# Alicloud Nas Ops

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-buhaiqing-aliyun-skills-alicloud-nas-ops`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [buhaiqing](https://agentstack.voostack.com/s/buhaiqing)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [buhaiqing](https://github.com/buhaiqing)
- **Source:** https://github.com/buhaiqing/aliyun-skills/tree/main/alicloud-nas-ops

## Install

```sh
agentstack add skill-buhaiqing-aliyun-skills-alicloud-nas-ops
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

> This skill follows the [Agent Skill OpenSpec](https://agentskills.io/specification).

# Alibaba Cloud File Storage NAS Operations Skill

## Runtime Rules

| Area | Rule | Reference |
| --- | --- | --- |
| CLI path | **MANDATORY**: Always prefer the SkillOpt wrapper `./scripts/nas-skillopt-wrapper.sh` for all NAS CLI operations to enable automated self-repair and dynamic optimization; fallback to native `aliyun nas` only when the wrapper is unavailable or `skillopt-lib.sh` is missing. | [CLI](references/cli-usage.md), [SkillOpt](references/skillopt-integration.md) |
| GCL | All write operations MUST pass GCL review before execution | [GCL Rubric](references/rubric.md) |

## Overview

**Alibaba Cloud File Storage NAS** is a fully managed, shared, scalable, and
distributed file system accessible over the standard NFS (v3 / v4.1) and SMB
(2.x / 3.x) protocols. It supports four file system families — **General-purpose
NAS (standard)**, **Extreme NAS (extreme)**, **CPFS** (Cloud Parallel File
Storage), and **CPFS SE** — covering everything from web application hot
storage to high-throughput HPC and AI workloads.

This skill is an **operational runbook** for agents: explicit scope, credential
rules, pre-flight checks, **dual-path execution** (official **`aliyun` CLI** as
the primary path, **JIT Go SDK** as the fallback for plugin-required or
advanced operations), response validation, and failure recovery. **Do not use
the web console as the primary agent execution path** in `SKILL.md` or
[阿里云 NAS 控制台](https://nas.console.aliyun.com).

### CLI applicability (repository policy)

- **`cli_applicability: dual-path`:**
  - **Primary path:** `aliyun nas ` covers ~95 control-plane
    operations (file systems, mount targets, permission groups/rules, snapshots,
    lifecycle policies, recycle bin, filesets, tags, etc.).
  - **Fallback path:** JIT Go SDK (`github.com/alibabacloud-go/nas-20170626/v3/client`)
    for the small set of operations gated by the dedicated
    `aliyun-cli-nas` plugin, or for callers that prefer a programmatic flow.

## Five Core Standards (Quality Gates)

| # | Standard | How This Skill Fulfills It |
|---|----------|---------------------------|
| 1 | **Clear Boundaries** | SHOULD/SHOULD NOT use conditions with precise triggers; explicit delegation to OSS / EBS / RAM / VPC skills |
| 2 | **Structured I/O** | `{{env.*}}` / `{{user.*}}` / `{{output.*}}` placeholders; central JSON-path table |
| 3 | **Explicit Actionable Steps** | Every operation: Pre-flight → Execute (CLI / SDK) → Validate → Recover |
| 4 | **Complete Failure Strategies** | Error taxonomy ≥ 10 product-specific codes (InvalidFileSystem.NotFound, QuotaExceeded, Forbidden.RAM, etc.); HALT vs retry per type |
| 5 | **Absolute Single Responsibility** | One product (NAS), one primary resource (FileSystem + MountTarget + AccessGroup); VPC / RAM / billing delegated |

### Well-Architected Framework Integration

| Pillar | Skill Integration | Reference |
|--------|-------------------|-----------|
| **安全 (Security)** | RAM permission groups (AccessGroup/AccessRule), NFS ACL, SMB ACL/AD, VPC-only mount targets, encryption | `references/well-architected-assessment.md` §2.1 |
| **稳定 (Stability)** | Cross-AZ mount targets, snapshot policies, recycle bin, lifecycle tier-down to IA/Archive, DR via cross-region replication | `references/well-architected-assessment.md` §2.2 |
| **成本 (Cost)** | Storage class (Performance / Capacity / Premium / standard / advance), StoragePackage plans, lifecycle tier-down, directory quota | `references/well-architected-assessment.md` §2.3 |
| **效率 (Efficiency)** | Batch mount-target creation, snapshot policy re-use, fileset operations for CPFS | `references/well-architected-assessment.md` §2.4 |
| **性能 (Performance)** | Extreme NAS tier (100 MB/s/TiB → 1000 MB/s/TiB), CPFS throughput, monitor IOPS/latency via CMS namespace | `references/well-architected-assessment.md` §2.5 |

## Trigger & Scope (Agent-Readable)

### SHOULD Use This Skill When

- User mentions "Alibaba Cloud NAS" OR "File Storage NAS" OR "文件存储" OR
  "NAS" OR "文件系统" OR "挂载点" OR "权限组" OR "CPFS" OR "通用型NAS" OR
  "容量型NAS" OR "性能型NAS" OR "极速型NAS" OR "NFS" OR "SMB" OR "访问点" OR
  "快照策略" OR "回收站" OR "生命周期策略" OR "Fileset"
- Task involves CRUD or lifecycle operations on **NAS file systems** (create,
  describe, modify, delete, list)
- Task involves **mount targets**: `CreateMountTarget`, `DescribeMountTargets`,
  `DeleteMountTarget`, `ModifyMountTarget`
- Task involves **permission groups and rules**: `CreateAccessGroup`,
  `DescribeAccessGroups`, `ModifyAccessGroup`, `DeleteAccessGroup`,
  `CreateAccessRule`, `DescribeAccessRules`, `ModifyAccessRule`,
  `DeleteAccessRule`
- Task involves **access points**: `CreateAccessPoint`, `DescribeAccessPoints`,
  `ModifyAccessPoint`, `DeleteAccessPoint`
- Task involves **snapshots and policies**: `CreateAutoSnapshotPolicy`,
  `DescribeAutoSnapshotPolicies`, `ApplyAutoSnapshotPolicy`,
  `CreateSnapshot`, `DescribeSnapshots`, `DeleteSnapshot`,
  `ResetFileSystem` (rollback)
- Task involves **lifecycle / data tiering**: `CreateLifecyclePolicy`,
  `DescribeLifecyclePolicies`, `ModifyLifecyclePolicy`,
  `StartLifecyclePolicyExecution`, `StopLifecyclePolicyExecution`
- Task involves **recycle bin**: `EnableRecycleBin`, `GetRecycleBinAttribute`,
  `UpdateRecycleBinAttribute`, `DisableAndCleanRecycleBin`,
  `ListRecentlyRecycledDirectories`, `ListRecycledDirectoriesAndFiles`,
  `CreateRecycleBinRestoreJob`, `CreateRecycleBinDeleteJob`
- Task involves **NFS / SMB ACL**, **SMB protocol services**,
  **LDAP/AD integration** (`EnableNfsAcl`, `DescribeNfsAcl`,
  `EnableSmbAcl`, `DescribeSmbAcl`, `CreateLDAPConfig`,
  `ModifyLDAPConfig`, `CreateProtocolService`, `DescribeProtocolService`,
  `CreateProtocolMountTarget`)
- Task involves **CPFS filesets and data flows**:
  `CreateFileset`, `DescribeFilesets`, `ModifyFileset`, `DeleteFileset`,
  `CreateDataFlow`, `DescribeDataFlows`, `ModifyDataFlow`,
  `StartDataFlow`, `StopDataFlow`
- Task involves **directory quotas** (`SetDirQuota`, `DescribeDirQuotas`,
  `CancelDirQuota`, `SetFilesetQuota`, `CancelFilesetQuota`)
- Task involves **NAS service activation** (`OpenNASService`),
  **region/zone discovery** (`DescribeRegions`, `DescribeZones`), **tag
  management** (`AddTags`, `RemoveTags`, `ListTagResources`,
  `TagResources`, `UntagResources`), **resource group changes**
  (`ChangeResourceGroup`)
- User mentions: mount, 挂载, 文件存储, 快照, 跨可用区, 权限组规则, 目录配额,
  回收站恢复, 文件级快照, IA 存储, 归档存储, lifecycle policy
- User asks to deploy, configure, troubleshoot, or monitor NAS **via API, SDK,
  CLI, or automation**

### SHOULD NOT Use This Skill When

- Task is purely billing / account management → delegate to: `alicloud-billing-ops`
- Task is RAM / permission model only → delegate to: `alicloud-ram-ops`
- Task is about **OSS object storage** (buckets + objects) → delegate to:
  `alicloud-oss-ops`
- Task is about **block storage / EBS disks** (for ECS) → delegate to:
  `alicloud-ecs-ops`
- Task is about **HDFS / Data Lake Analytics** storage backend → use the data
  analytics skill, not raw NAS
- Task is about **CDN edge delivery** (NAS is not a CDN origin by default;
  use OSS + CDN)
- User wants to mount NAS from inside an ApsaraMQ / EMR cluster — those
  clusters mount NAS through their own CSI drivers; this skill exposes the
  control plane only
- User insists on **console-only** flows with no API → state limitation

## Delegation Rules

| 能力 | 委托目标 | 说明 |
|------|----------|------|
| GCL 质量门禁 | `alicloud-gcl-runner-ops` | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

## Variable Convention (Agent-Readable)

| Placeholder | Meaning | Agent Action |
|-------------|---------|--------------|
| `{{env.ALIBABA_CLOUD_ACCESS_KEY_ID}}` | Alibaba Cloud AK | NEVER ask the user; fail if unset |
| `{{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}}` | Alibaba Cloud SK | NEVER ask the user; fail if unset |
| `{{env.ALIBABA_CLOUD_REGION_ID}}` | Default region | Use documented default only if skill explicitly allows |
| `{{user.region}}` | User-supplied region (e.g., `cn-hangzhou`) | Ask once; reuse |
| `{{user.zone_id}}` | Zone (e.g., `cn-hangzhou-h`) | Ask when creating capacity-bound FS |
| `{{user.protocol_type}}` | `NFS` / `SMB` / `cpfs` | Ask once; validate against `FileSystemType` |
| `{{user.storage_type}}` | `Performance` / `Capacity` / `Premium` / `standard` / `advance` / `advance_100` / `advance_200` / `economic` | Ask once; validate |
| `{{user.file_system_type}}` | `standard` / `extreme` / `cpfs` / `cpfsse` | Ask once; default `standard` |
| `{{user.file_system_id}}` | File system ID (`31a8e4****`, `extreme-****`, `cpfs-****`, `cpfsse-****`) | Ask once; reuse |
| `{{user.mount_target_id}}` | Mount target ID (e.g., `mt-****`) | Ask once; reuse |
| `{{user.access_group_name}}` | Permission group name | Ask once; reuse |
| `{{user.vpc_id}}` | VPC ID | Ask once; cross-check via `alicloud-vpc-ops` |
| `{{user.vswitch_id}}` | vSwitch ID | Ask once; must be in same VPC and zone |
| `{{user.network_type}}` | `Vpc` (only supported value in most regions) | Default `Vpc`; do not invent |
| `{{output.file_system_id}}` | From `CreateFileSystem` response | Parse from `$.FileSystemId` |
| `{{output.mount_target_id}}` | From `CreateMountTarget` response | Parse from `$.MountTargetId` |
| `{{output.mount_target_domain}}` | From `CreateMountTarget` response | Parse from `$.MountTargetDomain` |
| `{{output.snapshot_id}}` | From `CreateSnapshot` response | Parse from `$.SnapshotId` |
| `{{output.request_id}}` | Request ID for support / correlation | Parse from `$.RequestId` |

> **`{{env.*}}` MUST NOT** be collected from the user. **`{{user.*}}`** MUST be
> collected interactively when missing.

> **凭据安全（强制）：** 参考
> [Credential Masking 规则](../alicloud-skill-generator/references/credential-masking.md)

## API and Response Conventions (Agent-Readable)

- **OpenAPI is canonical** for path, query, body fields, enums, and response
  shapes. Reference:
  `https://help.aliyun.com/zh/nas/developer-reference/api-nas-2017-06-26-overview`
- **Errors:** Map errors to `Code` and `Message` per spec. Common NAS codes:
  - `InvalidFileSystem.NotFound` — File system ID does not exist
  - `InvalidMountTarget.NotFound` — Mount target ID does not exist
  - `InvalidAccessGroup.NotFound` — Permission group does not exist
  - `InvalidParameter` — Missing or malformed parameter
  - `QuotaExceeded` / `FileSystem.QuotaFull` — Account- or instance-level quota exhausted
  - `OperationDenied.FileSystemStatus` — File system is not in a state that allows the operation
  - `Forbidden.RAM` — Caller lacks `nas:*` RAM permission
  - `Throttling` — Rate limit exceeded; exponential backoff required
  - `InsufficientBalance` — Pay-as-you-go NAS requires a positive balance
  - `ServiceNotOpened` — NAS not activated in the region (run `OpenNASService` first)
- **Timestamps:** ISO 8601 strings (e.g., `2026-04-28T10:00:00+08:00`).
- **Idempotency:** `CreateFileSystem` accepts `ClientToken` (≤ 64 ASCII chars)
  for safe retry; `CreateMountTarget` is **non-idempotent** — duplicates return
  `OperationDenied.MountTargetDomainAlreadyExists`. `DeleteFileSystem` and
  `DeleteMountTarget` are idempotent on already-deleted resources.
- **Async behavior:** `CreateFileSystem`, `DeleteFileSystem`,
  `CreateMountTarget`, `DeleteMountTarget` are async. Poll `DescribeFileSystems`
  / `DescribeMountTargets` until terminal state (`Running` / `Stopped` / absent).

### Common Response Field Table (JSON paths verified against OpenAPI 2017-06-26)

| Operation | JSON Path | Type | Description |
|-----------|-----------|------|-------------|
| OpenNASService | `$.OrderId` | string | Order ID for service activation |
| CreateFileSystem | `$.FileSystemId` | string | New file system ID |
| DescribeFileSystems | `$.FileSystems.FileSystem[].FileSystemId` | array | File system IDs |
| DescribeFileSystems | `$.FileSystems.FileSystem[].FileSystemType` | string | `standard` / `extreme` / `cpfs` / `cpfsse` |
| DescribeFileSystems | `$.FileSystems.FileSystem[].Status` | string | `Pending` / `Running` / `Stopped` |
| DescribeFileSystems | `$.FileSystems.FileSystem[].ProtocolType` | string | `NFS` / `SMB` / `cpfs` |
| DescribeFileSystems | `$.FileSystems.FileSystem[].StorageType` | string | `Performance` / `Capacity` / `Premium` / `standard` / `advance` |
| DescribeFileSystems | `$.FileSystems.FileSystem[].MeteredSize` | integer | Used capacity in bytes |
| DescribeFileSystems | `$.TotalCount` / `$.PageSize` / `$.PageNumber` | integer | Pagination metadata |
| DeleteFileSystem | `$.RequestId` | string | Request ID |
| CreateMountTarget | `$.MountTargetDomain` | string | Mount domain (e.g., `31a8e4****.cn-hangzhou.nas.aliyuncs.com`) |
| CreateMountTarget | `$.MountTargetId` | string | Mount target ID (e.g., `mt-****`) |
| DescribeMountTargets | `$.MountTargets.MountTarget[].MountTargetId` | array | Mount target IDs |
| DescribeMountTargets | `$.MountTargets.MountTarget[].MountTargetDomain` | array | Mount domains |
| DescribeMountTargets | `$.MountTargets.MountTarget[].Status` | string | `Pending` / `Active` / `Inactive` / `Deleted` |
| DescribeMountTargets | `$.MountTargets.MountTarget[].VpcId` / `$.MountTargets.MountTarget[].VswId` | string | Bound VPC / vSwitch |
| DeleteMountTarget | `$.RequestId` | string | Request ID |
| CreateAccessGroup | `$.AccessGroupName` | string | New permission group name |
| DescribeAccessGroups | `$.AccessGroups.AccessGroup[].AccessGroupName` | array | Group names |
| CreateAccessRule | `$.AccessRuleId` | string | New rule ID |
| DescribeAccessRules | `$.AccessRules.AccessRule[].AccessRuleId` | array | Rule IDs |
| DescribeAccessRules | `$.AccessRules.AccessRule[].SourceCidrIp` | array | Authorized source CIDR |
| DescribeAccessRules | `$.AccessRules.AccessRule[].RWAccessType` | string | `RDWR` / `RDONLY` |
| DescribeAccessRules | `$.AccessRules.AccessRule[].UserAccessType` | string | `no_squash` / `root_squash` / `all_squash` |
| DescribeAccessRules | `$.AccessRules.AccessRule[].Priority` | integer | 1–100, 1 = highest |
| CreateSnapshot | `$.SnapshotId` | string | New snapshot ID (e.g., `s-****`) |
| DescribeSnapshots | `$.Snapshots.Snapshot[].SnapshotId` | array | Snapshot IDs |
| DescribeSnapshots | `$.Snapshots.Snapshot[].Status` | string | `Progressing` / `Accomplished` / `Failed` |
| CreateAutoSnapshotPolicy | `$.AutoSnapshotPolicyId` | string | New policy ID |
| CreateAccessPoint | `$.AccessPointId` | string | New access point ID |
| DescribeAccessPoints | `$.AccessPoints.AccessPoint[].AccessPointId` | array | Access point IDs |
| CreateLifecyclePolicy | `$.LifecyclePolicyName` | string | New policy name |
| DescribeLifecyclePolicies | `$.LifecyclePolicies.LifecyclePolicy[].LifecyclePolicyName` | array | Policy names |
| GetRecycleBinAttribute | `$.RecycleBinAttribute.RetentionDays` | integer | Retention period (1–180 days) |
| DescribeRegions | `$.Regions.Region[].RegionId` | array | Region IDs |
| DescribeZones | `$.Zones.Zone[].ZoneId` | array | Zone IDs |
| DescribeZones | `$.Zones.Zone[].SupportedFileSystemType` | array | Supported FS types per zone |

### Expected State Transitions

| Operation | Initial State | Target State | Poll Interval | Max Wait |
|-----------|---------------|--------------|---------------|----------|
| CreateFileSystem | — | `Running` | 10s | 600s |
| DeleteFileSystem | `Running` / `Stopped` | absent | 10s | 300s |
| CreateMountTarget | — | `Active` | 5s | 300s |
| DeleteMountTarget | `Active` | `Deleted` / absent | 5s | 300s |
| CreateSnapshot | — | `Accomplished` | 10s | 1800s |
| ResetFileSystem (rollback) | `Running` | `Running` (rolled back) | 10s | 3600s |
| CreateRecycleBinRestoreJob | — | `Running` → `Success` | 10s | 86400s |

## Quick Start

### What This Skill Does
Manage the full NAS lifecycle: create file systems (4 families), mount targets,
permission groups, access points, snapshots, lifecycle policies, recycle bin,
and CPFS fi

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [buhaiqing](https://github.com/buhaiqing)
- **Source:** [buhaiqing/aliyun-skills](https://github.com/buhaiqing/aliyun-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-buhaiqing-aliyun-skills-alicloud-nas-ops
- Seller: https://agentstack.voostack.com/s/buhaiqing
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.