/alibabacloud-pai-quota-management

name: alibabacloud-pai-quota-management
domain: aiops
description: |
  End-to-end Alibaba Cloud PAI Quota lifecycle management via `aliyun paistudio` (Quota CRUD, scale,
  workload inspection) and `aliyun aiworkspace` (binding Quotas to Workspaces). Covers root and child
  quota creation, absolute scaling, metadata update, deletion, listing quota workloads / active user
  usages, plus attaching and detaching quotas to PAI workspaces. Use when the user asks to list / get /
  create / update / scale / delete PAI quotas, inspect quota workloads or active users, or attach /
  detach quotas to a workspace. Trigger phrases: "PAI quota", "create PAI quota", "scale PAI quota",
  "child quota", "quota tree", "bind quota to workspace", "list PAI quotas", "Lingjun quota",
  "PAI 资源配额", "Quota 扩缩容".
required_permissions:
  - pai:ListQuotas
  - pai:GetQuota
  - pai:CreateQuota
  - pai:UpdateQuota
  - pai:ScaleQuota
  - pai:DeleteQuota
  - pai:ListQuotaWorkloads
  - pai:ListQuotaActiveUserUsages
  - pai:GetResourceGroup
  - pai:ListResourceGroups
  - pai:UpdateResourceGroup
  - aiworkspace:ListWorkspaces
  - aiworkspace:GetWorkspace
  - aiworkspace:ListResources
  - aiworkspace:CreateWorkspaceResource
  - aiworkspace:UpdateWorkspaceResource
  - aiworkspace:DeleteWorkspaceResource
  - vpc:DescribeVpcs
  - vpc:DescribeVSwitches
  - ecs:DescribeSecurityGroups

PAI Quota Management

0. Observability (MUST follow for every aliyun command)

Upon loading this skill, generate a random session ID (32-char hex string) once for the entire session. Use it as `{session-id}` below.

**Rule: Every `aliyun` CLI command that calls a cloud API MUST include the `--user-agent` flag.** Local utility commands (e.g. `configure`, `plugin`, `version`) do not support this flag and should be excluded.

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-quota-management/{session-id}

Example (assuming session-id is `a]1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6`):

aliyun ecs describe-instances --biz-region-id cn-hangzhou --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-quota-management/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

Do not skip, alter the format, or omit `--user-agent` on any `aliyun` command invocation.

**Plugin freshness (one-time per session, optional system command — NO `--user-agent`):**

aliyun plugin update

Every command omits the `--user-agent` flag for readability. **The agent MUST append it to every actual business API invocation** following the rules above. Missing or malformed `--user-agent` on a business API call is a workflow violation.

1. Scenario Description

Manage the full lifecycle of Alibaba Cloud PAI **Quotas** via the `aliyun paistudio` CLI plugin (and `aliyun aiworkspace` for workspace binding). Quotas carve a ResourceGroup's capacity into tree-structured allocations (root -> children), are scaled in absolute terms via `scale-quota`, and are attached to PAI workspaces via the `aiworkspace` product.

Architecture: `ResourceGroup(s) -> root Quota -> child Quota(s) -> Workspace binding`.

2. Installation & Auth

• Aliyun CLI >= 3.3.3 with the `paistudio` and `aiworkspace` plugins. See `references/cli-installation-guide.md`.
• The agent NEVER reads / echoes / writes AK/SK. Verify only via `aliyun configure list`.

3. Environment Variables

| Env | Required | Notes | | --- | --- | --- | | `REGION_ID` | Yes | e.g. `cn-shanghai`, `cn-wulanchabu`. | | `QUOTA_ID` | When operating on a specific quota | From `list-quotas`. | | `WORKSPACE_ID` | For workspace binding | From `aliyun aiworkspace list-workspaces`. |

4. RAM Policy

See `references/ram-policies.md` for full read-only and read-write policy JSON. On `Forbidden.RAM` / `NoPermission`, STOP, print the failing `Action` and `Resource`, and direct the user to attach the missing action. Do NOT use wildcards.

5. Parameter Confirmation

| Parameter | Required | Source / Validation | Default | | --- | --- | --- | --- | | `RegionId` | Yes | `aliyun configure get region`. | None | | `QuotaName` | Create / rename | 1-63 chars. | None | | `ResourceType` | Create | **Derived — NOT user-supplied.** Root: from `get-resource-group`. Child: from `get-quota` on parent. Enum: `ECS`, `Lingjun`, `ACS`. | None | | `ResourceGroupIds` | Create root | Space-separated list (repeated positional). | None | | `ParentQuotaId` | Create child | From `list-quotas --layout-mode Tree`. | None | | `AllocateStrategy` | Create | Enum: `ByNodeSpecs`, `ByMachineGroupIds`. | `ByNodeSpecs` | | `Min` | Create / scale | JSON, e.g. `{"NodeSpecs":[{"NodeSpec":"ecs.gn7i-c8g1.2xlarge","Count":4}]}`. | None | | `QuotaConfig` | Update VPC / queue | JSON. See `references/validation-rules.md` §4 for VPC mutability. | None | | `QueueStrategy` | Update | Enum: `PaiStrategyIntelligent` (auto), `PaiStrategyStrictFIFO` (FIFO), `PaiStrategyBalance` (fair), `PaiStrategyRoundRobin` (round-robin). Case-sensitive. | None | | `Labels` | Update | Space-separated `Key=K Value=V` pairs. | None | | `WorkspaceId` | Binding | From `aliyun aiworkspace list-workspaces`. | None |

6. Core Workflow

> **[MUST] Use the `aliyun` CLI exclusively.** No raw HTTP, no SDK, no MCP tool, no console clicks, no Yuque/internal endpoints. If the CLI does not expose a capability, treat it as not implementable (`references/not-implementable.md`). > > **[MUST] Observability — per-command `--user-agent`**: see §0. Every business API call (`aliyun paistudio …`, `aliyun aiworkspace …`), including `--cli-dry-run` and read-only `list-*` / `get-*`, MUST carry `--user-agent "AlibabaCloud-Agent-Skills/alibabacloud-pai-quota-management/{session-id}"` with the real session id substituted in. Code samples below omit the flag for readability — the agent MUST append it on every actual invocation.

Confirmation Gate — HARD STOP (Create / Update / Scale / Delete / Detach)

> **[CRITICAL — HIGHEST PRIORITY RULE]** > > The agent is **ABSOLUTELY FORBIDDEN** from executing `create-quota`, `upd