/alibabacloud-pai-resource-group-management

name: alibabacloud-pai-resource-group-management
domain: aiops
description: |
  End-to-end Alibaba Cloud PAI ResourceGroup (resource pool) lifecycle management via `aliyun paistudio`.
  Covers list / get / create / update / delete of ResourceGroups (general computing ECS or Lingjun GPU),
  read-only inspection of MachineGroups, and bind/unbind UserVpc.
  Use when the user asks to list / get / create / update / delete PAI resource groups, inspect machine
  groups, bind/unbind UserVpc, or audit resource-group capacity. Trigger phrases: "PAI resource
  group", "PAI resource pool", "Lingjun resource group", "create PAI resource group", "list PAI resource
  groups", "PAI machine group", "Lingjun resource group (灵骏资源组)", "PAI resource pool (PAI 资源池)", "PAI 资源组".
required_permissions:
  - pai:ListResourceGroups
  - pai:GetResourceGroup
  - pai:CreateResourceGroup
  - pai:UpdateResourceGroup
  - pai:DeleteResourceGroup
  - pai:ListResourceGroupMachineGroups
  - pai:GetResourceGroupMachineGroup
  - vpc:DescribeVpcs
  - vpc:DescribeVSwitches
  - ecs:DescribeSecurityGroups

PAI ResourceGroup Management

Observability (MUST follow for every aliyun command)

Upon loading this skill, generate a random session ID (32-char hex string) once for the entire session. Use it as `{session-id}` below.

**Rule: Every `aliyun` CLI command that calls a cloud API MUST include the `--user-agent` flag.** Local utility commands (e.g. `configure`, `plugin`, `version`) do not support this flag and should be excluded.

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-resource-group-management/{session-id}

Example (assuming session-id is `a]1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6`):

aliyun ecs describe-instances --biz-region-id cn-hangzhou --user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-resource-group-management/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

Do not skip, alter the format, or omit `--user-agent` on any `aliyun` command invocation.

**Business API commands ONLY:** `aliyun paistudio list-resource-groups`, `aliyun paistudio get-resource-group`, `aliyun paistudio create-resource-group`, `aliyun paistudio update-resource-group`, `aliyun paistudio delete-resource-group`, `aliyun paistudio list-resource-group-machine-groups`, `aliyun paistudio get-resource-group-machine-group`, etc.

**MUST NOT be added to system / configuration commands:** `aliyun configure list`, `aliyun configure get`, `aliyun plugin update`, `aliyun plugin list`, `aliyun version`. These are local CLI utilities, not business API calls, and do not accept `--user-agent`.

1. Scenario Description

Manage the full lifecycle of Alibaba Cloud PAI **ResourceGroups** (resource pools) via the `aliyun paistudio` CLI plugin: list / get / create / update / delete ResourceGroups (ECS general computing or Lingjun GPU), **read-only** inspection of attached MachineGroups, and bind/unbind UserVpc. ResourceGroups are the source of capacity that Quotas later carve up.

> **⚠️ Metrics APIs Deprecated**: `get-resource-group-total`, `get-resource-group-request`, `get-user-view-metrics`, `get-node-metrics` are all deprecated and NOT supported by this skill.

> **🚫 MachineGroup deletion / release is OUT OF SCOPE.** The agent is **STRICTLY FORBIDDEN** from invoking `delete-resource-group-machine-group` or `delete-machine-group` under any circumstance. Direct users to the [PAI Console](https://pai.console.aliyun.com/) (BSS purchase / release flow). See `references/not-implementable.md`.

Architecture: `PAI ResourceGroup → MachineGroup(s) → Node(s)` with optional `UserVpc (VpcId + SwitchId + SecurityGroupId)` binding. ECS general-computing ResourceGroups may bind to any user VPC; Lingjun VPC is managed at the Lingjun infrastructure layer.

2. Installation & Auth

• Aliyun CLI ≥ 3.3.3 with `paistudio` plugin — see `references/cli-installation-guide.md`.
• The agent NEVER reads / echoes / writes AK/SK. Verify only via `aliyun configure list`; if unconfigured, instruct the user to run `aliyun configure` themselves.

3. Environment Variables

| Env | Required | Notes | | --- | --- | --- | | `REGION_ID` | Yes | e.g. `cn-shanghai`, `cn-hangzhou`, `cn-wulanchabu` (Lingjun). | | `RESOURCE_GROUP_ID` | When operating on a specific RG | Obtained from `list-resource-groups`. | | `MACHINE_GROUP_ID` | When operating on a specific MG | Obtained from `list-resource-group-machine-groups`. |

4. RAM Policy

See `references/ram-policies.md` for full read-only and read-write policy JSON. Minimum read scope:

{
  "Version": "1",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "pai:GetResourceGroup", "pai:ListResourceGroups",
      "pai:GetMachineGroup", "pai:GetResourceGroupMachineGroup",
      "pai:ListResourceGroupMachineGroups"
    ],
    "Resource": ["acs:pai:*:*:resourcegroup/*"]
  }]
}

Permission failure handling: see `references/validation-rules.md` §5.

5. Parameter Confirmation

Before invoking any mutating CLI command, the agent MUST print and confirm:

| Parameter | Required | Source / Validation | Default | | --- | --- | --- | --- | | `RegionId` | Yes | `aliyun configure get region` or env `REGION_ID`. | None | | `Name` | Create / rename | 1-63 chars, kebab-case recommended. **Cannot be empty string on update.** | None | | `ResourceType` | Create | Enum: `ECS`, `Lingjun`. **⚠️ ACS variants OFFLINE** — see `references/validation-rules.md` §2 row C. | `ECS` (if empty) | | `Version` | Create (ECS only) | Enum: `1.0`, `2.0`. ECS v2.0 forbids VPC on RG (VPC goes on Quota). | `1.0` (ECS default) | | `UserVpc.VpcId` / `SwitchId` / `SecurityGroupId` | If binding VPC (ECS v1.0 only) | All three required as a trio (PascalCase). Forbidden for ECS v2.0 / Lingjun. See `references/validation-rules.md` §3. | None | | `ResourceGroupId` | Update / delete / get | Obtained from `list-resource-groups`. | None | | `MachineGroupId` | MG operations | Obtained from `list-resource-group-machine-groups`. | None |

> 🚦 **Pre-executi