/alibabacloud-rds-instances-manage

name: alibabacloud-rds-instances-manage
description: |
  Query and manage Alibaba Cloud RDS instances in the user's own account through Alibaba Cloud CLI and official RDS, VPC, BssOpenApi, and DAS OpenAPIs.
  Use for listing or inspecting RDS instances, zones, classes, performance, logs, parameters, databases, accounts, networks, whitelists, bills, and SQL insight statistics, or for explicitly requested instance creation, parameter/specification/description changes, account creation, whitelist changes, public endpoint allocation, whitelist-template attachment, tagging, restart, and instance deletion.
  Do not use this skill to diagnose incidents, troubleshoot performance anomalies, or perform root-cause analysis; it only queries current RDS instance state and executes the explicitly supported instance-management operations.

Alibaba Cloud RDS Instances Manage

Serve as an RDS instance inventory and lifecycle operations agent. Use Alibaba Cloud CLI as the only cloud API execution layer. Query the user's current cloud state before making recommendations or changes.

Architecture

Use these boundaries:

• `aliyun rds <lowercase-command>` for RDS 2014-08-15 instance APIs.
• `aliyun vpc <lowercase-command>` for VPC 2016-04-28 network discovery.
• `aliyun bssopenapi <lowercase-command>` for BssOpenApi 2017-12-14 billing queries.
• `aliyun das <lowercase-command>` for DAS 2020-01-16 performance insight queries.
• Local `date` for `get_current_time`; do not represent it as OpenAPI.

Keep detailed action parameters in [references/related-apis.md](references/related-apis.md). Read the relevant action section before constructing a command.

Agent Execution Contract

Make the local environment ready when command execution is available. Do not ask the user to install or upgrade Alibaba Cloud CLI when the agent can do it after obtaining any required tool approval.

Do not run a business API until all readiness gates pass:

1. `aliyun` exists and `aliyun version` is `3.3.3` or newer. 2. The required product plugin and action appear in `aliyun <product> --help` and `aliyun <product> <lowercase-command> -h`. 3. The selected Alibaba Cloud CLI profile is configured and valid. 4. The region and all required action parameters are known.

If a current public action is absent from an old CLI, upgrade the CLI. Do not silently switch to an SDK, an internal RPC action, or a guessed API name.

Default the RDS/VPC target region to `cn-hangzhou` only when the user omits a region. Always invoke DAS 2020-01-16 through its `cn-shanghai` control-plane region, even when the target RDS instance is in another region.

Installation and Preflight

Run the readiness checks once at the start of every task:

command -v aliyun
aliyun version
aliyun configure set --auto-plugin-install true
aliyun plugin list
aliyun rds --help
aliyun configure list

Upgrade versions below `3.3.3` before using this skill. Re-run the checks after an upgrade.

Check only the products needed for the user's request:

aliyun rds describe-db-instances -h
aliyun vpc describe-vpcs -h
aliyun bssopenapi describe-instance-bill -h
aliyun das get-pfs-sql-summaries -h

If a required product plugin is unavailable, install its short name with `aliyun plugin install --names <product>` and repeat the action check.

Do not add the skill User-Agent to `command -v`, `aliyun version`, `aliyun configure`, `aliyun help`, install, or upgrade commands.

Credential Configuration

Use an existing valid profile when possible. Prefer interactive configuration when credentials are missing:

aliyun configure --mode AK --profile rds-manage

Use `cn-hangzhou` as the configured region unless the user chooses another default.

Never:

• Put AccessKey IDs, AccessKey secrets, STS tokens, database passwords, or signatures in tracked files.
• Ask the user to export long-lived credentials as environment variables.
• Print raw `--cli-dry-run` output without reviewing it for sensitive request parameters.
• Infer that a profile belongs to a requested account solely from its name.

When identity must be verified, call STS and compare the returned `AccountId` with the expected account before any cloud operation:

aliyun sts get-caller-identity --profile <profile>

Observability

Generate one 32-character lowercase hexadecimal session ID per user task and reuse it across all business API calls in that task:

openssl rand -hex 16

Use this per-command User-Agent:

AlibabaCloud-Agent-Skills/alibabacloud-rds-instances-manage/{session-id}

Example:

aliyun rds describe-db-instances \
  --biz-region-id cn-hangzhou \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-instances-manage/{session-id}' \
  --profile <profile>

Do not use a deprecated global User-Agent configuration.

Core Workflow

1. Resolve Intent and Parameters

Classify the request as read-only or mutating. Resolve the exact capability name and OpenAPI Action from the capability table below.

For every regional request:

• Preserve the user's explicit region.
• Use `cn-hangzhou` only when omitted.
• Pass plugin flag `--biz-region-id` when the action defines the OpenAPI `RegionId` parameter.
• Otherwise pass the Alibaba Cloud CLI global `--region` option.

Convert user-facing snake_case fields to the lowercase-hyphenated plugin flags documented by Alibaba Cloud CLI. Always invoke both actions and parameters in lowercase-hyphenated form (for example, `aliyun rds describe-db-instance-attribute --db-instance-id <id>`); never use PascalCase action names or flags such as `DescribeDBInstanceAttribute --DBInstanceId`.

2. Execute Read-only Operations

Run read-only actions without an additional confirmation after the readiness gates pass. Before claiming results are complete:

• Follow `NextToken` or page-number pagination when the request asks for all results.
• State the regions queried for regional APIs.
• Preserv