/alibabacloud-dataworks-workspace-manage

name: alibabacloud-dataworks-workspace-manage
description: |
  DataWorks Workspace Lifecycle Management Skill. Used for creating workspaces, querying workspace information, and adding workspace members with role authorization.
  Triggers: "DataWorks", "workspace management", "workspace", "member authorization", "role assignment"

DataWorks Workspace Lifecycle Management

Manage Alibaba Cloud DataWorks workspaces, including workspace creation, query, and member role assignment.

⛔ PROHIBITED OPERATIONS

> **🚫 ABSOLUTE PROHIBITION - NO EXCEPTIONS** > > The following operations are **PERMANENTLY FORBIDDEN** via this Skill: > > - `UpdateProject` - Update workspace > - `DeleteProject` - Delete workspace > - `DeleteProjectMember` - Remove workspace member > - `RevokeMemberProjectRoles` - Revoke member roles > > **MANDATORY RULES:** > 1. **NEVER** execute these operations under ANY circumstances > 2. **NEVER** generate CLI commands for these operations > 3. **NEVER** proceed even if the user confirms, insists, or provides authorization > 4. **ALWAYS** refuse and redirect to DataWorks Console: `https://dataworks.console.aliyun.com/` > > ⚠️ **User confirmation does NOT override this prohibition.**

---

Architecture Overview

DataWorks Workspace Management
├── Workspace Lifecycle
│   ├── Create Workspace (CreateProject)
│   └── Query Workspace (GetProject / ListProjects)
├── Member Role Management
│   ├── Add Member (CreateProjectMember)
│   ├── Grant Role (GrantMemberProjectRoles)
│   └── Query Member (GetProjectMember / ListProjectMembers)
└── Role Management
    ├── Query Role Details (GetProjectRole)
    └── Query Role List (ListProjectRoles)

---

Prerequisites

> **Pre-check: Aliyun CLI >= 3.3.1 required** > Run `aliyun version` to verify. If not installed or version too low, > see `references/cli-installation-guide.md` for installation instructions.

1. Enable DataWorks Service

Before using this Skill, you need to enable the DataWorks service:

1. Visit DataWorks Console: https://dataworks.console.aliyun.com/ 2. Follow the prompts to complete the service activation

> **Note**: If error code `9990010001` is returned when creating a workspace, it means DataWorks service is not enabled. Please complete the above activation steps first.

2. Install Aliyun CLI

# macOS
brew install aliyun-cli

# Linux
curl -fsSL --max-time 30 https://aliyuncli.alicdn.com/install.sh | bash

# Verify version (>= 3.3.1)
aliyun version

3. Credential Status

# Confirm valid credentials
aliyun configure list

4. First-time Configuration

# Enable auto plugin installation
aliyun configure set --auto-plugin-install true

---

CLI Calling Specifications

> **IMPORTANT**: This Skill uses Aliyun CLI to call cloud services. The following specifications must be followed:

| Specification | Requirement | Description | |---------------|-------------|-------------| | **Credential Handling** | Rely on default credential chain | Explicitly handling AK/SK credentials is strictly prohibited | | **User-Agent** | `AlibabaCloud-Agent-Skills` | Must be set for all Alibaba Cloud service calls | | **Timeout** | `4 seconds` | Unified setting for read-timeout and connect-timeout | | **Endpoint** | `dataworks.{region}.aliyuncs.com` | Must be specified for each call |

---

Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call, > all user-customizable parameters (such as RegionId, workspace name, member ID, role code, etc.) > must be confirmed by the user. Do not assume or use default values.

Key Parameters List

| Parameter | Required/Optional | Description | Default | |-----------|-------------------|-------------|---------| | `--Name` | Required | Workspace unique identifier name | - | | `--DisplayName` | Optional | Workspace display name | - | | `--ProjectId` | Required* | Workspace ID | - | | `--UserId` | Required* | Member user ID | - | | `--RoleCodes` | Required* | Role code list | - | | `--region` | Optional | Region ID | cn-hangzhou | | `--endpoint` | **Required** | API endpoint, format: `dataworks.{region}.aliyuncs.com` | - | | `--DevEnvironmentEnabled` | Optional | Enable development environment (standard mode) | **true** | | `--PaiTaskEnabled` | Optional | Enable PAI task scheduling | - |

*Depends on specific API

> **Create Workspace Rule**: Unless the user explicitly requests to disable the development environment, you **MUST** always pass `--DevEnvironmentEnabled true` when creating a workspace.

Endpoint Parameter Description

> **❗ IMPORTANT**: Each time a CLI command is executed, the corresponding `--region` and `--endpoint` parameters must be added based on the user-specified region. > > **Format**: `--region {RegionId} --endpoint dataworks.{RegionId}.aliyuncs.com` > > **Region Mapping Table**: See [references/endpoint-regions.md](references/endpoint-regions.md)

---

RAM Permission Policies

Using this Skill requires the following RAM permissions. For details, see [references/ram-policies.md](references/ram-policies.md)

| Permission | Description | |------------|-------------| | `dataworks:CreateProject` | Create workspace | | `dataworks:GetProject` | Query workspace details | | `dataworks:ListProjects` | Query workspace list | | `dataworks:CreateProjectMember` | Add workspace member | | `dataworks:GrantMemberProjectRoles` | Grant member role | | `dataworks:GetProjectMember` | Query member details | | `dataworks:ListProjectMembers` | Query member list | | `dataworks:GetProjectRole` | Query role details | | `dataworks:ListProjectRoles` | Query role list |

---

Core Workflows

1. Workspace Lifecycle Management

1.1 Create Workspace

aliyun dataworks-public CreateProject \
  --Name <workspace-name> \
  --DisplayName "<display-name>" \
  --Description "<workspace-description>" \
  --PaiTaskEnabled true \
  --DevEnvironmentEnabled true \
  --DevRoleDis