Pre-check: Aliyun CLI >= 3.3.3 required Run

aliyun version

to verify >= 3.3.3. If not installed or version too low, run

curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

to update, or see

references/cli-installation-guide.md

for installation instructions.

undefined

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters (e.g., RegionId, instance names, white IPs, VPC IDs, security groups, etc.) MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

InstanceId

RegionId

nodeType

networkType

actionType

resourceGroupId

whiteIpGroup

whiteIpType

Pre-check: Alibaba Cloud Credentials Required

Security Rules:

• NEVER read, echo, or print AK/SK values
• NEVER ask user to input AK/SK in conversation or command line
• ONLY use

  aliyun configure list

  to check credential status

bash

aliyun configure list

If no valid credentials, guide user to run

aliyun configure

in terminal (never accept plaintext AK/SK in chat). Credential portal: Alibaba Cloud RAM Console

Prerequisite: Instance Status Check

Before executing any network configuration operation, verify that the instance status is

active

. Network configuration changes cannot be executed when instance status is

activating

,

invalid

, or

inactive

.

bash

# Check instance status with retry logic
max_retries=10
retry_count=0
while [ $retry_count -lt $max_retries ]; do
  status=$(aliyun elasticsearch describe-instance \
    --instance-id <InstanceId> \
    --read-timeout 30 \
    --user-agent AlibabaCloud-Agent-Skills/alibabacloud-elasticsearch-network-manage | jq -r '.Result.status')

  if [ "$status" == "active" ]; then
    echo "✅ Instance status is active, proceeding..."
    break
  else
    echo "⚠️ Instance status is $status, waiting 30s before retry..."
    sleep 30
    retry_count=$((retry_count + 1))
  fi
done

if [ $retry_count -eq $max_retries ]; then
  echo "❌ Instance did not become active after $max_retries retries, aborting"
  exit 1
fi

Scope: Supports all network types on basic management instances. On cloud-native instances, supports cluster public/private network and Kibana public network. For Kibana private network on cloud-native instances, use EnableKibanaPvlNetwork / DisableKibanaPvlNetwork instead.

nodeType

networkType

actionType

undefined

Prerequisites: Only supports cloud-native instances (archType=public), Kibana spec must be > 1 core 2GB. For basic management instances, use TriggerNetwork.

endpointName

{InstanceId}-kibana-endpoint

securityGroups

vSwitchIdsZone

vSwitchIdsZone[].vswitchId

vSwitchIdsZone[].zoneId

vpcId

Pre-check: Call DescribeInstance first to check

Result.enableKibanaPrivateNetwork

. If already enabled, compare current config (vpcId, vswitchId, securityGroups) with user requirements. If they match, skip and inform user config is already correct.

undefined

Check if current config matches user requirements

Prerequisites: This API only supports cloud-native instances (archType=public). For basic management instances, use TriggerNetwork.

aliyun elasticsearch disable-kibana-pvl-network \
  --instance-id <InstanceId> \
  --read-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-elasticsearch-network-manage

1. IP White List Method: Use

   whiteIpList

   +

   nodeType

   +

   networkType

2. IP White Group Method: Use

   modifyMode

   +

   whiteIpGroup

Notes:

• Cannot update when instance status is activating, invalid, or inactive
• Public network white list does not support private IPs; private network white list does not support public IPs
• Kibana private network white list for cloud-native instances (archType=public) cannot be modified via this API. Use UpdateKibanaPvlNetwork API to modify security groups instead (see Task 7)

whiteIpList

nodeType

networkType

undefined

Pre-check: Call DescribeInstance first to check

Result.protocol

. If already

HTTPS

, skip OpenHttps and inform user HTTPS is already enabled.

undefined

Enable HTTPS

---

Pre-check: Call DescribeInstance first to check

Result.protocol

. If already

HTTP

, skip CloseHttps and inform user HTTPS is already disabled.

undefined

Disable HTTPS

---

Prerequisites:

1. This API only supports cloud-native instances (archType=public). For basic management instances, use TriggerNetwork.
2. Kibana specification must be greater than 1 core 2GB.
3. Instance must have Kibana private network access enabled.

InstanceId

pvlId

{InstanceId}-kibana-internal-internal

endpointName

securityGroups

undefined

Prerequisites: This API only supports cloud-native instances (archType=public).

Pre-check: Call DescribeInstance to check

Result.enableKibanaPublicSSO

/

Result.enableKibanaPrivateSSO

. If desired state already achieved, skip the call.

undefined

1. Cloud-native Kibana: Private network uses EnableKibanaPvlNetwork/DisableKibanaPvlNetwork. Whitelist via UpdateKibanaPvlNetwork. SSO via UpdateKibanaSso (archType=public only).
2. Security: Use 0.0.0.0/0 with caution. Enable HTTPS in production.
3. Reliability: Use clientToken for idempotency. Retry on

   InstanceStatusNotSupportCurrentAction

   /

   ConcurrencyUpdateInstanceConflict

   (wait 30-60s). Check current state before changes, skip if desired state already achieved.