Alicloud Nas Ops

> This skill follows the Agent Skill OpenSpec.

Alibaba Cloud File Storage NAS Operations Skill

Runtime Rules

| Area | Rule | Reference | | --- | --- | --- | | CLI path | MANDATORY: Always prefer the SkillOpt wrapper ./scripts/nas-skillopt-wrapper.sh for all NAS CLI operations to enable automated self-repair and dynamic optimization; fallback to native aliyun nas only when the wrapper is unavailable or skillopt-lib.sh is missing. | [CLI](references/cli-usage.md), [SkillOpt](references/skillopt-integration.md) | | GCL | All write operations MUST pass GCL review before execution | [GCL Rubric](references/rubric.md) |

Overview

Alibaba Cloud File Storage NAS is a fully managed, shared, scalable, and distributed file system accessible over the standard NFS (v3 / v4.1) and SMB (2.x / 3.x) protocols. It supports four file system families — General-purpose NAS (standard), Extreme NAS (extreme), CPFS (Cloud Parallel File Storage), and CPFS SE — covering everything from web application hot storage to high-throughput HPC and AI workloads.

This skill is an operational runbook for agents: explicit scope, credential rules, pre-flight checks, dual-path execution (official aliyun CLI as the primary path, JIT Go SDK as the fallback for plugin-required or advanced operations), response validation, and failure recovery. Do not use the web console as the primary agent execution path in SKILL.md or 阿里云 NAS 控制台.

CLI applicability (repository policy)

• cli_applicability: dual-path:
• Primary path: aliyun nas covers ~95 control-plane

operations (file systems, mount targets, permission groups/rules, snapshots, lifecycle policies, recycle bin, filesets, tags, etc.).

• Fallback path: JIT Go SDK (github.com/alibabacloud-go/nas-20170626/v3/client)

for the small set of operations gated by the dedicated aliyun-cli-nas plugin, or for callers that prefer a programmatic flow.

Five Core Standards (Quality Gates)

| # | Standard | How This Skill Fulfills It | |---|----------|---------------------------| | 1 | Clear Boundaries | SHOULD/SHOULD NOT use conditions with precise triggers; explicit delegation to OSS / EBS / RAM / VPC skills | | 2 | Structured I/O | {{env.*}} / {{user.*}} / {{output.*}} placeholders; central JSON-path table | | 3 | Explicit Actionable Steps | Every operation: Pre-flight → Execute (CLI / SDK) → Validate → Recover | | 4 | Complete Failure Strategies | Error taxonomy ≥ 10 product-specific codes (InvalidFileSystem.NotFound, QuotaExceeded, Forbidden.RAM, etc.); HALT vs retry per type | | 5 | Absolute Single Responsibility | One product (NAS), one primary resource (FileSystem + MountTarget + AccessGroup); VPC / RAM / billing delegated |

Well-Architected Framework Integration

| Pillar | Skill Integration | Reference | |--------|-------------------|-----------| | 安全 (Security) | RAM permission groups (AccessGroup/AccessRule), NFS ACL, SMB ACL/AD, VPC-only mount targets, encryption | references/well-architected-assessment.md §2.1 | | 稳定 (Stability) | Cross-AZ mount targets, snapshot policies, recycle bin, lifecycle tier-down to IA/Archive, DR via cross-region replication | references/well-architected-assessment.md §2.2 | | 成本 (Cost) | Storage class (Performance / Capacity / Premium / standard / advance), StoragePackage plans, lifecycle tier-down, directory quota | references/well-architected-assessment.md §2.3 | | 效率 (Efficiency) | Batch mount-target creation, snapshot policy re-use, fileset operations for CPFS | references/well-architected-assessment.md §2.4 | | 性能 (Performance) | Extreme NAS tier (100 MB/s/TiB → 1000 MB/s/TiB), CPFS throughput, monitor IOPS/latency via CMS namespace | references/well-architected-assessment.md §2.5 |

Trigger & Scope (Agent-Readable)

SHOULD Use This Skill When

• User mentions "Alibaba Cloud NAS" OR "File Storage NAS" OR "文件存储" OR

"NAS" OR "文件系统" OR "挂载点" OR "权限组" OR "CPFS" OR "通用型NAS" OR "容量型NAS" OR "性能型NAS" OR "极速型NAS" OR "NFS" OR "SMB" OR "访问点" OR "快照策略" OR "回收站" OR "生命周期策略" OR "Fileset"

• Task involves CRUD or lifecycle operations on NAS file systems (create,

describe, modify, delete, list)

• Task involves mount targets: CreateMountTarget, DescribeMountTargets,

DeleteMountTarget, ModifyMountTarget

• Task involves permission groups and rules: CreateAccessGroup,

DescribeAccessGroups, ModifyAccessGroup, DeleteAccessGroup, CreateAccessRule, DescribeAccessRules, ModifyAccessRule, DeleteAccessRule

• Task involves access points: CreateAccessPoint, DescribeAccessPoints,

ModifyAccessPoint, DeleteAccessPoint

• Task involves snapshots and policies: CreateAutoSnapshotPolicy,

DescribeAutoSnapshotPolicies, ApplyAutoSnapshotPolicy, CreateSnapshot, DescribeSnapshots, DeleteSnapshot, ResetFileSystem (rollback)

• Task involves lifecycle / data tiering: CreateLifecyclePolicy,

DescribeLifecyclePolicies, ModifyLifecyclePolicy, StartLifecyclePolicyExecution, StopLifecyclePolicyExecution

• Task involves recycle bin: EnableRecycleBin, GetRecycleBinAttribute,

UpdateRecycleBinAttribute, DisableAndCleanRecycleBin, ListRecentlyRecycledDirectories, ListRecycledDirectoriesAndFiles, CreateRecycleBinRestoreJob, CreateRecycleBinDeleteJob

• Task involves NFS / SMB ACL, SMB protocol services,

LDAP/AD integration (EnableNfsAcl, DescribeNfsAcl, EnableSmbAcl, DescribeSmbAcl, CreateLDAPConfig, ModifyLDAPConfig, CreateProtocolService, DescribeProtocolService, CreateProtocolMountTarget)

• Task involves CPFS filesets and data flows:

CreateFileset, DescribeFilesets, ModifyFileset, DeleteFileset, CreateDataFlow, DescribeDataFlows, ModifyDataFlow, StartDataFlow, StopDataFlow

• Task involves directory quotas (SetDirQuota, DescribeDirQuotas,

CancelDirQuota, SetFilesetQuota, CancelFilesetQuota)

• Task involves NAS service activation (OpenNASService),

region/zone discovery (DescribeRegions, DescribeZones), tag management (AddTags, RemoveTags, ListTagResources, TagResources, UntagResources), resource group changes (ChangeResourceGroup)

• User mentions: mount, 挂载, 文件存储, 快照, 跨可用区, 权限组规则, 目录配额,

回收站恢复, 文件级快照, IA 存储, 归档存储, lifecycle policy

• User asks to deploy, configure, troubleshoot, or monitor NAS **via API, SDK,

CLI, or automation**

SHOULD NOT Use This Skill When

• Task is purely billing / account management → delegate to: alicloud-billing-ops
• Task is RAM / permission model only → delegate to: alicloud-ram-ops
• Task is about OSS object storage (buckets + objects) → delegate to:

alicloud-oss-ops

• Task is about block storage / EBS disks (for ECS) → delegate to:

alicloud-ecs-ops

• Task is about HDFS / Data Lake Analytics storage backend → use the data

analytics skill, not raw NAS

• Task is about CDN edge delivery (NAS is not a CDN origin by default;

use OSS + CDN)

• User wants to mount NAS from inside an ApsaraMQ / EMR cluster — those

clusters mount NAS through their own CSI drivers; this skill exposes the control plane only

• User insists on console-only flows with no API → state limitation

Delegation Rules

| 能力 | 委托目标 | 说明 | |------|----------|------| | GCL 质量门禁 | alicloud-gcl-runner-ops | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

Variable Convention (Agent-Readable)

| Placeholder | Meaning | Agent Action | |-------------|---------|--------------| | {{env.ALIBABA_CLOUD_ACCESS_KEY_ID}} | Alibaba Cloud AK | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}} | Alibaba Cloud SK | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_REGION_ID}} | Default region | Use documented default only if skill explicitly allows | | {{user.region}} | User-supplied region (e.g., cn-hangzhou) | Ask once; reuse | | {{user.zone_id}} | Zone (e.g., cn-hangzhou-h) | Ask when creating capacity-bound FS | | {{user.protocol_type}} | NFS / SMB / cpfs | Ask once; validate against FileSystemType | | {{user.storage_type}} | Performance / Capacity / Premium / standard / advance / advance_100 / advance_200 / economic | Ask once; validate | | {{user.file_system_type}} | standard / extreme / cpfs / cpfsse | Ask once; default standard | | {{user.file_system_id}} | File system ID (31a8e4****, extreme-****, cpfs-****, cpfsse-****) | Ask once; reuse | | {{user.mount_target_id}} | Mount target ID (e.g., mt-****) | Ask once; reuse | | {{user.access_group_name}} | Permission group name | Ask once; reuse | | {{user.vpc_id}} | VPC ID | Ask once; cross-check via alicloud-vpc-ops | | {{user.vswitch_id}} | vSwitch ID | Ask once; must be in same VPC and zone | | {{user.network_type}} | Vpc (only supported value in most regions) | Default Vpc; do not invent | | {{output.file_system_id}} | From CreateFileSystem response | Parse from $.FileSystemId | | {{output.mount_target_id}} | From CreateMountTarget response | Parse from $.MountTargetId | | {{output.mount_target_domain}} | From CreateMountTarget response | Parse from $.MountTargetDomain | | {{output.snapshot_id}} | From CreateSnapshot response | Parse from $.SnapshotId | | {{output.request_id}} | Request ID for support / correlation | Parse from $.RequestId |

> {{env.*}} MUST NOT be collected from the user. {{user.*}} MUST be > collected interactively when missing.

> 凭据安全（强制）： 参考 > [Credential Masking 规则](../alicloud-skill-generator/references/credential-masking.md)

API and Response Conventions (Agent-Readable)

• OpenAPI is canonical for path, query, body fields, enums, and response

shapes. Reference: https://help.aliyun.com/zh/nas/developer-reference/api-nas-2017-06-26-overview

• Errors: Map errors to Code and Message per spec. Common NAS codes:
• InvalidFileSystem.NotFound — File system ID does not exist
• InvalidMountTarget.NotFound — Mount target ID does not exist
• InvalidAccessGroup.NotFound — Permission group does not exist
• InvalidParameter — Missing or malformed parameter
• QuotaExceeded / FileSystem.QuotaFull — Account- or instance-level quota exhausted
• OperationDenied.FileSystemStatus — File system is not in a state that allows the operation
• Forbidden.RAM — Caller lacks nas:* RAM permission
• Throttling — Rate limit exceeded; exponential backoff required
• InsufficientBalance — Pay-as-you-go NAS requires a positive balance
• ServiceNotOpened — NAS not activated in the region (run OpenNASService first)
• Timestamps: ISO 8601 strings (e.g., 2026-04-28T10:00:00+08:00).
• Idempotency: CreateFileSystem accepts ClientToken (≤ 64 ASCII chars)

for safe retry; CreateMountTarget is non-idempotent — duplicates return OperationDenied.MountTargetDomainAlreadyExists. DeleteFileSystem and DeleteMountTarget are idempotent on already-deleted resources.

• Async behavior: CreateFileSystem, DeleteFileSystem,

CreateMountTarget, DeleteMountTarget are async. Poll DescribeFileSystems / DescribeMountTargets until terminal state (Running / Stopped / absent).

Common Response Field Table (JSON paths verified against OpenAPI 2017-06-26)

| Operation | JSON Path | Type | Description | |-----------|-----------|------|-------------| | OpenNASService | $.OrderId | string | Order ID for service activation | | CreateFileSystem | $.FileSystemId | string | New file system ID | | DescribeFileSystems | $.FileSystems.FileSystem[].FileSystemId | array | File system IDs | | DescribeFileSystems | $.FileSystems.FileSystem[].FileSystemType | string | standard / extreme / cpfs / cpfsse | | DescribeFileSystems | $.FileSystems.FileSystem[].Status | string | Pending / Running / Stopped | | DescribeFileSystems | $.FileSystems.FileSystem[].ProtocolType | string | NFS / SMB / cpfs | | DescribeFileSystems | $.FileSystems.FileSystem[].StorageType | string | Performance / Capacity / Premium / standard / advance | | DescribeFileSystems | $.FileSystems.FileSystem[].MeteredSize | integer | Used capacity in bytes | | DescribeFileSystems | $.TotalCount / $.PageSize / $.PageNumber | integer | Pagination metadata | | DeleteFileSystem | $.RequestId | string | Request ID | | CreateMountTarget | $.MountTargetDomain | string | Mount domain (e.g., 31a8e4****.cn-hangzhou.nas.aliyuncs.com) | | CreateMountTarget | $.MountTargetId | string | Mount target ID (e.g., mt-****) | | DescribeMountTargets | $.MountTargets.MountTarget[].MountTargetId | array | Mount target IDs | | DescribeMountTargets | $.MountTargets.MountTarget[].MountTargetDomain | array | Mount domains | | DescribeMountTargets | $.MountTargets.MountTarget[].Status | string | Pending / Active / Inactive / Deleted | | DescribeMountTargets | $.MountTargets.MountTarget[].VpcId / $.MountTargets.MountTarget[].VswId | string | Bound VPC / vSwitch | | DeleteMountTarget | $.RequestId | string | Request ID | | CreateAccessGroup | $.AccessGroupName | string | New permission group name | | DescribeAccessGroups | $.AccessGroups.AccessGroup[].AccessGroupName | array | Group names | | CreateAccessRule | $.AccessRuleId | string | New rule ID | | DescribeAccessRules | $.AccessRules.AccessRule[].AccessRuleId | array | Rule IDs | | DescribeAccessRules | $.AccessRules.AccessRule[].SourceCidrIp | array | Authorized source CIDR | | DescribeAccessRules | $.AccessRules.AccessRule[].RWAccessType | string | RDWR / RDONLY | | DescribeAccessRules | $.AccessRules.AccessRule[].UserAccessType | string | no_squash / root_squash / all_squash | | DescribeAccessRules | $.AccessRules.AccessRule[].Priority | integer | 1–100, 1 = highest | | CreateSnapshot | $.SnapshotId | string | New snapshot ID (e.g., s-****) | | DescribeSnapshots | $.Snapshots.Snapshot[].SnapshotId | array | Snapshot IDs | | DescribeSnapshots | $.Snapshots.Snapshot[].Status | string | Progressing / Accomplished / Failed | | CreateAutoSnapshotPolicy | $.AutoSnapshotPolicyId | string | New policy ID | | CreateAccessPoint | $.AccessPointId | string | New access point ID | | DescribeAccessPoints | $.AccessPoints.AccessPoint[].AccessPointId | array | Access point IDs | | CreateLifecyclePolicy | $.LifecyclePolicyName | string | New policy name | | DescribeLifecyclePolicies | $.LifecyclePolicies.LifecyclePolicy[].LifecyclePolicyName | array | Policy names | | GetRecycleBinAttribute | $.RecycleBinAttribute.RetentionDays | integer | Retention period (1–180 days) | | DescribeRegions | $.Regions.Region[].RegionId | array | Region IDs | | DescribeZones | $.Zones.Zone[].ZoneId | array | Zone IDs | | DescribeZones | $.Zones.Zone[].SupportedFileSystemType | array | Supported FS types per zone |

Expected State Transitions

| Operation | Initial State | Target State | Poll Interval | Max Wait | |-----------|---------------|--------------|---------------|----------| | CreateFileSystem | — | Running | 10s | 600s | | DeleteFileSystem | Running / Stopped | absent | 10s | 300s | | CreateMountTarget | — | Active | 5s | 300s | | DeleteMountTarget | Active | Deleted / absent | 5s | 300s | | CreateSnapshot | — | Accomplished | 10s | 1800s | | ResetFileSystem (rollback) | Running | Running (rolled back) | 10s | 3600s | | CreateRecycleBinRestoreJob | — | Running → Success | 10s | 86400s |

Quick Start

What This Skill Does

Manage the full NAS lifecycle: create file systems (4 families), mount targets, permission groups, access points, snapshots, lifecycle policies, recycle bin, and CPFS fi

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: buhaiqing
• Source: buhaiqing/aliyun-skills
• License: MIT

Install and usage instructions live in the source repository linked above.