 4. Delete Bailian API Key (API_KEY_ID is output during create-api-key.sh execution)
aliyun modelstudio delete-api-key --api-key-id "$API_KEY_ID" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

---

Workflow Teardown

After the workflow completes (or after Cleanup), disable AI-Mode:

aliyun configure ai-mode disable

---

Cannot-via-CLI/SDK Summary

See references/related-commands.md for full CLI command reference.

Key limitation: First-time activation of FC has no CLI/API support — users must activate it manually in the console.

>

Auto-activated: OSS service via aliyun ossadmin open-oss-service (built into Step 2). Bailian workspace via aliyun modelstudio create-workspace (built into Step 1).

---

Best Practices

1. Region is fixed to cn-hangzhou (FC and OSS in the same region) 2. DashScope API Key is passed via Devs template parameters — not hardcoded 3. OSS Bucket names include a random suffix to avoid conflicts 4. Record the access URL and created resources after deployment completes

---

Reference Links

Acceptance Criteria: Build AI Animation Story Creation App

Scenario: Build AI Animation Story Creation App — Auto Deploy Purpose: Skill testing acceptance criteria

---

Correct CLI Command Patterns

1. OSS — Product: oss

✅ CORRECT

aliyun oss mb oss://my-animation-bucket --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy
aliyun oss stat oss://my-animation-bucket --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

❌ INCORRECT

# Wrong: using ossutil as separate command
ossutil mb oss://my-bucket

2. Devs — Product: devs (FC app template deployment)

✅ CORRECT

# Create project (with template config, parameter names confirmed)
aliyun devs create-project --body '{"name":"my-project","spec":{"templateConfig":{"templateName":"animation-creation","parameters":{"region":"cn-hangzhou","bailian_api_key":"sk-xxx","ossBucket":"my-bucket"}}}}' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

# Render template (must pass namespace, otherwise functionName starts with "-" causing deployment failure)
aliyun devs render-services-by-template --template-name animation-creation --project-name my-project --variable-values '{"shared":{"namespace":"my-project"}}' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

# Update environment (must use --body; --spec cannot correctly handle deeply nested JSON; must include roleArn; only comfyui and web services)
aliyun devs update-environment --project-name my-project --name production --body '{"name":"production","spec":{"roleArn":"acs:ram::123456:role/aliyundevscustomrole","stagedConfigs":{"services":{"comfyui":{...},"web":{...}}}}}' --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

# Trigger deployment
aliyun devs deploy-environment --project-name my-project --name production --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

# Query environment details
aliyun devs get-environment --project-name my-project --name production --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

❌ INCORRECT

# Wrong: using fc create-function instead of devs template (this solution requires template deployment)
aliyun fc create-function --function-name my-func --runtime python3.10 --handler index.handler

# Wrong: using old fc-open product
aliyun fc-open create-function --service-name svc --function-name func

# Wrong: using variableValues instead of parameters for template variables
aliyun devs create-project --body '{"name":"my-project","spec":{"templateConfig":{"templateName":"animation-creation","variableValues":{"bailian_api_key":{"value":"sk-xxx"}}}}}'

# Wrong: wrong parameter names (bucketName instead of ossBucket, dashScopeApiKey instead of bailian_api_key)
aliyun devs create-project --body '{"name":"my-project","spec":{"templateConfig":{"templateName":"animation-creation","parameters":{"bucketName":"my-bucket","dashScopeApiKey":"sk-xxx"}}}}'

# Wrong: putting custom-domain service in UpdateEnvironment (causes "Unknown service type" error)
aliyun devs update-environment --spec '{"stagedConfigs":{"services":{"comfyui":{...},"web":{...},"custom-domain":{...}}}}'

# Wrong: missing roleArn in UpdateEnvironment
aliyun devs update-environment --spec '{"stagedConfigs":{"services":{"comfyui":{...},"web":{...}}}}'

# Wrong: using --spec instead of --body for UpdateEnvironment (deep-nested JSON gets corrupted)
aliyun devs update-environment --spec '{"roleArn":"...","stagedConfigs":{"services":{...}}}'

# Wrong: not passing namespace to render-services-by-template (functionName becomes "-comfyui", fails FC naming rule)
aliyun devs render-services-by-template --template-name animation-creation --project-name my-project

# Wrong: expecting CreateProject to auto-deploy (it only creates project + empty environment)
# Must follow up with render → update-environment → deploy-environment

3. FC Custom Domain — Product: fc

✅ CORRECT

# Get domain verification token (use --data-urlencode)
curl -s --connect-timeout 10 --max-time 30 -A AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy -X POST "https://domain.devsapp.net/token" \
  --data-urlencode "type=fc" --data-urlencode "user=<UID>" \
  --data-urlencode "region=cn-hangzhou" --data-urlencode "service=fcv3" \
  --data-urlencode "function=<ProjectName>-web"

# Helper function uses FC 2.0 API (fc-open)
aliyun fc-open create-service --body '{"serviceName":"serverless-devs-check"}' --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy
aliyun fc-open create-function --service-name serverless-devs-check --body '<JSON>' --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

# Create FC custom domain
aliyun fc create-custom-domain --body '{"domainName":"<DOMAIN>","protocol":"HTTP","routeConfig":{"routes":[...]}}' --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

❌ INCORRECT

# Wrong: using FC trigger URL as access URL (adds Content-Disposition: attachment, browser downloads instead of rendering)
# https://<func>.cn-hangzhou.fcapp.run is NOT a valid application URL

# Wrong: using FC 3.0 API for helper function (function name with $ not supported)
aliyun fc create-function --function-name "serverless-devs-check$domain<TOKEN>" ...

# Wrong: using -F instead of --data-urlencode for curl (causes "failed to change user ID" error)
curl -X POST "https://domain.devsapp.net/token" -F "user=<UID>" ...

# Wrong: not cleaning up helper function after domain creation
# Must delete trigger, function, and service from serverless-devs-check after domain is registered

---

Key Validation Points

1. Template parameters are passed via parameters, not variableValues 2. Confirmed template parameter names: region (fixed cn-hangzhou), bailian_api_key, ossBucket 3. FC application is deployed via Devs API, not aliyun fc create-function 4. Template name is animation-creation 5. DashScope API Key — auto-created via aliyun modelstudio create-api-key (requires list-workspaces first to get workspace-id) 6. OSS Bucket creation uses aliyun oss mb 7. UpdateEnvironment must include roleArn (format: acs:ram::<UID>:role/aliyundevscustomrole) 8. UpdateEnvironment services must NOT include `custom-domain` (only comfyui and web) 9. UpdateEnvironment must use `--body`, not --spec (CLI cannot correctly serialize deeply nested JSON) 10. render-services-by-template must pass `--variable-values '{"shared":{"namespace":"<ProjectName>"}}'`, otherwise function names start with - 11. Full deployment chain: CreateProject → RenderServicesByTemplate → UpdateEnvironment → DeployEnvironment → GetEnvironment polling → Create custom domain 12. Deployment status is queried via aliyun devs get-environment, waiting for both comfyui and web latestDeployment.phase to be "Finished" 13. FC trigger URL (*.fcapp.run) cannot be used as the application URL (forces Content-Disposition: attachment) — a custom domain must be created 14. Custom domain is registered via the devsapp.net community DNS service + FC CreateCustomDomain API 15. Helper function must use FC 2.0 API (aliyun fc-open) — FC 3.0 does not support $ in function names 16. Domain format: <ProjectName>-web.fcv3.<UID>.cn-hangzhou.fc.devsapp.net 17. Access URL is the custom domain http://<DOMAIN>/ (HTTP protocol) 18. All aliyun CLI commands must include User-Agent: OSS commands use --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy, all others use --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.1+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.1 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.1)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.1+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies: Build AI Animation Story Creation App

Scenario: Build AI Animation Story Creation App (Auto Deploy)

---

Required RAM Permissions

1. Devs (Serverless Development Platform)

2. FC (Function Compute 3.0)

Devs template deployment internally requires FC permissions to create functions and triggers. Custom domain creation also requires FC permissions.

System policy: AliyunFCFullAccess

3. OSS (Object Storage Service)

System policy: AliyunOSSFullAccess

4. STS

5. RAM

6. DashScope / MaaS (Bailian)

Bailian API Key is automatically created and managed via the aliyun maas CLI plugin.

---

Recommended System Policies

Related Commands: Build AI Animation Story Creation App

Full CLI command usage and parameters are built into SKILL.md Core Workflow and scripts/ scripts. The following is a quick reference index.

Command Quick Reference

Template Parameters (parameters for create-project)

Template Variables (shared parameters for render-services-by-template)

Cannot-via-CLI/SDK

OSS service can be auto-activated via aliyun ossadmin open-oss-service (already built into SKILL.md Step 2).

Bailian workspace is auto-created via aliyun modelstudio create-workspace if none exists (built into SKILL.md Step 1).

Notes

• The OSS CLI plugin does not support the --user-agent flag (returns invalid flag) — use --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy instead
• All other aliyun commands must include --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Verification Method: Build AI Animation Story Creation App

Step-by-Step Verification

1. Verify OSS Bucket Created

aliyun oss stat oss://<OSS_BUCKET_NAME> --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Expected: Returns Bucket details (Name, Location, CreationDate, etc.)

2. Verify Project Created

aliyun devs list-environments --project-name <ProjectName> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Expected: Returns environment list containing at least one production environment

3. Verify Deployment Complete

aliyun devs get-environment --project-name <ProjectName> --name production --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Expected: status.servicesInstances.comfyui.latestDeployment.phase and status.servicesInstances.web.latestDeployment.phase are both "Finished"

4. Verify Custom Domain Created

aliyun fc get-custom-domain --domain-name <ProjectName>-web.fcv3.<UID>.cn-hangzhou.fc.devsapp.net --region cn-hangzhou --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Expected: Returns domain details with routeConfig containing <ProjectName>-web function route

5. Verify Application Accessible

curl -s --connect-timeout 10 --max-time 30 -o /dev/null -w "%{http_code}" http://<ProjectName>-web.fcv3.<UID>.cn-hangzhou.fc.devsapp.net/

Expected: HTTP 200