Alicloud Das Ops

> This skill follows the Agent Skill OpenSpec.

Alibaba Cloud DAS (Database Autonomy Service) Operations Skill

Runtime Rules

| Area | Rule | Reference | | --- | --- | --- | | CLI path | MANDATORY: Always prefer the SkillOpt wrapper ./scripts/das-skillopt-wrapper.sh for all DAS CLI operations to enable automated self-repair and dynamic optimization; fallback to native aliyun das only when the wrapper is unavailable or skillopt-lib.sh is missing. | [CLI](references/cli-usage.md), [SkillOpt](references/skillopt-integration.md) |

Overview

Database Autonomy Service (DAS, formerly HDM) is an AI-driven database operations and maintenance platform on Alibaba Cloud. It provides full-lifecycle autonomous capabilities: anomaly detection, root-cause diagnosis, optimization recommendations, automatic SQL throttling, auto-scaling, and intelligent O&M reports.

This skill is an operational runbook for agents: explicit scope, credential rules, pre-flight checks, JIT Go SDK execution flows (CLI does not support DAS), response validation, and failure recovery. Do not use the web console as the primary agent execution path in SKILL.md.

CLI applicability (repository policy)

• cli_applicability: sdk-first: DAS is accessible via aliyun das CLI,

but requires explicit --endpoint because DAS is not in the default shared endpoint map. The endpoint is fixed to das.cn-shanghai.aliyuncs.com (public) regardless of the target instance's region. ``bash # Example: CLI call with mandatory endpoint aliyun das DescribeSqlLogConfig \ --endpoint das.cn-shanghai.aliyuncs.com \ --RegionId cn-shanghai \ --InstanceId "{{user.instance_id}}" ``

• JIT Go SDK is the preferred path when CLI returns endpoint errors or

for complex operations. The Go SDK package is github.com/alibabacloud-go/das-20200116/v5/client.

• When using the SkillOpt wrapper, the endpoint is handled automatically; see

[SkillOpt Integration](references/skillopt-integration.md).

Trigger & Scope (Agent-Readable)

SHOULD Use This Skill When

• User mentions "Alibaba Cloud DAS" OR "数据库自治服务" OR "HDM"
• Task involves CRUD or lifecycle operations on **DAS-managed database

instances** (register, inspect, diagnose, optimize, throttle, scale)

• Task keywords:
• instance registration / 接入实例 / AddHDMInstance
• inspection / 巡检评分 / GetInstanceInspections
• SQL diagnosis / SQL诊断 / CreateDiagnosticReport
• cache analysis / 缓存分析 / CreateCacheAnalysisJob
• deadlock analysis / 死锁分析 / CreateLatestDeadLockAnalysis
• session management / 实例会话 / CreateKillInstanceSessionTask
• space analysis / 空间分析 / GetSpaceSummary
• SQL throttling / SQL限流 / CreateSqlLimitTask
• SQL concurrency control / SQL并发控制 / EnableSqlConcurrencyControl, DisableSqlConcurrencyControl, DisableAllSqlConcurrencyControlRules
• SQL concurrency control rules query / SQL限流规则查询 / GetRunningSqlConcurrencyControlRules, GetSqlConcurrencyControlRulesHistory
• SQL concurrency control keywords / SQL限流关键词生成 / GetSqlConcurrencyControlKeywordsFromSqlText
• auto-scaling / 自动弹性伸缩 / SetAutoScalingConfig
• event subscription / 事件通知 / SetEventSubscription
• autonomous event / 自治事件 / GetAutonomousNotifyEventsInRange
• SQL insight / SQL洞察 / DescribeSqlLogStatistic
• query governance / 查询治理 / GetQueryOptimizeData
• index advice / 索引诊断 / GetQueryOptimizeExecErrorStats
• performance insight / 性能洞察 / GetPfsSqlSamples
• DAS Agent / DAS智能助手 / DAS Agent chat
• User asks to deploy, configure, troubleshoot, or monitor DAS **via API,

SDK, or automation**

SHOULD NOT Use This Skill When

• Task is purely billing / account management → delegate to:

alicloud-billing-ops (when present)

• Task is RAM / permission model only → delegate to: alicloud-ram-ops

(when present)

• Task is about **creating or deleting the underlying database engine

instances** (e.g., creating an RDS MySQL instance) → delegate to: alicloud-rds-ops, alicloud-polar-mysql-ops, alicloud-polar-postgresql-ops, alicloud-polar-oracle-ops, or the engine-specific skill

• Task is about DAS Agent chat / LLM Q&A → this skill covers API-level

DAS Agent operations (e.g., querying usage); conversational LLM features are console-only and out of scope for API automation

• User insists on console-only flows with no API → state limitation;

do not invent undocumented HTTP steps

Delegation Rules

| 能力 | 委托目标 | 说明 | |------|----------|------| | GCL 质量门禁 | alicloud-gcl-runner-ops | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

Variable Convention (Agent-Readable)

Structured placeholders reduce injection ambiguity and unsafe prompts:

| Placeholder | Meaning | Agent Action | |-------------|---------|--------------| | {{env.ALIBABA_CLOUD_ACCESS_KEY_ID}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_REGION_ID}} | From runtime environment | Use documented default only if skill explicitly allows | | {{user.region}} | User-supplied region | Ask once; reuse. For DAS SDK calls, always pass cn-shanghai as the service region regardless of instance location | | {{user.instance_id}} | User-supplied database instance ID | Ask once; reuse (e.g., rm-2ze8g2am97624****) | | {{user.engine}} | Database engine type | Ask when required (e.g., MySQL, PostgreSQL, Redis, MongoDB, SQLServer, PolarDB) | | {{user.node_id}} | Node ID for cluster instances | Ask when required (PolarDB, PolarDB-X) | | {{output.resource_id}} | From last API JSON response | Parse per OpenAPI spec for this operation | | {{output.task_id}} | Async task ID from create operations | Parse per OpenAPI spec; used for polling |

> {{env.*}} MUST NOT be collected from the user. {{user.*}} MUST be > collected interactively when missing.

> 凭据安全（强制）： 参考 [Credential Masking 规则](../alicloud-skill-generator/references/credential-masking.md)

API and Response Conventions (Agent-Readable)

• OpenAPI is canonical for path, query, body fields, enums, and response

shapes. DAS uses RPC-style APIs.

• Endpoint: das.cn-shanghai.aliyuncs.com (public) or

das.vpc-proxy.aliyuncs.com (VPC). The SDK endpoint MUST be set explicitly because DAS is not in the default shared endpoint map of some SDK versions.

• Region: SDK calls MUST specify RegionId: "cn-shanghai" regardless of

the target database instance's actual region.

• Errors: Map SDK/HTTP errors to code / status / message fields per

spec. Common DAS error codes:

• InvalidDBInstanceId.NotFound — Instance not found or not registered in DAS
• InvalidParameter — Missing or malformed parameter
• OperationDenied.InstanceStatus — Instance status does not allow the operation
• Throttling — Rate limit exceeded; implement exponential backoff
• InsufficientBalance — Account balance insufficient for Pro features
• Timestamps: DAS returns Unix timestamps in milliseconds (e.g.,

expireTime: 1924963200000). Convert to ISO 8601 when presenting to users.

• Idempotency: Most DAS create operations (e.g., CreateDiagnosticReport)

generate new resources each time; document that duplicate calls produce distinct reports/tasks. AddHDMInstance is idempotent for the same InstanceId — repeated registration returns success without side effects.

DAS Standard Response Structure

Nearly all DAS API responses follow this five-element envelope:

{
  "Code": 200,
  "Message": "Successful",
  "RequestId": "B6D17591-B48B-4D31-9CD6-9B9796B2****",
  "Data": { ... },
  "Success": true
}

| Field | Type | Meaning | Agent Action | |-------|------|---------|--------------| | Code | integer (int64) | HTTP-like status code; 200 indicates success | Verify Code == 200 before parsing Data | | Message | string | Human-readable result; "Successful" on success | Log on failure; do not rely on for branching | | RequestId | string | Unique request identifier for tracing | Include in error reports to Alibaba Cloud support | | Data | any (object, array, boolean, string) | Payload; shape varies by operation | Parse per operation schema | | Success | boolean | true when the business operation succeeded | Use as primary success gate |

> Important: Code == 200 does not always mean business success. > Always check Success == true before consuming Data. > Some operations return Code: 200 with Success: false and a descriptive > Message (e.g., instance already in target state).

> Response fields: See [api-doc-mapping.md](references/api-doc-mapping.md) for operation-to-SDK-type mapping. Each operation section below documents the specific $.Data shape to parse.

Expected State Transitions

| Operation | Initial State | Target State | Poll Interval | Max Wait | |-----------|---------------|--------------|---------------|----------| | AddHDMInstance | — | registered (implied) | N/A (sync) | 30s | | CreateDiagnosticReport | — | FINISHED or FAILED | 5s | 300s | | CreateCacheAnalysisJob | — | SUCCESS or FAILED | 10s | 600s | | CreateLatestDeadLockAnalysis | — | SUCCESS or FAILED | 5s | 120s | | CreateKillInstanceSessionTask | — | completed (implied) | N/A (async fire-and-forget) | 30s | | CreateSqlLimitTask | — | ACTIVE or EXPIRED | 5s | 60s | | EnableSqlConcurrencyControl | — | Open (implied) | N/A (sync) | 30s | | DisableSqlConcurrencyControl | Open | Closed | N/A (sync) | 30s | | DisableAllSqlConcurrencyControlRules | Open | Closed | N/A (sync) | 30s |

Changelog

| Version | Date | Changes | |---------|------|---------| | 1.2.0 | 2026-06-11 | Token efficiency optimization: consolidated operation sections to compact table format (TE-3/TE-6), moved prompt-templates.md to advanced/ (TE-7), removed Response Field Table (deduped via api-doc-mapping.md), compacted governance/adversarial-review.md and cross-skill-collaboration.md, removed redundant API doc links, condensed integration.md engine table | | 1.1.0 | 2026-06-01 | Added SQL concurrency control operations: EnableSqlConcurrencyControl, DisableSqlConcurrencyControl, DisableAllSqlConcurrencyControlRules, GetRunningSqlConcurrencyControlRules, GetSqlConcurrencyControlRulesHistory, GetSqlConcurrencyControlKeywordsFromSqlText | | 1.0.0 | 2026-05-14 | Initial DAS ops skill with SDK-only execution, covering instance registration, inspection, diagnosis, cache analysis, deadlock analysis, session management, space analysis, SQL throttling, event subscription, autonomous events, SQL insight, and query governance |

> EXECUTION MANDATORY RULE: 所有 control-plane CLI 执行步骤 必须 通过 SkillOpt wrapper ./scripts/das-skillopt-wrapper.sh 运行。 > 以下所有代码块中的 aliyun das ... 命令在执行时应替换为 ./scripts/das-skillopt-wrapper.sh ...。 > 仅在 wrapper 脚本不可用或 skillopt-lib.sh 缺失时，才退回到原生 aliyun das CLI 调用。 > 参考 ## Runtime Rules 中的 CLI path 规则。

Execution Flows (Agent-Readable)

Every operation: Pre-flight → Execute (JIT Go SDK) → Validate → Recover. Do not skip phases.

Global Pre-flight Checks (Run Before Any DAS Operation)

| Check | Method | Expected | On Failure | |-------|--------|----------|------------| | SDK / deps | go version | >= 1.21 | Document Go install; attempt JIT download of 1.24+ | | SDK package | go get github.com/alibabacloud-go/das-20200116/v5/client | No import error | Document dependency resolution steps | | Credentials | os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID") and SECRET | Non-empty | HALT; user configures env | | Region | Verify ALIBABA_CLOUD_REGION_ID is set | Non-empty | HALT; user configures env | | Network | curl -I https://das.cn-shanghai.aliyuncs.com | HTTP 403 or 400 (not timeout) | Warn about network / proxy issues |

Shared SDK Client Initialization Pattern

All JIT Go SDK examples below assume the following shared initialization. Generate this once per workspace and reuse across operations:

// /tmp/aliyun-sdk-workspace/das_client.go
package main
import (
    "encoding/json"; "fmt"; "os"; "strconv"
    openapi "github.com/alibabacloud-go/darabonba-openapi/v2/client"
    das "github.com/alibabacloud-go/das-20200116/v5/client"
    "github.com/alibabacloud-go/tea/tea"
)
func newDASClient() (*das.Client, error) {
    config := &openapi.Config{
        AccessKeyId:     tea.String(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")),
        AccessKeySecret: tea.String(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")),
        Endpoint:        tea.String(os.Getenv("DAS_ENDPOINT")),
    }
    if config.Endpoint == nil || *config.Endpoint == "" {
        config.Endpoint = tea.String("das.cn-shanghai.aliyuncs.com")
    }
    return das.NewClient(config)
}
func printResponse(body interface{}) { b, _ := json.MarshalIndent(body, "", "  "); fmt.Println(string(b)) }
func main() {}

Execute (once per workspace):

mkdir -p /tmp/aliyun-sdk-workspace
cd /tmp/aliyun-sdk-workspace
go mod init sdk-script 2>/dev/null || true
go get github.com/alibabacloud-go/darabonba-openapi/v2/client
go get github.com/alibabacloud-go/das-20200116/v5/client

> Note: Set DAS_ENDPOINT=das.vpc-proxy.aliyuncs.com when running inside an Alibaba Cloud VPC.

> Execution pattern: Each operation below shows the Go request struct and its client.{Operation}(request) call. The client, err := newDASClient() and printResponse(response.Body) boilerplate is omitted for brevity — use the shared pattern above.

---

Operation: Register Instance (AddHDMInstance)

> Safety Note: Registering a production instance enables DAS monitoring agents and may introduce minor performance overhead (300s → suggest retry off-peak |

---

Operation: Create Cache Analysis Job (CreateCacheAnalysisJob)

| Step | Detail | |------|--------| | Pre-flight | Engine = Redis or Tair. Instance registered | | Go | request := &das.CreateCacheAnalysisJobRequest{RegionId: tea.String("cn-shanghai"), InstanceId: tea.String(os.Getenv("INSTANCE_ID"))} → client.CreateCacheAnalysisJob(request) | | Validate | $.Data = true. Poll DescribeCacheAnalysisJob until SUCCESS or FAILED (10s interval, 600s max) | | Recover | Job fails → check $.Data.errorMessage |

---

Operation: Create Deadlock Analysis (CreateLatestDeadLockAnalysis)

| Step | Detail | |------|--------| | Pre-flight | Engine = MySQL, PolarDB, PolarDB-X. Instance registered | | Go | request := &das.CreateLatestDeadLockAnalysisRequest{RegionId: tea.String("cn-shanghai"), InstanceId: tea.String(os.Getenv("INSTANCE_ID")), NodeId: tea.String(os.Getenv("NODE_ID"))} → client.CreateLatestDeadLockAnalysis(request) | | Validate | $.Data = true. Poll GetDeadLockHistory to confirm new entry (5s interval, 120s max) | | Recover | No recent deadlock → inform user |

---

Operation: Kill Instance Session (CreateKillInstanceSessionTask)

| Step | Detail | |------|--------| | Pre-flight | Instance registered. User provides session IDs. Safety gate — present target sessions, require confirmation | | Go | request := &das.CreateKillInstanceSessionTaskRequest{RegionId: tea.String("cn-shanghai"), InstanceId: tea.String(os.Getenv("INSTANCE_ID"))} → client.CreateKillInstanceSessionTask(request) | | Validate | $.Data = true. Re-query GetSessionList to verify target sessions gone | | Recover | Session already closed → inform; OperationDenied.InstanceStatus → wait |

---

Operation: Get Space Summary (GetSpaceSummary)

| Step | Detail | |------|--------| | Go | request := &das.GetSpaceSummaryRequest{RegionId: tea.String("cn-shanghai"), InstanceId: tea.String(os.Getenv("INSTANCE_ID"))} → client.GetSpaceSummary(request) | | Validate | $.Data.totalSize (bytes). Breakdown: dataSize, indexSize, freeSize. Alert

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: buhaiqing
• Source: buhaiqing/aliyun-skills
• License: MIT

Install and usage instructions live in the source repository linked above.