Alicloud Rds Ops

> This skill follows the Agent Skill OpenSpec.

Alibaba Cloud RDS Operations Skill

Common JSON Paths (Centralized)

# Create DB Instance:         $.DBInstanceId
# Describe DB Instances:      $.Items.DBInstance[].{DBInstanceId,DBInstanceStatus,Engine,EngineVersion,RegionId,ZoneId}
# Describe Accounts:          $.Accounts.DBInstanceAccount[].AccountName
# Describe Databases:         $.Databases.Database[].DBName
# Describe Backups:           $.Items.Backup[].BackupId
# Describe ResourceUsage:     $.{DiskUsed,LogSize,DataSize}
# Create Backup:              $.BackupJobId
# Create Database:            $.DBName
# Create/Restore/Delete/etc:  $.RequestId

Overview

Alibaba Cloud RDS (Relational Database Service) provides managed relational databases including MySQL, PostgreSQL, SQL Server, and MariaDB. This skill is an operational runbook for agents: explicit scope, credential rules, pre-flight checks, dual-path execution (official SDK/API and CLI flows), response validation, and failure recovery.

CLI applicability (repository policy)

• cli_applicability: dual-path: Official aliyun fully supports RDS. Each

execution flow documents both the SDK step and the aliyun step for every operation.

Runtime Rules

| Area | Rule | Reference | | --- | --- | --- | | CLI path | MANDATORY: Always prefer the SkillOpt wrapper ./scripts/rds-skillopt-wrapper.sh for all RDS CLI operations to enable automated self-repair and dynamic optimization; fallback to native aliyun rds only when the wrapper is unavailable or skillopt-lib.sh is missing. For runtime enforcement, source the shared shim: source ../../alicloud-skill-generator/scripts/skillopt-shim/aliyun-shim.sh. | [CLI](references/cli-usage.md), [SkillOpt](references/skillopt-integration.md), [Shim](file://../../alicloud-skill-generator/scripts/skillopt-shim/SHIM-README.md) | | Credentials | Read {{env.*}} only from environment; never ask user to paste or print secrets | [Integration](references/integration.md) | | GCL | All write operations MUST pass GCL adversarial review before execution | [GCL Rubric](references/rubric.md) |

Quick Start

不知道从哪里开始？按需选一个：

• "怎么把 SQL 文件跑进 RDS" → [SQL Execution Runbook](references/advanced/sql-execution.md)（含 mysql 客户端和 RDS Data API 两种路径）
• "我需要 1 条自然语言提示词" → [Prompts Handbook](references/prompts.md)（34 条分类示例）
• "实例有异常，帮我巡检一下" → [RDS Cruise 巡检工作流](references/cruise.md) + [Alert Diagnosis](references/alert-diagnosis.md)
• "我想看核心概念/术语" → [Core Concepts](references/core-concepts.md)
• "出错码对应什么" → [Troubleshooting Guide](references/troubleshooting.md)
• "我要写自定义 Go SDK 脚本" → [API & SDK Usage](references/api-sdk-usage.md)

Trigger & Scope (Agent-Readable)

SHOULD Use This Skill When

• User mentions "Alibaba Cloud RDS" OR "云数据库" OR "关系型数据库" OR "RDS实例"
• User mentions "MySQL" OR "PostgreSQL" OR "SQL Server" OR "MariaDB" in the

context of Alibaba Cloud managed databases

• Task involves CRUD or lifecycle operations on RDS DB instances (create,

describe, modify, delete, list, restart, upgrade)

• Task involves database accounts (create, describe, delete, grant privileges)
• Task involves databases (create, describe, delete)
• Task involves backups (create, describe, restore, delete)
• Task involves performance monitoring (CPU, memory, IOPS, connections, TPS/QPS)
• Task involves slow query logs (describe, analyze)
• Task involves executing SQL or running a .sql file on RDS MySQL (use

mysql client or aliyun rds-data — see [SQL Execution](references/advanced/sql-execution.md); not aliyun rds alone)

• Task involves parameter groups (describe, modify)
• Task involves security groups / whitelists (describe, modify)
• Task keywords: 数据库, 实例, 备份, 慢查询, 参数, 白名单, 监控, SQL, sql文件,

执行SQL, 导入脚本, database, instance, backup, slow log, parameter, whitelist, monitor, execute sql, sql file, schema

• User asks to deploy, configure, troubleshoot, or monitor RDS **via API, SDK,

CLI, or automation**

SHOULD NOT Use This Skill When

• Task is purely billing / account management → delegate to: alicloud-billing-ops

(when present)

• Task is RAM / permission model only → delegate to: alicloud-ram-ops (when present)
• Task is about PolarDB MySQL → delegate to: alicloud-polar-mysql-ops
• Task is about PolarDB PostgreSQL → delegate to: alicloud-polar-postgresql-ops
• Task is about PolarDB Oracle-compatible → delegate to: alicloud-polar-oracle-ops
• Task is about Redis / NoSQL → delegate to: alicloud-redis-ops (when present)
• Task is about MongoDB → delegate to: alicloud-mongodb-ops (when present)
• User insists on console-only flows with no API → state limitation; do not

invent undocumented HTTP steps

Delegation Rules

| 能力 | 委托目标 | 说明 | |------|----------|------| | GCL 质量门禁 | alicloud-gcl-runner-ops | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

Variable Convention (Agent-Readable)

| Placeholder | Meaning | Agent Action | |-------------|---------|--------------| | {{env.ALIBABA_CLOUD_ACCESS_KEY_ID}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_REGION_ID}} | From runtime environment | Use documented default only if skill explicitly allows | | {{user.region}} | User-supplied region | Ask once; reuse | | {{user.db_instance_id}} | User-supplied RDS DBInstanceId | Ask once; reuse | | {{user.db_instance_name}} | User-supplied RDS instance name | Ask once; reuse | | {{user.engine}} | Database engine (MySQL, PostgreSQL, SQLServer, MariaDB) | Ask once; reuse | | {{user.engine_version}} | Engine version (e.g., 8.0, 13.0) | Ask once; reuse | | {{user.account_name}} | Database account name | Ask once; reuse | | {{user.db_name}} | Database name | Ask once; reuse | | {{user.backup_id}} | Backup ID | Ask once; reuse | | {{output.db_instance_id}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.request_id}} | From API response | For support / correlation |

> {{env.*}} MUST NOT be collected from the user. {{user.*}} MUST be > collected interactively when missing.

> 凭据安全（强制）： 参考 [Credential Masking 规则](../alicloud-skill-generator/references/credential-masking.md)

API and Response Conventions (Agent-Readable)

• OpenAPI is canonical for path, query, body fields, enums, and response shapes.
• Errors: Map SDK/HTTP errors to code / status / message fields per spec.
• Timestamps: ISO 8601 with timezone when the API returns strings.
• Idempotency: Document client request tokens, duplicate names, and

DBInstanceAlreadyExists behavior per API.

• ClientToken: For write operations (CreateDBInstance, CreateAccount, etc.),

generate a unique ClientToken (UUID v4) per logical request. If the same operation is retried due to network timeout, reuse the same ClientToken to ensure idempotency. The API returns the same result for duplicate requests with the same ClientToken within 24 hours.

Response Field Table

| Operation | JSON Path | Type | Description | |-----------|-----------|------|-------------| | CreateDBInstance | $.DBInstanceId | string | New DB instance ID | | DescribeDBInstances | $.Items.DBInstance[].DBInstanceId | array | Instance IDs | | DescribeDBInstances | $.Items.DBInstance[].DBInstanceStatus | string | Instance status | | DescribeDBInstances | $.Items.DBInstance[].Engine | string | Engine type | | DescribeDBInstances | $.Items.DBInstance[].EngineVersion | string | Engine version | | DescribeDBInstances | $.Items.DBInstance[].DBInstanceClass | string | Instance class | | DescribeDBInstances | $.Items.DBInstance[].RegionId | string | Region ID | | DescribeDBInstances | $.Items.DBInstance[].ZoneId | string | Zone ID | | DescribeDBInstances | $.Items.DBInstance[].CreationTime | string | ISO 8601 timestamp | | DescribeDBInstances | $.Items.DBInstance[].ExpireTime | string | ISO 8601 expiration | | DescribeDBInstances | $.Items.DBInstance[].DBInstanceStorage | string | Storage size (GB) | | RestartDBInstance | $.RequestId | string | Request ID | | DeleteDBInstance | $.RequestId | string | Request ID | | DescribeAccounts | $.Accounts.DBInstanceAccount[].AccountName | array | Account names | | DescribeDatabases | $.Databases.Database[].DBName | array | Database names | | DescribeBackups | $.Items.Backup[].BackupId | array | Backup IDs | | DescribeSlowLogs | $.Items.SQLSlowLog[].SQLText | array | Slow query SQL text | | DescribeResourceUsage | $.DiskUsed | int | Disk used (MB) | | DescribeResourceUsage | $.LogSize | int | Log size (MB) | | DescribeResourceUsage | $.DataSize | int | Data size (MB) | | DescribeDBInstancePerformance | $.PerformanceKeys.PerformanceKey[].Key | array | Metric keys | | DescribeDBInstancePerformance | $.PerformanceKeys.PerformanceKey[].ValueFormat | string | Value format | | DescribeDBInstanceHAConfig | $.SyncMode | string | Sync mode (Sync/Async) | | DescribeDBInstanceHAConfig | $.HAMode | string | HA mode (RPO/RTO) | | DescribeDBInstanceHAConfig | $.HostInstanceInfos.NodeInfo[].NodeType | array | Master/Slave node types | | CreateDatabase | $.DBName | string | Created database name | | DeleteDatabase | $.RequestId | string | Request ID | | DeleteAccount | $.RequestId | string | Request ID | | CreateBackup | $.BackupJobId | string | Backup job ID | | RestoreDBInstance | $.DBInstanceId | string | Restored instance ID | | DescribeReadDBInstances | $.Items.ReadOnlyDBInstance[].DBInstanceId | array | Read-only instance IDs |

Expected State Transitions

| Operation | Initial State | Target State | Poll Interval | Max Wait | |-----------|---------------|--------------|---------------|----------| | CreateDBInstance | — | Running | 10s | 600s | | RestartDBInstance | Running | Running | 10s | 300s | | DeleteDBInstance | any stable state | absent | 10s | 300s | | CreateAccount | — | Available | 5s | 120s | | CreateDatabase | — | Running | 5s | 120s | | RestoreDBInstance | — | Running | 10s | 600s | | CreateBackup | — | Success | 10s | 600s |

Polling Strategy

RDS 写入操作多为异步；通用 shell 轮询模板与各 Operation 参数见 [references/polling-patterns.md](references/polling-patterns.md)。

> 未达到 Target State 但接近 Max Wait → 进入 [Failure Recovery](#failure-recovery) > 流程，记录 RequestId 提交工单。

Execution Flows (Agent-Readable)

Every operation: Pre-flight → Execute (SDK/API and aliyun) → Validate → Recover.

> EXECUTION MANDATORY RULE: 所有 CLI 执行步骤 必须 通过 SkillOpt wrapper ./scripts/rds-skillopt-wrapper.sh 运行。 > 以下所有代码块中的 aliyun rds ... 命令在执行时应替换为 ./scripts/rds-skillopt-wrapper.sh ...。 > 仅在 wrapper 脚本不可用时，才退回到原生 aliyun rds CLI 调用。 > 参考 ## Runtime Rules 中的 CLI path 规则。

---

Operation: Create DB Instance

Pre-flight Checks

| Check | Method | Expected | On Failure | |-------|--------|----------|------------| | SDK / deps | aliyun version | Exit code 0 | Document CLI install | | Credentials | Env vars or CLI config | Non-empty keys | HALT; user configures env | | Region | aliyun rds DescribeRegions | {{user.region}} supported | Suggest valid region | | Engine / Version | aliyun rds DescribeAvailableClasses | {{user.engine}} {{user.engine_version}} supported | Suggest valid combo | | VPC/VSwitch | aliyun vpc DescribeVpcs / DescribeVSwitches | VPC and VSwitch exist | Delegate to alicloud-vpc-ops | | Quota | aliyun rds DescribeAvailableResource | Sufficient quota | HALT; user raises quota |

Execution — CLI (Primary Path)

aliyun rds CreateDBInstance \
  --RegionId "{{user.region}}" \
  --Engine "{{user.engine}}" \
  --EngineVersion "{{user.engine_version}}" \
  --DBInstanceClass "{{user.db_instance_class}}" \
  --DBInstanceStorage "{{user.db_instance_storage}}" \
  --DBInstanceNetType "{{user.net_type|Intranet}}" \
  --VPCId "{{user.vpc_id}}" \
  --VSwitchId "{{user.vswitch_id}}" \
  --SecurityIPList "{{user.security_ip_list|10.0.0.0/8}}" \
  --PayType "{{user.pay_type|Postpaid}}"

> Note: Output is JSON by default. Parse DBInstanceId from response.

Execution — JIT Go SDK (Fallback Path)

JIT Go SDK fallback: 参见 [API & SDK Usage](references/api-sdk-usage.md)

Post-execution Validation

1. Read {{output.db_instance_id}} from $.DBInstanceId.
2. Poll DescribeDBInstances until DBInstanceStatus is Running:

# 通用轮询，参数见 [references/polling-patterns.md](references/polling-patterns.md)

1. On success, report {{output.db_instance_id}}, connection string, and key fields.
2. On terminal failure, go to Failure Recovery.

Failure Recovery

| Error pattern | Max retries | Backoff | Agent Action | |---------------|-------------|---------|--------------| | InvalidParameter / 400 | 0–1 | — | Fix args from OpenAPI; retry once if safe | | QuotaExceeded / DBInstanceQuotaExceeded | 0 | — | HALT | | InsufficientBalance | 0 | — | HALT | | DBInstanceAlreadyExists | 0 | — | Ask reuse vs new name | | Throttling / 429 | 3 | exponential | Back off; respect Retry-After | | InternalError / 5xx | 3 | 2s, 4s, 8s | Retry; then HALT with RequestId |

---

Operation: Describe DB Instances

Execution — CLI

# Describe all instances in region
aliyun rds DescribeDBInstances --RegionId "{{user.region}}"

# Describe specific instance
aliyun rds DescribeDBInstances \
  --RegionId "{{user.region}}" \
  --DBInstanceId "{{user.db_instance_id}}"

# Extract specific fields with JMESPath
aliyun rds DescribeDBInstances --RegionId "{{user.region}}" \
  --output cols=DBInstanceId,DBInstanceStatus,Engine,DBInstanceClass rows=Items.DBInstance[].{DBInstanceId,DBInstanceStatus,Engine,DBInstanceClass}

Execution — JIT Go SDK

JIT Go SDK fallback: 参见 [API & SDK Usage](references/api-sdk-usage.md)

Present to User

| Field | Path | Notes | |-------|------|-------| | DB Instance ID | $.Items.DBInstance[].DBInstanceId | Plain text | | Name | $.Items.DBInstance[].DBInstanceDescription | Plain text | | Status | $.Items.DBInstance[].DBInstanceStatus | Running, Creating, Deleting, Rebooting, etc. | | Engine | $.Items.DBInstance[].Engine | MySQL, PostgreSQL, SQLServer, MariaDB | | Version | $.Items.DBInstance[].EngineVersion | e.g., 8.0, 13.0 | | Instance Class | $.Items.DBInstance[].DBInstanceClass | e.g., rds.mysql.s1.large | | Storage | $.Items.DBInstance[].DBInstanceStorage | GB | | Region | $.Items.DBInstance[].RegionId | Plain text | | Zone | $.Items.DBInstance[].ZoneId | Plain text | | Network Type | $.Items.DBInstance[].DBInstanceNetType | Internet / Intranet | | VPC ID | $.Items.DBInstance[].VPCId | Plain text | | VSwitch ID | $.Items.DBInstance[].VSwitchId | Plain text | | Security IPs | $.Items.DBInstance[].SecurityIPList | Comma-separated | | Creation Time | $.Items.DBInstance[].CreationTime | ISO 8601 | | Expire Time | $.Items.DBInstance[].ExpireTime | ISO 8601 | | Pay Type | $.Items.DBInstance[].PayType | Postpaid / Prepaid |

---

Operation: Restart DB Instance

Pre-flight

• Verify instance exists and status is Running.
• MUST obtain explicit confirmation: restart causes brief downtime.

Execution — CLI

aliyun rds RestartDBInstance --DBInstanceId "{{user.db_instance_id}}"

Execution — JIT Go SDK

JIT Go SDK fallback: 参见 [API & SDK Usage](references/api-sdk-usage.md)

Post-execution Validation

Poll until DBInstanceStatus returns to Running:

# 通用轮询，参数见 [references/polling-patterns.md](references/polling-patterns.md)

---

Operation: Delete DB Instance

Pre-flight (Safety Gate)

• MUST obtain explicit confirmation: irreversible delete of instance

`{{user.db_in

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: buhaiqing
• Source: buhaiqing/aliyun-skills
• License: MIT

Install and usage instructions live in the source repository linked above.