cloud-create-project
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseCreate Serverless Project
创建Serverless项目
Create Elastic Cloud Serverless projects using the Serverless REST API. Use the skill for day-2
operations like listing, updating, or deleting projects.
cloud-manage-project使用Serverless REST API创建Elastic Cloud Serverless项目。日常运维操作(如列出、更新或删除项目)请使用技能。
cloud-manage-projectPrerequisites and permissions
前提条件与权限
- Ensure is configured. If not, run
EC_API_KEYskill first.cloud-setup - Creating projects requires a Cloud API key with Admin or Organization owner role.
- This skill does not perform a separate role pre-check. Attempt the requested operation and let the API enforce
authorization. If the API returns an authorization error (for example, ), stop and ask the user to verify the provided API key permissions.
403 Forbidden
- 确保已配置。若未配置,请先运行
EC_API_KEY技能。cloud-setup - 创建项目需要拥有管理员或组织所有者角色的Cloud API密钥。
- 本技能不会单独进行角色预检查。直接执行请求的操作,由API来强制授权。如果API返回授权错误(例如),请停止操作并告知用户验证其提供的API密钥权限。
403 Forbidden
Manual setup fallback (when cloud-setup
is unavailable)
cloud-setup手动设置备选方案(当cloud-setup
不可用时)
cloud-setupIf this skill is installed standalone and is not available, instruct the user to configure Cloud
environment variables manually before running commands. Never ask the user to paste API keys in chat.
cloud-setup| Variable | Required | Description |
|---|---|---|
| Yes | Elastic Cloud API key used for project creation operations. |
| No | Cloud API base URL (default: |
Note: Ifis missing, or the user does not have a Cloud API key yet, direct the user to generate one at Elastic Cloud API keys, then configure it locally using the steps below.EC_API_KEY
Preferred method (agent-friendly): create a file in the project root:
.envbash
EC_API_KEY=your-api-key
EC_BASE_URL=https://api.elastic-cloud.comAll scripts auto-load from the working directory.
cloud/*.envAlternative: export directly in the terminal:
bash
export EC_API_KEY="<your-cloud-api-key>"
export EC_BASE_URL="https://api.elastic-cloud.com"Terminal exports may not be visible to sandboxed agents running in separate shell sessions, so prefer when using
an agent.
.env如果本技能是独立安装且不可用,请指导用户在运行命令前手动配置Cloud环境变量。切勿要求用户在聊天中粘贴API密钥。
cloud-setup| 变量名 | 是否必填 | 描述 |
|---|---|---|
| 是 | 用于项目创建操作的Elastic Cloud API密钥。 |
| 否 | Cloud API基础URL(默认值: |
注意: 如果缺少,或者用户还没有Cloud API密钥,请引导用户前往Elastic Cloud API keys生成,然后按照以下步骤在本地配置。EC_API_KEY
首选方式(适用于Agent):在项目根目录创建文件:
.envbash
EC_API_KEY=your-api-key
EC_BASE_URL=https://api.elastic-cloud.com所有脚本会自动从工作目录加载文件。
cloud/*.env备选方式:在终端中直接导出:
bash
export EC_API_KEY="<your-cloud-api-key>"
export EC_BASE_URL="https://api.elastic-cloud.com"终端导出的变量可能对在独立shell会话中运行的沙箱Agent不可见,因此使用Agent时优先选择方式。
.envCritical principles
核心原则
- Never display secrets in chat. Do not echo, log, or repeat API keys, passwords, or credentials in conversation
messages or agent thinking. Direct the user to the file instead. The admin password must never appear in chat history, thinking traces, or agent output.
.elastic-credentials - Confirm before creating. Always present the project configuration to the user and ask for confirmation before running the creation script.
- Admin credentials are for API key creation only. The script saves the password to
adminfor bootstrapping a scoped API key. The.elastic-credentialsuser has full privileges and cannot be modified in serverless. Never use admin credentials for direct Elasticsearch operations (querying, indexing, etc.) — always create a scoped API key first (see Step 8). Theadmincommand excludes admin credentials by default — useload-credentialsonly during Step 7/8, then reload without it once the API key is created. Never read or display the contents of--include-adminin chat..elastic-credentials - Recover lost credentials. If the script fails to write (disk full, permissions, etc.), the save may be incomplete. Check
.elastic-credentialsfor the password first. If missing, use the.elastic-credentialsskill'scloud-manage-projectcommand to generate a new password.reset-credentials - Region is permanent. A project's region cannot be changed after creation.
- Prefer automatic readiness checks. Pass to the creation script so it polls until the phase changes from
--waittoinitializing. Only fall back to manually polling the status endpoint ifinitializedis unavailable.--wait
- 切勿在聊天中显示机密信息。不要在对话消息或Agent的思考过程中回显、记录或重复API密钥、密码或凭据。请引导用户查看文件。管理员密码绝对不能出现在聊天历史、思考痕迹或Agent输出中。
.elastic-credentials - 创建前确认。在运行创建脚本前,务必向用户展示项目配置并请求确认。
- 管理员凭据仅用于API密钥创建。脚本会将密码保存到
admin中,用于引导生成范围受限的API密钥。.elastic-credentials用户拥有全部权限,且在serverless环境中无法修改。切勿使用管理员凭据直接执行Elasticsearch操作(查询、索引等)——务必先创建范围受限的API密钥(见步骤8)。admin命令默认会排除管理员凭据——仅在步骤7/8中使用load-credentials,创建完API密钥后重新加载时去掉该参数。切勿在聊天中读取或显示--include-admin的内容。.elastic-credentials - 恢复丢失的凭据。如果脚本无法写入(磁盘已满、权限问题等),可能会导致保存不完整。首先检查
.elastic-credentials中是否有密码。如果缺失,请立即使用.elastic-credentials技能的cloud-manage-project命令生成新密码。reset-credentials - 区域不可更改。项目创建后,其区域无法修改。
- 优先使用自动就绪检查。在创建脚本中传入参数,使其轮询直到项目阶段从
--wait变为initializing。仅当initialized不可用时,才回退到手动轮询状态端点。--wait
Project types
项目类型
| Type | Description | Key endpoints |
|---|---|---|
| Search, analytics, and vector workloads | Elasticsearch, Kibana |
| Logs, metrics, traces, and APM | Elasticsearch, Kibana, APM, OTLP |
| SIEM, endpoint protection, cloud security | Elasticsearch, Kibana, OTLP |
| 类型 | 描述 | 关键端点 |
|---|---|---|
| 搜索、分析和向量工作负载 | Elasticsearch、Kibana |
| 日志、指标、追踪和APM(应用性能监控) | Elasticsearch、Kibana、APM、OTLP |
| SIEM、端点防护、云安全 | Elasticsearch、Kibana、OTLP |
Project type inference
项目类型推断
Map the user's request to the correct value:
--type| User says | |
|---|---|
| "search project", "elasticsearch project", vector search | |
| "observability project", "o11y", logs, metrics, traces, APM | |
| "security project", "SIEM", detections, endpoint protection | |
Do not silently default to any type. If the user does not specify a type, infer it from the conversation context
(for example, discussing log ingestion suggests , discussing detections or SIEM suggests ,
discussing search or vector workloads suggests ). Always present the inferred type to the user and ask
for confirmation before proceeding. If context is insufficient to infer a type, ask the user to choose.
observabilitysecurityelasticsearch将用户的请求映射到正确的值:
--type| 用户表述内容 | |
|---|---|
| "搜索项目"、"elasticsearch项目"、向量搜索 | |
| "可观测性项目"、"o11y"、日志、指标、追踪、APM | |
| "安全项目"、"SIEM"、检测、端点防护 | |
不要默认任何类型。如果用户未指定类型,请从对话上下文推断(例如,讨论日志摄入意味着,讨论检测或SIEM意味着,讨论搜索或向量工作负载意味着)。在继续之前,务必将推断的类型告知用户并请求确认。如果上下文不足以推断类型,请让用户选择。
observabilitysecurityelasticsearchProduct tiers
产品层级
Observability and security projects support a flag. Default to unless the user explicitly
requests a different tier.
--product-tiercomplete| Project type | Tier | Description |
|---|---|---|
| | Full observability suite (logs, metrics, traces, APM) |
| | Log management only |
| | Full security suite (SIEM, cloud, endpoint) |
| | Core SIEM only |
Elasticsearch projects do not have a product tier — use instead.
--optimized-for可观测性和安全项目支持参数。除非用户明确要求其他层级,否则默认使用。
--product-tiercomplete| 项目类型 | 层级 | 描述 |
|---|---|---|
| | 完整可观测性套件(日志、指标、追踪、APM) |
| | 仅日志管理 |
| | 完整安全套件(SIEM、云安全、端点防护) |
| | 仅核心SIEM功能 |
Elasticsearch项目没有产品层级——请使用参数替代。
--optimized-forSensible defaults
合理默认值
Present these defaults to the user before creation. Ask if they want to use or change them:
| Setting | Default |
|---|---|
| Region | |
Project type must be confirmed with the user — do not assume a default. See "Project type inference" above.
Always use unless the user explicitly requests . Do not proactively offer the
option.
--optimized-for general_purposevectorvectorIf the user does not specify a name, ask for one — it is required.
创建前向用户展示以下默认值,询问他们是否要使用或修改:
| 设置 | 默认值 |
|---|---|
| 区域 | |
必须与用户确认项目类型——不要假设默认值。请参阅上方的“项目类型推断”。
除非用户明确要求,否则始终使用。不要主动提供选项。
vector--optimized-for general_purposevector如果用户未指定名称,请询问用户——项目名称是必填项。
Workflow: Create a project
工作流:创建项目
text
Project Creation:
- [ ] Step 1: Verify API key is set
- [ ] Step 2: Present defaults and confirm with user
- [ ] Step 3: List available regions (optional)
- [ ] Step 4: Create the project
- [ ] Step 5: Save credentials and endpoints
- [ ] Step 6: Wait for project to initialize
- [ ] Step 7: Set environment variables
- [ ] Step 8: Recommend creating a scoped API keytext
项目创建:
- [ ] 步骤1:验证API密钥已设置
- [ ] 步骤2:展示默认值并请求用户确认
- [ ] 步骤3:列出可用区域(可选)
- [ ] 步骤4:创建项目
- [ ] 步骤5:保存凭据和端点
- [ ] 步骤6:等待项目初始化完成
- [ ] 步骤7:设置环境变量
- [ ] 步骤8:建议创建范围受限的API密钥Step 1: Verify API key is set
步骤1:验证API密钥已设置
bash
echo "${EC_API_KEY:?Not set}"If is not set, run the skill first to configure authentication and defaults.
EC_API_KEYcloud-setupbash
echo "${EC_API_KEY:?Not set}"如果未设置,请先运行技能配置身份验证和默认值。
EC_API_KEYcloud-setupStep 2: Present summary and confirm with user
步骤2:展示摘要并请求用户确认
Before presenting the summary, ensure the project type has been explicitly confirmed by the user. If no type was
specified, infer one from the conversation context and propose it. If the context is ambiguous, ask the user to choose
from , , or .
elasticsearchobservabilitysecurityAlways show a confirmation summary before creating. Include different fields depending on project type:
Elasticsearch project:
text
Project Summary:
Type: elasticsearch
Name: my-project
Region: gcp-us-central1Observability project:
text
Project Summary:
Type: observability
Name: my-project
Region: gcp-us-central1
Product tier: completeSecurity project:
text
Project Summary:
Type: security
Name: my-project
Region: gcp-us-central1
Product tier: completeAsk the user to confirm or override any values before proceeding.
在展示摘要前,确保项目类型已得到用户明确确认。如果用户未指定类型,请从对话上下文推断并提出建议。如果上下文模糊,请让用户从、或中选择。
elasticsearchobservabilitysecurity创建前始终展示确认摘要。根据项目类型包含不同字段:
Elasticsearch项目:
text
项目摘要:
类型: elasticsearch
名称: my-project
区域: gcp-us-central1可观测性项目:
text
项目摘要:
类型: observability
名称: my-project
区域: gcp-us-central1
产品层级: complete安全项目:
text
项目摘要:
类型: security
名称: my-project
区域: gcp-us-central1
产品层级: complete请用户确认或修改任何值后再继续。
Step 3: List available regions (optional)
步骤3:列出可用区域(可选)
bash
python3 skills/cloud/create-project/scripts/create-project.py list-regionsThe output is grouped by cloud provider (AWS, Azure, GCP) and sorted alphabetically. Regions marked with do not
support project creation.
*bash
python3 skills/cloud/create-project/scripts/create-project.py list-regions输出按云提供商(AWS、Azure、GCP)分组,并按字母顺序排序。标记有的区域不支持项目创建。
*Step 4: Create the project
步骤4:创建项目
bash
python3 skills/cloud/create-project/scripts/create-project.py create \
--type elasticsearch \
--name "my-project" \
--region gcp-us-central1 \
--optimized-for general_purpose \
--waitAlways pass for Elasticsearch projects. Only use if the user explicitly
requests it.
--optimized-for general_purposevectorFor observability and security projects, pass unless the user explicitly requests a different
tier.
--product-tier completeAlways pass so the script automatically polls until the project is ready.
--waitbash
python3 skills/cloud/create-project/scripts/create-project.py create \
--type elasticsearch \
--name "my-project" \
--region gcp-us-central1 \
--optimized-for general_purpose \
--wait对于Elasticsearch项目,始终传入。仅当用户明确要求时才使用。
--optimized-for general_purposevector对于可观测性和安全项目,传入,除非用户明确要求其他层级。
--product-tier complete始终传入,以便脚本自动轮询直到项目就绪。
--waitStep 5: Save credentials and endpoints
步骤5:保存凭据和端点
The script automatically writes credentials to in the working directory. The password is redacted
from the JSON output on stdout.
.elastic-credentialsIf saving succeeds, tell the user:
text
Credentials saved to .elastic-credentials — open that file to retrieve your password.Do not read, cat, or display the contents of in chat.
.elastic-credentialsIf saving fails, the script prints an error to stderr. Check whether exists and contains a
password (a partial write is possible). If the password is missing or the file does not exist, immediately run the
skill's command to generate a new password.
.elastic-credentialscloud-manage-projectreset-credentialsThe creation response also contains:
- Project ID — needed for all subsequent operations
- Cloud ID — for client libraries
- Elasticsearch and Kibana endpoints — safe to display in chat
The admin credentials are for initial bootstrap only. Recommend creating a scoped API key for ongoing access (Step 8).
脚本会自动将凭据写入工作目录下的文件。标准输出的JSON结果中会隐藏密码。
.elastic-credentials如果保存成功,告知用户:
text
凭据已保存到.elastic-credentials文件中——请打开该文件获取密码。不要在聊天中读取、打印或显示的内容。
.elastic-credentials如果保存失败,脚本会将错误打印到标准错误流。检查是否存在且包含密码(可能会出现部分写入的情况)。如果密码缺失或文件不存在,请立即使用技能的命令生成新密码。
.elastic-credentialscloud-manage-projectreset-credentials创建响应还包含:
- 项目ID——后续所有操作都需要该ID
- Cloud ID——用于客户端库
- Elasticsearch和Kibana端点——可安全地在聊天中展示
管理员凭据仅用于初始引导。建议创建范围受限的API密钥用于日常访问(步骤8)。
Step 6: Wait for project to initialize
步骤6:等待项目初始化完成
When is passed (recommended), the script polls automatically until the project phase becomes . No
manual polling is needed.
--waitinitializedIf the agent ran without , poll manually:
--waitbash
python3 skills/cloud/create-project/scripts/create-project.py status \
--type elasticsearch \
--id <project-id>Repeat until changes from to .
phaseinitializinginitialized当传入参数(推荐)时,脚本会自动轮询直到项目阶段变为。无需手动轮询。
--waitinitialized如果Agent运行时未使用,则手动轮询:
--waitbash
python3 skills/cloud/create-project/scripts/create-project.py status \
--type elasticsearch \
--id <project-id>重复执行直到从变为。
phaseinitializinginitializedStep 7: Set environment variables
步骤7:设置环境变量
The creation script saves credentials and endpoints to with the project name in the header. Load
them into the current shell with so admin credentials are available for API key creation in Step
8:
.elastic-credentials--include-adminbash
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>" --include-admin)This sets , , any project-type specific endpoints (, ), and the
admin / needed to bootstrap an API key.
ELASTICSEARCH_URLKIBANA_URLAPM_URLINGEST_URLELASTICSEARCH_USERNAMEELASTICSEARCH_PASSWORD创建脚本会将凭据和端点保存到文件中,文件头部包含项目名称。使用参数将其加载到当前shell中,以便步骤8中创建API密钥时能使用管理员凭据:
.elastic-credentials--include-adminbash
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>" --include-admin)这会设置、、项目类型特定的端点(、),以及引导生成API密钥所需的管理员/。
ELASTICSEARCH_URLKIBANA_URLAPM_URLINGEST_URLELASTICSEARCH_USERNAMEELASTICSEARCH_PASSWORDStep 8: Create a scoped API key
步骤8:创建范围受限的API密钥
The user has full privileges and cannot be modified in serverless projects. Do not proceed with Elasticsearch
operations using admin credentials. Create a scoped Elasticsearch API key with only the permissions the user needs.
adminIf the skill is available, use it for API key creation — it covers the full lifecycle (create,
grant, invalidate, query) and handles scoping privileges correctly. If the skill is not installed, ask the user to
either install it or create the API key manually through Kibana > Stack Management > API keys. After creation, save
the API key to using the project-specific header format (see skill's "Credential
file format" section), then reload without to drop admin credentials from the environment:
elasticsearch-authn.elastic-credentialsmanage-project--include-adminbash
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")admin如果技能可用,请使用它来创建API密钥——它涵盖了完整的生命周期(创建、授权、失效、查询),并能正确处理权限范围。如果未安装该技能,请让用户选择安装它,或通过Kibana > 堆栈管理 > API密钥手动创建。创建完成后,使用项目特定的头部格式将API密钥保存到中(请参阅技能的“凭据文件格式”部分),然后**不使用**重新加载,从环境中移除管理员凭据:
elasticsearch-authn.elastic-credentialsmanage-project--include-adminbash
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")Examples
示例
Create an Elasticsearch project with defaults
使用默认值创建Elasticsearch项目
bash
python3 skills/cloud/create-project/scripts/create-project.py create \
--type elasticsearch \
--name "my-search-project" \
--region gcp-us-central1 \
--optimized-for general_purpose \
--waitbash
python3 skills/cloud/create-project/scripts/create-project.py create \
--type elasticsearch \
--name "my-search-project" \
--region gcp-us-central1 \
--optimized-for general_purpose \
--waitCreate an observability project
创建可观测性项目
bash
python3 skills/cloud/create-project/scripts/create-project.py create \
--type observability \
--name "prod-o11y" \
--region aws-eu-west-1 \
--product-tier complete \
--waitbash
python3 skills/cloud/create-project/scripts/create-project.py create \
--type observability \
--name "prod-o11y" \
--region aws-eu-west-1 \
--product-tier complete \
--waitCreate a security project
创建安全项目
bash
python3 skills/cloud/create-project/scripts/create-project.py create \
--type security \
--name "siem-prod" \
--region gcp-us-central1 \
--product-tier complete \
--waitbash
python3 skills/cloud/create-project/scripts/create-project.py create \
--type security \
--name "siem-prod" \
--region gcp-us-central1 \
--product-tier complete \
--waitGuidelines
指导原则
- Run the skill first if
cloud-setupis not set.EC_API_KEY - Always confirm the project configuration with the user before creating.
- Never display passwords or API keys in chat. Direct the user to .
.elastic-credentials - Never silently default to a project type. Infer from context and confirm with the user.
- Default to optimization. Only use
general_purposeif the user explicitly requests it.vector - Default to product tier for observability and security projects. Only use
completeorlogs_essentialsif the user explicitly requests it.essentials - Always pass so the script polls until the project is ready.
--wait - If credential saving fails, immediately reset credentials using the skill.
cloud-manage-project - After creation, recommend creating a scoped API key instead of relying on admin credentials.
- Region cannot be changed after creation — confirm the choice before proceeding.
- 如果未设置,请先运行
EC_API_KEY技能。cloud-setup - 创建前务必与用户确认项目配置。
- 切勿在聊天中显示密码或API密钥。引导用户查看文件。
.elastic-credentials - 不要默认任何项目类型。从上下文推断并与用户确认。
- 默认使用优化。仅当用户明确要求时才使用
general_purpose。vector - 对于可观测性和安全项目,默认使用产品层级。仅当用户明确要求时才使用
complete或logs_essentials。essentials - 始终传入参数,以便脚本轮询直到项目就绪。
--wait - 如果凭据保存失败,请立即使用技能重置凭据。
cloud-manage-project - 创建完成后,建议创建范围受限的API密钥,而不是依赖管理员凭据。
- 项目创建后区域无法更改——继续前请确认用户的选择。
Script reference
脚本参考
| Command | Description |
|---|---|
| Create a new serverless project |
| Get project initialization status |
| List available regions |
| Flag | Commands | Description |
|---|---|---|
| create, status | Project type: |
| create | Project name (required) |
| create | Region ID (default: |
| status | Project ID |
| create | Elasticsearch subtype: |
| create | Observability/security tier (see "Product tiers" section) |
| create | Poll until project is initialized before exiting |
| 命令 | 描述 |
|---|---|
| 创建新的serverless项目 |
| 获取项目初始化状态 |
| 列出可用区域 |
| 参数 | 适用命令 | 描述 |
|---|---|---|
| create, status | 项目类型: |
| create | 项目名称(必填) |
| create | 区域ID(默认值: |
| status | 项目ID |
| create | Elasticsearch子类型: |
| create | 可观测性/安全项目层级(请参阅“产品层级”部分) |
| create | 轮询直到项目初始化完成后再退出 |
Environment variables
环境变量
| Variable | Required | Description |
|---|---|---|
| Yes | Elastic Cloud API key |
| No | Cloud API base URL (default: |
| Output | Elasticsearch URL (loaded via |
| Output | Kibana URL (loaded via |
| Output | APM endpoint (observability projects only) |
| Output | OTLP ingest endpoint (observability and security projects) |
| Output | Elasticsearch API key (created in Step 8, loaded via |
| 变量名 | 是否必填 | 描述 |
|---|---|---|
| 是 | Elastic Cloud API密钥 |
| 否 | Cloud API基础URL(默认值: |
| 输出项 | Elasticsearch URL(创建后通过 |
| 输出项 | Kibana URL(创建后通过 |
| 输出项 | APM端点(仅适用于可观测性项目) |
| 输出项 | OTLP摄入端点(适用于可观测性和安全项目) |
| 输出项 | Elasticsearch API密钥(步骤8中创建,通过 |
Additional resources
额外资源
- For full API details, request/response schemas, and project-type options, see references/api-reference.md
- 如需完整的API详情、请求/响应架构和项目类型选项,请参阅 references/api-reference.md