/alibabacloud-dms-data-agent-platform-setup

name: alibabacloud-dms-data-agent-platform-setup
description: Create an agent platform instance in DMS via Alibaba Cloud OpenAPI. Supports Simple Mode and Advanced Mode. Use this skill when the user wants to provision, deploy, or set up a new Dify instance on Alibaba Cloud DMS.

Create Dify Instance

Provision a Dify instance automatically via Alibaba Cloud OpenAPI. Supports **Simple Mode** (create all resources from scratch) and **Advanced Mode** (fine-grained control over each component).

Prerequisites

1. Check Aliyun CLI

> **[REQUIRED] Verify Aliyun CLI version >= 3.3.1 before proceeding.**

aliyun version

If the command is not found or the version is below 3.3.1, install or upgrade:

**macOS (Homebrew, recommended)**

brew install aliyun-cli
# Upgrade if already installed
brew upgrade aliyun-cli

After installation, enable automatic plugin installation:

aliyun configure set --auto-plugin-install true

2. Observability — Session ID & User-Agent

> **[REQUIRED] Generate a session-id at the start of every skill session. Use it consistently across ALL CLI commands and Python SDK calls.**

Session-ID Generation Rule

• Generate **once per session**, reuse throughout the entire workflow
• Format: **32-character lowercase hex string** (e.g., `openssl rand -hex 16`)
• Must be consistent across CLI / SDK / Terraform within the same session

export SKILL_SESSION_ID=$(openssl rand -hex 16)

User-Agent Template

AlibabaCloud-Agent-Skills/alibabacloud-dms-data-agent-platform-setup/{session-id}

• **Python scripts** (`detect_dify_instance.py`, `openAPI_call.py`): read `SKILL_SESSION_ID` from environment automatically
• **Aliyun CLI commands**: inject via `--user-agent` flag on each command:

aliyun dms-enterprise <action> \
  --endpoint dms-enterprise.aliyuncs.com \
  --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-dms-data-agent-platform-setup/${SKILL_SESSION_ID}"

> **Do NOT use `aliyun configure ai-mode set-user-agent` (deprecated). Always use per-command `--user-agent` injection.**

3. Configure Alibaba Cloud Credentials

> **[REQUIRED] Both credential sets must be configured — Aliyun CLI credentials AND Python SDK credentials. Neither can be omitted.** > **NEVER read, echo, or print AK/SK values.**

This skill performs two types of operations, each using a different credential method:

• **Query instance list** (`aliyun dms-enterprise list-instances`): uses Aliyun CLI credentials
• **Provision Dify instance** (`openAPI_call.py`): uses the Alibaba Cloud default credential chain

3a. Configure Aliyun CLI Credentials

aliyun configure list

Confirm that a valid profile exists in the output (AK, STS, or OAuth).

**If no valid profile exists, stop and prompt the user to:** 1. Obtain an AccessKey from the [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak) 2. Configure credentials outside of this session to avoid exposing secrets:

   aliyun configure set \
     --mode AK \
     --access-key-id <your-access-key-id> \
     --access-key-secret <your-access-key-secret> \
     --region cn-hangzhou

3. Re-run `aliyun configure list` to confirm the profile is active

3b. Configure Python Script Credentials

`openAPI_call.py` uses the Alibaba Cloud default credential chain — no environment variables need to be set manually. The SDK automatically resolves credentials in the following order: environment variables, credentials file, instance RAM role, etc.

Configure your credentials by following the official guide: [Alibaba Cloud Python SDK v2 — Manage Access Credentials](https://help.aliyun.com/zh/sdk/developer-reference/v2-manage-python-access-credentials#3ca299f04bw3c)

> **NEVER hardcode AK/SK values in code or pass them as command-line arguments.**

4. Python Environment

It is recommended to use [uv](https://docs.astral.sh/uv/) to create an isolated virtual environment with pinned dependencies:

uv venv .venv
uv pip install --python .venv/bin/python -r scripts/requirements.txt

`requirements.txt` is provided in `./scripts/`.

Script Location

• `./scripts/detect_dify_instance.py` — Check whether the DMS Dify service is available in the target region
• `./scripts/openAPI_call.py` — Provision a Dify instance

> Run commands from the directory containing this `SKILL.md` file.

---

Pre-check: Verify DMS Service Availability

> **[REQUIRED] Before running `openAPI_call.py`, run `detect_dify_instance.py` to verify that the DMS service is accessible in the target region.**

.venv/bin/python ./scripts/detect_dify_instance.py <region-id>

Example:

.venv/bin/python ./scripts/detect_dify_instance.py cn-shanghai

• If the API returns an empty list (`[]`), that is normal — it means no Dify instances exist yet, but the service is available.
• If the API returns an error, prompt the user to enable the DMS service in the [Alibaba Cloud Console](https://dms.aliyun.com) before proceeding.

---

Simple Mode

All components (Workspace, database, KV store, vector database) are newly created.

Parameters to Collect from User

| Parameter | Description | |-----------|-------------| | `VpcId` | VPC ID | | `VSwitchId` | VSwitch ID | | `BackupVSwitchId` | Backup VSwitch ID | | `SecurityGroupId` | Security Group ID | | `ZoneId` | Availability Zone ID | | `DataRegion` | Data region | | `WorkspaceName` | Name for the new Workspace | | Account | Database account (used for DbInstanceAccount, KvStoreAccount, VectordbAccount; default: `dify_user`) | | Password | Database password (used for DbInstancePassword, KvStorePassword, VectordbPassword) | | `DryRun` | Recommended: set to `true` for a dry run first, then `false` to provision |

Execution Command

.venv/bin/python ./scripts/openAPI_call.py '{
    "VpcId": "<VpcId>",
    "VSwitchId": "<VSwitchId>",
    "BackupVSwitchId": "<BackupVSwitchId>",
    "SecurityG