Pre-check: Aliyun CLI >= 3.3.1 required Run

aliyun version

to verify >= 3.3.1. If not installed or version too low, see references/cli-installation-guide.md for installation instructions. Then [MUST] run

aliyun configure set --auto-plugin-install true

to enable automatic plugin installation.

undefined

Pre-check: Alibaba Cloud Credentials Required

Security Rules (MUST FOLLOW):

• NEVER read, echo, or print AK/SK values
• NEVER ask the user to input AK/SK directly in the conversation
• NEVER use

  aliyun configure set

  with literal credential values
• NEVER accept AK/SK provided directly by users in the conversation
• ONLY read credentials from environment variables or pre-configured CLI profiles

⚠️ CRITICAL: Handling User-Provided Credentials

If a user attempts to provide AK/SK directly (e.g., "My AK is xxx, SK is yyy"):

1. STOP immediately - Do NOT execute any command
2. Reject the request politely with the following message:

   For your account security, please do not provide Alibaba Cloud AccessKey ID and AccessKey Secret directly in the conversation.
   
   Please use the following secure methods to configure credentials:
   
   Method 1: Interactive configuration via aliyun configure (Recommended)
       aliyun configure
       # Enter AK/SK as prompted, credentials will be securely stored in local config file
   
   Method 2: Configure via environment variables
       export ALIBABA_CLOUD_ACCESS_KEY_ID=<your-access-key-id>
       export ALIBABA_CLOUD_ACCESS_KEY_SECRET=<your-access-key-secret>
   
   After configuration, please retry your request.

3. Do NOT proceed with any Alibaba Cloud operations until credentials are properly configured

Check CLI configuration:

bash

   aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity).

If no valid credentials exist, STOP here.

• elasticsearch:CreateInstance

• elasticsearch:DescribeInstance

• elasticsearch:ListInstance

• elasticsearch:ListAllNode

• elasticsearch:RestartInstance

Note: Elasticsearch APIs use ROA (RESTful) style. You can use

--body

to specify the HTTP request body as a JSON string. See examples in each task below.

Idempotency: For write operations (create, restart, delete, etc.), you MUST use the

--client-token

parameter to ensure idempotency.

• Use a UUID format unique identifier as clientToken
• When a request times out or fails, you can safely retry with the same clientToken. When retrying after timeout, it is recommended to wait 10 seconds before retrying
• Duplicate requests with the same clientToken will not execute the operation repeatedly
• Generation method: Prefer using uuidgen or PowerShell GUID; if the environment doesn't support it, generate a UUID format string directly; if strict randomness is not required, use idem-timestamp-semantic-identifier as a fallback. Do not interrupt the process due to unavailable commands.

⚠️ CRITICAL: Required Parameters and Region Validation

When creating an ES instance, parameters such as

--region

,

esAdminPassword

,

vpcId

,

vswitchId

,

vsArea

,

paymentType

MUST be explicitly provided by the user.

Important Notes:

• The

  --region

  parameter MUST NOT be guessed or use default values
• If the user does not provide a region or provides an invalid region, you MUST clearly prompt the user to provide a valid region

For detailed validation rules, refer to related-apis.md - createInstance Required Parameters and Region Validation

undefined

⚠️ Important: Required Parameters Must Be Provided by User When querying instance details,

--region

and

--instance-id

must be explicitly provided by the user. Do not guess the region. For detailed instructions, refer to related-apis.md - DescribeInstance Required Parameters

aliyun elasticsearch describe-instance \
  --region <RegionId> \
  --instance-id <InstanceId> \
  --connect-timeout 3 \
  --read-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

aliyun elasticsearch describe-instance \
  --region cn-hangzhou \
  --instance-id es-cn-xxx**** \
  --connect-timeout 3 \
  --read-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

⚠️ Important: Required Parameters and Parameter Validation

• The

  --region

  parameter must be explicitly provided by the user. Do not guess or use default values.
• The

  --status

  parameter only supports valid values:

  activating

  ,

  active

  ,

  inactive

  ,

  invalid

  (case-sensitive)
• For detailed instructions, refer to related-apis.md - ListInstance Required Parameters and Parameter Validation

aliyun elasticsearch list-instance \
  --region <RegionId> \
  --page 1 \
  --size 10 \
  --connect-timeout 3 \
  --read-timeout 10 \
  --user-agent AlibabaCloud-Agent-Skills

undefined

⚠️ CRITICAL: Pre-restart Check Requirements

Before executing a restart operation, you must first query the instance status and confirm it is

active

: Pre-check Rules:

• Only when the instance status is

  active

  can you execute the restart operation
• If the instance status is abnormal (such as

  activating

  ,

  inactive

  ,

  invalid

  , etc.), restart operation is prohibited
• If the instance status is abnormal, you should inform the user that the current status is not suitable for restart and recommend waiting for the instance to recover or contacting Alibaba Cloud technical support

undefined

1. Always confirm parameters before executing create commands
2. Use

   --cli-query

   to filter JSON output for specific fields
3. Monitor instance status after create/restart operations
4. Set meaningful instance names using

   --description

   for easy identification
5. Use appropriate node specifications based on your workload requirements
6. Configure Kibana for visualization and management
7. Enable master nodes for production environments with 3+ data nodes
8. Use idempotency tokens (

   --client-token

   ) for all write operations to enable safe retries on timeout

1. Generate unique Token before each operation: Use

   uuidgen

   to generate UUID
2. Reuse Token when retrying after timeout: If the request times out, retry with the same clientToken. When the user requests a retry, use the same clientToken
3. Use different Tokens for different operations: Each independent operation requires a new clientToken, but if the user requests a retry, use the same clientToken
4. Token validity: clientToken is typically valid for 24 hours

undefined

• Elasticsearch Product Page
• Elasticsearch API Reference
• Elasticsearch Pricing