Alicloud Eip Ops

> This skill follows the Agent Skill OpenSpec.

Alibaba Cloud EIP Operations Skill

Runtime Rules

| Area | Rule | Reference | | --- | --- | --- | | CLI path | MANDATORY: Always prefer the SkillOpt wrapper ./scripts/vpc-skillopt-wrapper.sh for all EIP CLI operations to enable automated self-repair and dynamic optimization; fallback to native aliyun eip only when the wrapper is unavailable or skillopt-lib.sh is missing. | [CLI](references/cli-usage.md), [SkillOpt](references/skillopt-integration.md) |

Overview

Alibaba Cloud EIP (Elastic IP Address) provides independent public IP addresses that can be dynamically associated with cloud resources. This skill is an operational runbook for agents: explicit scope, credential rules, pre-flight checks, cli-first execution (official aliyun CLI as primary path, JIT Go SDK as fallback), response validation, and failure recovery.

CLI applicability (repository policy)

• cli_applicability: cli-first: Official aliyun fully supports EIP. CLI is the primary execution path for all operations. JIT Go SDK is the fallback only when CLI lacks support for a specific edge-case operation.

Quick Start

不知道从哪里开始？直接看 [Prompt Examples](references/prompt-examples.md)，里面有 30+ 条自然语言提示词示例，覆盖 EIP 分配、绑定、解绑、带宽修改、续费、释放等场景，复制即用。

Trigger & Scope (Agent-Readable)

SHOULD Use This Skill When

• User mentions "Alibaba Cloud EIP" OR "弹性公网IP" OR "Elastic IP Address" OR "公网IP"
• Task involves CRUD or lifecycle operations on EIP (allocate, describe, modify, release)
• Task involves EIP association/unassociation (bind to ECS, NAT, SLB, HaVip, ENI)
• Task involves EIP bandwidth modification (upgrade/downgrade bandwidth)
• Task involves EIP billing mode conversion (PayByBandwidth ↔ PayByTraffic)
• Task involves EIP bandwith plans (create, describe, modify, delete, add/remove EIP)
• Task involves EIP conversion (convert NAT public IP to EIP)
• Task keywords: EIP, elastic IP, 弹性公网IP, 公网IP, AllocateEipAddress, ReleaseEipAddress, AssociateEipAddress, UnassociateEipAddress, bandwidth, bandwidth plans, IP conversion
• User asks to deploy, configure, troubleshoot, or monitor EIP resources via API, SDK, CLI, or automation

SHOULD NOT Use This Skill When

• Task is purely billing / account management → delegate to: alicloud-billing-ops (when present)
• Task is RAM / permission model only → delegate to: alicloud-ram-ops (when present)
• Task is about NAT gateway management → delegate to: alicloud-nat-ops
• Task is about VPC/vSwitch creation → delegate to: alicloud-vpc-ops (when present)
• Task is about ECS instances → delegate to: alicloud-ecs-ops
• Task is about RDS / databases → delegate to: alicloud-rds-ops (when present)
• Task is about SLB / load balancing → delegate to: alicloud-slb-ops
• Task is about VPN gateway → delegate to: alicloud-vpc-ops (when present)

Delegation Rules

| 能力 | 委托目标 | 说明 | |------|----------|------| | GCL 质量门禁 | alicloud-gcl-runner-ops | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

Variable Convention (Agent-Readable)

| Placeholder | Meaning | Agent Action | |-------------|---------|--------------| | {{env.ALIBABA_CLOUD_ACCESS_KEY_ID}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_REGION_ID}} | From runtime environment | Use documented default only if skill explicitly allows | | {{user.region}} | User-supplied region | Ask once; reuse | | {{user.eip_id}} | User-supplied EIP Allocation ID | Ask once; reuse | | {{user.eip_name}} | User-supplied EIP name | Ask once; reuse | | {{user.bandwidth}} | User-supplied bandwidth (Mbps) | Ask once; reuse | | {{user.instance_id}} | User-supplied bound instance ID | Ask once; reuse | | {{user.instance_type}} | Bound instance type (EcsInstance/Nat/SLBInstance/HaVip/NetworkInterface/Ngw) | Ask once; reuse | | {{user.billing_mode}} | Billing mode (PayByBandwidth/PayByTraffic) | Ask once; reuse | | {{output.allocation_id}} | From AllocateEipAddress response | Parse JSON path $.AllocationId | | {{output.eip_address}} | From AllocateEipAddress response | Parse JSON path $.IpAddress |

> {{env.*}} MUST NOT be collected from the user. {{user.*}} MUST be collected interactively when missing.

> 凭据安全（强制）： 参考 [Credential Masking 规则](../alicloud-skill-generator/references/credential-masking.md)

API and Response Conventions (Agent-Readable)

• OpenAPI is canonical for fields, enums, and response shapes.
• Errors: Map SDK/HTTP errors to code / message per spec.
• Timestamps: ISO 8601 format.
• Idempotency: VPC API supports ClientToken for idempotent operations.

Response Field Table

| Operation | JSON Path | Type | Description | |-----------|-----------|------|-------------| | AllocateEipAddress | $.AllocationId | string | EIP allocation ID | | AllocateEipAddress | $.IpAddress | string | Allocated public IP address | | DescribeEipAddresses | $.EipAddresses.EipAddress[].AllocationId | array | EIP allocation IDs | | DescribeEipAddresses | $.EipAddresses.EipAddress[].IpAddress | array | EIP addresses | | DescribeEipAddresses | $.EipAddresses.EipAddress[].Status | array | Status: Available/InUse/Associating/Unassociating/Releasing | | AssociateEipAddress | $.RequestId | string | Request identifier | | UnassociateEipAddress | $.RequestId | string | Request identifier | | ReleaseEipAddress | $.RequestId | string | Request identifier |

Expected State Transitions

| Operation | Initial State | Target State | Poll Interval | Max Wait | |-----------|---------------|--------------|---------------|----------| | AllocateEipAddress | — | Available | 5s | 120s | | AssociateEipAddress | Available | InUse | 5s | 120s | | UnassociateEipAddress | InUse | Available | 5s | 120s | | ReleaseEipAddress | Available | (deleted) | 5s | 60s |

Quick Start

What This Skill Does

This skill enables you to allocate, manage, bind, and release Alibaba Cloud EIPs (Elastic IP Addresses) using the aliyun CLI (primary) or JIT Go SDK (fallback).

Prerequisites

• [ ] aliyun CLI installed (or Go runtime for JIT fallback)
• [ ] Credentials configured: ALIBABA_CLOUD_ACCESS_KEY_ID, ALIBABA_CLOUD_ACCESS_KEY_SECRET
• [ ] Region set: ALIBABA_CLOUD_REGION_ID

Verify Setup

# Check CLI and credentials
aliyun vpc DescribeEipAddresses --RegionId {{env.ALIBABA_CLOUD_REGION_ID}} --PageSize 1

Your First Command

# Example: List all EIPs
aliyun vpc DescribeEipAddresses --RegionId {{env.ALIBABA_CLOUD_REGION_ID}} \
  --output cols=AllocationId,IpAddress,Status,InstanceId rows=EipAddresses.EipAddress[].{AllocationId:AllocationId,IpAddress:IpAddress,Status:Status,InstanceId:InstanceId}

Next Steps

• [Core Concepts](references/core-concepts.md) — Understand EIP architecture and billing
• [Common Operations](#execution-flows) — Allocate, bind, release, and manage EIPs
• [Troubleshooting](references/troubleshooting.md) — Fix common EIP issues

Capabilities at a Glance

| Operation | Description | Complexity | Risk Level | |-----------|-------------|------------|------------| | Allocate EIP | Request a new elastic public IP | Low | Low | | Describe | View EIP details and status | Low | None | | Associate | Bind EIP to a cloud resource (ECS, NAT, SLB, etc.) | Low | Low | | Unassociate | Unbind EIP from a resource | Low | Medium — causes brief network interruption | | Modify | Change bandwidth, billing mode, or name | Low | Low | | Release | Permanently release an EIP | Low | High — irreversible | | List EIP Bandwidth Plans | View bandwidth plans and member EIPs | Low | None | | Create/Add to Plans | Add EIP to shared bandwidth | Medium | Low |

> EXECUTION MANDATORY RULE: 所有 control-plane CLI 执行步骤 必须 通过 SkillOpt wrapper ./scripts/vpc-skillopt-wrapper.sh 运行。 > 以下所有代码块中的 aliyun vpc ... 命令在执行时应替换为 ./scripts/vpc-skillopt-wrapper.sh ...。 > 仅在 wrapper 脚本不可用或 skillopt-lib.sh 缺失时，才退回到原生 aliyun vpc CLI 调用。 > 参考 ## Runtime Rules 中的 CLI path 规则。

Execution Flows (Agent-Readable)

Every operation: Pre-flight → Execute → Validate → Recover. Do not skip phases.

Operation: Allocate EIP

When to use:

• You need a public IP address that can be independently managed from compute lifecycle
• You want to reassign IPs between ECS, NAT Gateway, SLB without recreating

What you need:

• Region ID
• Bandwidth value (Mbps, depends on billing mode)
• ISP type (optional, default: BGP)

What to expect:

• A new EIP is allocated within seconds
• You receive an AllocationId and IpAddress for future operations

Pre-flight Checks

| Check | Method | Expected | On Failure | |-------|--------|----------|------------| | CLI availability | aliyun vpc DescribeRegions | Exit code 0 | HALT; install CLI | | Credentials | Environment variables set | Non-empty keys | HALT; configure credentials | | Region validity | DescribeRegions | Region present in response | Suggest valid regions | | EIP quota | DescribeEipAddresses + TotalCount | Under EIP quota limit | HALT; request quota increase |

Execution — CLI (aliyun) (Primary Path)

# Allocate EIP (PayByTraffic billing, bandwidth = 5 Mbps)
aliyun vpc AllocateEipAddress \
  --RegionId "{{user.region}}" \
  --Bandwidth "5" \
  --InternetChargeType "PayByTraffic" \
  --ISP "BGP" \
  --Name "{{user.eip_name}}"

Post-execution Validation

1. Capture {{output.allocation_id}} from response $.AllocationId.
2. Capture {{output.eip_address}} from response $.IpAddress.
3. Verify:

aliyun vpc DescribeEipAddresses \
  --RegionId "{{user.region}}" \
  --AllocationId "{{output.allocation_id}}" \
  --output cols=AllocationId,IpAddress,Status,InternetChargeType rows=EipAddresses.EipAddress[].{AllocationId:AllocationId,IpAddress:IpAddress,Status:Status,InternetChargeType:InternetChargeType}

Failure Recovery

| Error pattern | Max retries | Backoff | Agent Action | UX Feedback | |---------------|-------------|---------|--------------|-------------| | InvalidInstanceType.ValueNotSupported | 0 | — | HALT; verify InstanceType | [ERROR] Invalid InstanceType. Supported values: EcsInstance, Nat, SLBInstance, HaVip, NetworkInterface, Ngw. | | QuotaExceeded.EipAddress | 0 | — | HALT | [ERROR] QuotaExceeded: EIP quota reached. Delete unused EIPs or request increase. | | InsufficientBalance | 0 | — | HALT | [ERROR] InsufficientBalance: Account balance insufficient. Recharge your account. | | InvalidBandwidth.ValueNotSupported | 0 | — | HALT; suggest valid range | [ERROR] Invalid bandwidth. For PayByTraffic: 1-200 Mbps. For PayByBandwidth: 1-500 Mbps. | | Throttling / 429 | 3 | exponential | Back off | ⚠️ Rate limit reached. Retrying in {backoff}s... | | InternalError | 3 | 2s, 4s, 8s | Retry; then HALT | [ERROR] InternalError: Server-side error. Retry or escalate. |

Operation: AssociateEipAddress

When to use:

• Bind an existing EIP to an ECS instance for public internet access
• Bind EIP to NAT Gateway for SNAT/DNAT source IP
• Bind EIP to SLB for public-facing load balancer

What you need:

• EIP AllocationId (must be Available state)
• Target InstanceId (must be in same region)
• InstanceType

What to expect:

• EIP transitions from Available → InUse within seconds

Pre-flight Checks

| Check | Method | Expected | On Failure | |-------|--------|----------|------------| | EIP exists and Available | DescribeEipAddresses | Status=Available | EIP already in use or deleted | | Target instance exists | Resource-specific describe | Instance found | HALT; verify resource | | Same region | Compare RegionId fields | Match | HALT; EIP and target must be in same region | | No existing EIP on target | Check target current EIP | None | Ask: Unbind existing EIP first? |

Execution

# Associate EIP to ECS instance
aliyun vpc AssociateEipAddress \
  --RegionId "{{user.region}}" \
  --AllocationId "{{user.eip_id}}" \
  --InstanceId "{{user.instance_id}}" \
  --InstanceType "EcsInstance"

# Or associate to NAT Gateway
# aliyun vpc AssociateEipAddress \
#   --RegionId "{{user.region}}" \
#   --AllocationId "{{user.eip_id}}" \
#   --InstanceId "{{user.nat_gateway_id}}" \
#   --InstanceType "Nat"

Post-execution Validation

Poll until Status = InUse:

aliyun vpc DescribeEipAddresses \
  --RegionId "{{user.region}}" \
  --AllocationId "{{user.eip_id}}"

Operation: UnassociateEipAddress

When to use:

• Remove EIP from current resource before binding to another
• Migrate IP address between resources
• Prepare EIP for release

What you need:

• EIP AllocationId (must be InUse state)
• Current bound InstanceId and InstanceType

Pre-flight (Safety Gate)

• Warning: Unbinding causes network interruption to the bound resource.
• MUST confirm user intent before proceeding.
• Verify EIP is in InUse state.

Execution

aliyun vpc UnassociateEipAddress \
  --RegionId "{{user.region}}" \
  --AllocationId "{{user.eip_id}}" \
  --InstanceId "{{user.instance_id}}" \
  --InstanceType "{{user.instance_type}}"

Post-execution Validation

aliyun vpc DescribeEipAddresses \
  --RegionId "{{user.region}}" \
  --AllocationId "{{user.eip_id}}"

Verify Status = Available and fields InstanceId and InstanceType are empty.

Operation: Modify EIP (Bandwidth/Billing)

When to use:

• Scale up/down bandwidth based on traffic needs
• Switch between PayByBandwidth (fixed monthly) and PayByTraffic (usage-based)

What you need:

• EIP AllocationId
• New bandwidth value or new billing mode

Execution

# Upgrade bandwidth
aliyun vpc ModifyEipAddressAttribute \
  --RegionId "{{env.ALIBABA_CLOUD_REGION_ID}}" \
  --AllocationId "{{user.eip_id}}" \
  --Bandwidth "100"

# Switch billing mode
aliyun vpc ModifyEipAddressAttribute \
  --RegionId "{{env.ALIBABA_CLOUD_REGION_ID}}" \
  --AllocationId "{{user.eip_id}}" \
  --InternetChargeType "PayByTraffic" \
  --Bandwidth "100"

Operation: ReleaseEipAddress

Pre-flight (Safety Gate)

• MUST unbind EIP first (Status must be Available).
• MUST obtain explicit confirmation: irreversible release of {{output.eip_address}} ({{user.eip_id}}).
• MUST NOT proceed without clear user assent.

Execution

# Step 1: Unbind if necessary (only if InUse)
aliyun vpc UnassociateEipAddress \
  --RegionId "{{env.ALIBABA_CLOUD_REGION_ID}}" \
  --AllocationId "{{user.eip_id}}" \
  --InstanceId "{{user.instance_id}}" \
  --InstanceType "{{user.instance_type}}"

# Step 2: Release
aliyun vpc ReleaseEipAddress \
  --RegionId "{{env.ALIBABA_CLOUD_REGION_ID}}" \
  --AllocationId "{{user.eip_id}}"

Post-execution Validation

aliyun vpc DescribeEipAddresses \
  --RegionId "{{env.ALIBABA_CLOUD_REGION_ID}}" \
  --AllocationId "{{user.eip_id}}"

Empty result = confirmed released.

Operation: List EIPs

# List all EIPs with details
aliyun vpc DescribeEipAddresses --RegionId "{{env.ALIBABA_CLOUD_REGION_ID}}" \
  --output cols=AllocationId,IpAddress,Status,InstanceId,Bandwidth,Name rows=EipAddresses.EipAddress[].{AllocationId:AllocationId,IpAddress:IpAddress,Status:Status,InstanceId:InstanceId,Bandwidth:Bandwidth,Name:Name}

# List EIPs by status
aliyun vpc DescribeEipAddresses --RegionId "{{env.ALIBABA_CLOUD_REGION_ID}}" --Status Available

# List EIPs bound to NAT Gateways
aliyun vpc DescribeEipAddresses --RegionId "{{env.ALIBABA_CLOUD_REGION_ID}}" \
  --Output cols=AllocationId,IpAddress rows=EipAddresses.EipAddress[?InstanceType=='Nat' && Status=='InUse'].{AllocationId:AllocationId,IpAddress:IpAddress}

Failure Recovery

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: buhaiqing
• Source: buhaiqing/aliyun-skills
• License: MIT

Install and usage instructions live in the source repository linked above.