Configure IM Channels
Elastic Compute Agent IM channels integrate with DingTalk, Feishu, and WeCom to extend agent capabilities into instant messaging scenarios. Configure an IM channel to enable mobile O&M, alert loop closure, and team collaboration directly from your IM groups.
Elastic Compute Agent is currently in invitation-only testing, and IM channel features are being continuously improved. If you encounter creation failures or usage issues, submit a ticket to contact us.
IM channel capabilities
After you configure an IM channel, the following capabilities are available in your IM group:
Group chat — Send natural language commands by @mentioning the bot in an IM group.
Scheduled task result push — After a scheduled task completes, the inspection report is automatically pushed to the configured IM group.
Anomaly alert notification — When a health check detects an anomaly, anomaly details and remediation recommendations are immediately pushed to the group.
Multi-group management — Configure multiple bots and grant different IM resource operation permissions through RAM roles.
The IM channel bot obtains cloud resource operation permissions through its associated RAM role (see Step 1: Create a RAM Role). After a bot is added to an IM group, all group members who can @mention the bot can interact with the agent through it. The scope of resource operations they can perform is determined by the permissions of the RAM role associated with that IM channel. We recommend adding the bot only to controlled O&M groups and using least-privilege RAM role authorization.
Supported IM platforms
| IM Platform | Integration Method | Description |
| DingTalk | DingTalk application | Create an application on the DingTalk Open Platform to obtain the Client ID and Client Secret. One-click creation is recommended (entry point provided in the DingTalk developer console, which automatically preconfigures the required permissions). No manual configuration required. |
| Feishu | Feishu agent application | Create an agent application on the Feishu Open Platform to obtain the App ID and App Secret. One-click creation is recommended (entry point provided in the Feishu Open Platform, which automatically preconfigures the required permissions). No manual configuration required. |
| WeCom | WeCom intelligent bot (API mode) | In the WeCom Admin Console, select Intelligent Bot and create it in API mode to obtain the Bot ID and Secret. Currently, only manual creation is supported. |
Configuration steps
Step 1: Create a RAM role
IM channel bots require a RAM role to obtain permissions for accessing Alibaba Cloud resources. The following table describes two commonly used role examples to help you choose:
| Role | Scope | When to use |
| Role 1: Resource Exploration and Analysis (Recommended) | Read-only — resource queries, health inspections, and trend analysis. No write operations. | You only need to query resources and view inspection reports through IM. |
| Role 2: O&M Operations | All Role 1 permissions plus the ability to respond to system O&M events (such as confirming instance maintenance notifications). | You need to respond to system events directly through IM channels in addition to read-only operations. |
Create the role
Log on to the RAM console.
Choose Identity Management > Roles, and click Create Role.
Select Cloud Service as the Trusted Entity Type, and select "ComputeNest / AppFlow" as the Trusted Entity Name. The corresponding service identifier is
appflow.computenest.aliyuncs.com.Enter the role name (such as
RoleForECAgentIM-ExplorerorRoleForECAgentIM-Operator), and click OK.On the role details page, click Permission Management > Add Authorization. Create a custom policy, paste the access policy JSON for your chosen role (see the following sections), and grant it to the role.
Record the role name. You will need to select it when creating the IM channel.
Role 1 access policy: Resource exploration and analysis (recommended)
Applicable to read-only scenarios such as resource queries, health inspections, and trend analysis. Does not include any write operations. The trust policy is automatically generated by the RAM console when creating the role (select Cloud Service as the Trusted Entity Type, and select "ComputeNest / AppFlow" as the Trusted Entity Name, with the corresponding service identifier appflow.computenest.aliyuncs.com). No manual configuration required.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:CreateDiagnosticReport",
"ecs:DescribeAccountAttributes",
"ecs:DescribeActivations",
"ecs:DescribeAutoProvisioningGroupHistory",
"ecs:DescribeAutoProvisioningGroupInstances",
"ecs:DescribeAutoProvisioningGroups",
"ecs:DescribeAutoSnapshotPolicyAssociations",
"ecs:DescribeAutoSnapshotPolicyEx",
"ecs:DescribeAvailableResource",
"ecs:DescribeBandwidthLimitation",
"ecs:DescribeBandwidthPackages",
"ecs:DescribeCapacityReservationInstances",
"ecs:DescribeCapacityReservations",
"ecs:DescribeClassicLinkInstances",
"ecs:DescribeCloudAssistantSettings",
"ecs:DescribeCloudAssistantStatus",
"ecs:DescribeCommands",
"ecs:DescribeDedicatedHostAutoRenew",
"ecs:DescribeDedicatedHostClusters",
"ecs:DescribeDedicatedHostTypes",
"ecs:DescribeDedicatedHosts",
"ecs:DescribeDeploymentSetSupportedInstanceTypeFamily",
"ecs:DescribeDeploymentSets",
"ecs:DescribeDiagnosticMetricSets",
"ecs:DescribeDiagnosticMetrics",
"ecs:DescribeDiagnosticReportAttributes",
"ecs:DescribeDiagnosticReports",
"ecs:DescribeDiskDefaultKMSKeyId",
"ecs:DescribeDiskMonitorData",
"ecs:DescribeDisks",
"ecs:DescribeDisksFullStatus",
"ecs:DescribeElasticityAssuranceAutoRenewAttribute",
"ecs:DescribeElasticityAssuranceInstances",
"ecs:DescribeElasticityAssurances",
"ecs:DescribeEniMonitorData",
"ecs:DescribeHpcClusters",
"ecs:DescribeImageComponents",
"ecs:DescribeImageFromFamily",
"ecs:DescribeImagePipelineExecutions",
"ecs:DescribeImagePipelines",
"ecs:DescribeImageSharePermission",
"ecs:DescribeImageSupportInstanceTypes",
"ecs:DescribeImages",
"ecs:DescribeInstanceAttachmentAttributes",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeInstanceAutoRenewAttribute",
"ecs:DescribeInstanceHistoryEvents",
"ecs:DescribeInstanceMaintenanceAttributes",
"ecs:DescribeInstanceModificationPrice",
"ecs:DescribeInstanceMonitorData",
"ecs:DescribeInstanceRamRole",
"ecs:DescribeInstanceStatus",
"ecs:DescribeInstanceTypeFamilies",
"ecs:DescribeInstanceTypes",
"ecs:DescribeInstanceVncUrl",
"ecs:DescribeInstances",
"ecs:DescribeInstancesFullStatus",
"ecs:DescribeInvocationResults",
"ecs:DescribeInvocations",
"ecs:DescribeKeyPairs",
"ecs:DescribeLaunchTemplateVersions",
"ecs:DescribeLaunchTemplates",
"ecs:DescribeLockedSnapshots",
"ecs:DescribeManagedInstances",
"ecs:DescribeNetworkInterfaceAttribute",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DescribeNetworkInterfaces",
"ecs:DescribePlanMaintenanceWindows",
"ecs:DescribePortRangeListAssociations",
"ecs:DescribePortRangeListEntries",
"ecs:DescribePortRangeLists",
"ecs:DescribePrefixListAssociations",
"ecs:DescribePrefixListAttributes",
"ecs:DescribePrefixLists",
"ecs:DescribePrice",
"ecs:DescribeRecommendInstanceType",
"ecs:DescribeRegions",
"ecs:DescribeRenewalPrice",
"ecs:DescribeReservedInstanceAutoRenewAttribute",
"ecs:DescribeReservedInstances",
"ecs:DescribeResourcesModification",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroupReferences",
"ecs:DescribeSecurityGroups",
"ecs:DescribeSendFileResults",
"ecs:DescribeSnapshotGroups",
"ecs:DescribeSnapshotLinks",
"ecs:DescribeSnapshotMonitorData",
"ecs:DescribeSnapshotPackage",
"ecs:DescribeSnapshots",
"ecs:DescribeSnapshotsUsage",
"ecs:DescribeStorageCapacityUnits",
"ecs:DescribeTaskAttribute",
"ecs:DescribeTasks",
"ecs:DescribeTerminalSessions",
"ecs:DescribeUserData",
"ecs:DescribeVscs",
"ecs:DescribeZones",
"ecs:GetInstanceConsoleOutput",
"ecs:GetInstanceScreenshot",
"ecs:ListPluginStatus",
"ecs:ListTagResources",
"ecs:ReportInstancesStatus",
"ecagent:*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resourcecenter:ExecuteSQLQuery",
"resourcecenter:GetResourceType"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resourcemanager:ListResourceGroups"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ecagent:DescribeAgentService",
"ecagent:DescribeAgentCreditUsage"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"appflow:InvokeAction"
],
"Resource": "*"
}
]
}Role 2 access policy: O&M operations
Role 2 includes all permissions from Role 1 plus ecs:AcceptInquiredSystemEvent, which allows the bot to respond to system O&M events (such as confirming instance maintenance notifications). The trust policy is the same as Role 1 and is automatically generated by the RAM console.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:AcceptInquiredSystemEvent",
"ecs:CreateDiagnosticReport",
"ecs:DescribeAccountAttributes",
"ecs:DescribeActivations",
"ecs:DescribeAutoProvisioningGroupHistory",
"ecs:DescribeAutoProvisioningGroupInstances",
"ecs:DescribeAutoProvisioningGroups",
"ecs:DescribeAutoSnapshotPolicyAssociations",
"ecs:DescribeAutoSnapshotPolicyEx",
"ecs:DescribeAvailableResource",
"ecs:DescribeBandwidthLimitation",
"ecs:DescribeBandwidthPackages",
"ecs:DescribeCapacityReservationInstances",
"ecs:DescribeCapacityReservations",
"ecs:DescribeClassicLinkInstances",
"ecs:DescribeCloudAssistantSettings",
"ecs:DescribeCloudAssistantStatus",
"ecs:DescribeCommands",
"ecs:DescribeDedicatedHostAutoRenew",
"ecs:DescribeDedicatedHostClusters",
"ecs:DescribeDedicatedHostTypes",
"ecs:DescribeDedicatedHosts",
"ecs:DescribeDeploymentSetSupportedInstanceTypeFamily",
"ecs:DescribeDeploymentSets",
"ecs:DescribeDiagnosticMetricSets",
"ecs:DescribeDiagnosticMetrics",
"ecs:DescribeDiagnosticReportAttributes",
"ecs:DescribeDiagnosticReports",
"ecs:DescribeDiskDefaultKMSKeyId",
"ecs:DescribeDiskMonitorData",
"ecs:DescribeDisks",
"ecs:DescribeDisksFullStatus",
"ecs:DescribeElasticityAssuranceAutoRenewAttribute",
"ecs:DescribeElasticityAssuranceInstances",
"ecs:DescribeElasticityAssurances",
"ecs:DescribeEniMonitorData",
"ecs:DescribeHpcClusters",
"ecs:DescribeImageComponents",
"ecs:DescribeImageFromFamily",
"ecs:DescribeImagePipelineExecutions",
"ecs:DescribeImagePipelines",
"ecs:DescribeImageSharePermission",
"ecs:DescribeImageSupportInstanceTypes",
"ecs:DescribeImages",
"ecs:DescribeInstanceAttachmentAttributes",
"ecs:DescribeInstanceAttribute",
"ecs:DescribeInstanceAutoRenewAttribute",
"ecs:DescribeInstanceHistoryEvents",
"ecs:DescribeInstanceMaintenanceAttributes",
"ecs:DescribeInstanceModificationPrice",
"ecs:DescribeInstanceMonitorData",
"ecs:DescribeInstanceRamRole",
"ecs:DescribeInstanceStatus",
"ecs:DescribeInstanceTypeFamilies",
"ecs:DescribeInstanceTypes",
"ecs:DescribeInstanceVncUrl",
"ecs:DescribeInstances",
"ecs:DescribeInstancesFullStatus",
"ecs:DescribeInvocationResults",
"ecs:DescribeInvocations",
"ecs:DescribeKeyPairs",
"ecs:DescribeLaunchTemplateVersions",
"ecs:DescribeLaunchTemplates",
"ecs:DescribeLockedSnapshots",
"ecs:DescribeManagedInstances",
"ecs:DescribeNetworkInterfaceAttribute",
"ecs:DescribeNetworkInterfacePermissions",
"ecs:DescribeNetworkInterfaces",
"ecs:DescribePlanMaintenanceWindows",
"ecs:DescribePortRangeListAssociations",
"ecs:DescribePortRangeListEntries",
"ecs:DescribePortRangeLists",
"ecs:DescribePrefixListAssociations",
"ecs:DescribePrefixListAttributes",
"ecs:DescribePrefixLists",
"ecs:DescribePrice",
"ecs:DescribeRecommendInstanceType",
"ecs:DescribeRegions",
"ecs:DescribeRenewalPrice",
"ecs:DescribeReservedInstanceAutoRenewAttribute",
"ecs:DescribeReservedInstances",
"ecs:DescribeResourcesModification",
"ecs:DescribeSecurityGroupAttribute",
"ecs:DescribeSecurityGroupReferences",
"ecs:DescribeSecurityGroups",
"ecs:DescribeSendFileResults",
"ecs:DescribeSnapshotGroups",
"ecs:DescribeSnapshotLinks",
"ecs:DescribeSnapshotMonitorData",
"ecs:DescribeSnapshotPackage",
"ecs:DescribeSnapshots",
"ecs:DescribeSnapshotsUsage",
"ecs:DescribeStorageCapacityUnits",
"ecs:DescribeTaskAttribute",
"ecs:DescribeTasks",
"ecs:DescribeTerminalSessions",
"ecs:DescribeUserData",
"ecs:DescribeVscs",
"ecs:DescribeZones",
"ecs:GetInstanceConsoleOutput",
"ecs:GetInstanceScreenshot",
"ecs:ListPluginStatus",
"ecs:ListTagResources",
"ecs:ReportInstancesStatus",
"ecagent:*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resourcecenter:ExecuteSQLQuery",
"resourcecenter:GetResourceType"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resourcemanager:ListResourceGroups"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ecagent:DescribeAgentService",
"ecagent:DescribeAgentCreditUsage"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"appflow:InvokeAction"
],
"Resource": "*"
}
]
}Step 2: Create an IM channel
Log on to the Elastic Compute Agent console.
In the lower-left corner of the console, click Settings > IM Channels, and then click Add IM Channel.
Enter a channel name and select an IM platform (DingTalk, Feishu, or WeCom).
Configure credentials (see Step 3: Configure the IM Bot by Platform).
Under Role Configuration, select the RAM role created in Step 1.
Click OK.
Step 3: Configure the IM bot by platform
The configuration process varies depending on the IM platform you selected in Step 2. Create an application on the corresponding platform and fill in the credentials. Select your platform to view the configuration steps:
DingTalk
One-click creation is recommended. In the application creation interface of the DingTalk developer console, follow the prompts and click One-Click Create to complete application creation and permission preconfiguration. No manual configuration required.
Log on to the DingTalk Open Platform.
Click Developer Console.
Choose App Development > DingTalk Applications. In the application creation interface, click One-Click Create (recommended) as prompted. To create manually, click Create Now.
Enter the agent application name, and click Create.
After successful creation, copy the Client ID and Client Secret from the application credentials page.
Enter the Client ID and Client Secret in the IM channel creation form in the Elastic Compute Agent console.
DingTalk uses two separate mechanisms for IM channel integration. The DingTalk Application (Client ID and Client Secret configured here) handles inbound @mention interactions and bot identity authentication. Outbound push notifications to the group require a separate custom bot Webhook URL, which you configure in Step 5: Configure scheduled task push.
Feishu
One-click creation is recommended. Feishu Open Platform provides an entry for one-click creation of agent applications. The system automatically preconfigures the required permissions for the agent bot. After creation, you can directly obtain the App ID and App Secret. No manual permission configuration required.
Access Feishu Open Platform · One-Click Create Agent Application (recommended), or log on to the Feishu Open Platform backend to create manually.
Enter the Agent Application Name, and click Create Now.
Copy the App ID and App Secret from the application credentials page.
Enter the App ID and App Secret in the IM channel creation form in the Elastic Compute Agent console.
Add the bot to the target O&M group. In the group, @mention the bot and send any message (for example,
@bot hello) to activate it. After activation, the target group appears automatically in the Group ID drop-down list when you configure scheduled task push.
WeCom
Log on to the WeCom Admin Console.
Choose Security and Management > Management Tools > Intelligent Bot, and click Create Bot.
Select Create Manually, then select Create in API Mode at the bottom.
Add the Visible Scope, set the connection method to Use Long Connection. In the configuration method, click Click to Get Secret, click Enable Authorization, and complete the authorization as needed.
Click Save, and follow the prompts to complete the bot information.
Copy the Bot ID and Secret from the configuration details.
Enter the Bot ID and Secret in the IM channel creation form in the Elastic Compute Agent console.
Add the bot to the target O&M group. In the group, @mention the bot and send any message (for example,
@bot hello) to activate it. After activation, the target group appears automatically in the Group ID drop-down list when you configure scheduled task push.
Step 4: Verify bot connectivity
In the IM group, @mention the bot and send a test message (for example, "Query ECS instance information in the Hangzhou region"). The bot should respond normally.
Step 5: Configure scheduled task push
When creating a scheduled task in the Elastic Compute Agent console, you can push the results to the IM channel as follows:
In the left-side navigation pane of the Elastic Compute Agent console, click Scheduled Tasks, and switch to the Task Templates tab.
Select a built-in template (such as GPU Resource Health Inspection or ECS Resource Exploration and Analysis), and click Create Task.
NoteScheduled tasks currently only support creation from built-in templates. Custom templates are not supported.
In the task form, turn on the Enable IM Channel toggle.
From the channel type drop-down list, select DingTalk, Feishu, or WeCom. Then, from the Select Credentials Configured in IM Channel drop-down list, select the IM channel created in Step 2 (for example, "DingTalk Test Channel").
Specify the target group for push notifications:
DingTalk — In the Enter Webhook field, enter the Webhook URL of the custom bot. The Webhook URL is obtained from the DingTalk group custom bot. For details, see the DingTalk Custom Bot Integration Guide.
Feishu / WeCom — From the Group ID drop-down list, select the target O&M group. Make sure you have added the bot to the group and @mentioned it to activate it (as described at the end of Step 3). After activation, the target group appears automatically in the drop-down list.
NoteThe Credentials drop-down list selects the IM channel created in Step 2 (which handles bot identity authentication). The Enter Webhook field (DingTalk) or Group ID drop-down list (Feishu/WeCom) specifies the target group to receive push notifications. Both must be configured separately. Selecting credentials does not auto-populate the target group field.
Save the task. You can click Run Now on the Configured Tasks tab to manually trigger a run. The results will be pushed to the specified IM group.
Usage example
The following is a typical conversation example in an IM group. Currently, IM channel bots only support read-only operations; write operations must be performed manually in the console.
Group member A: @Elastic Compute Agent How many ECS instances are there in the Hangzhou region?
Bot: There are 11 ECS instances in the Hangzhou region (cn-hangzhou).
If you want to learn more about the detailed configuration, status, or other information of these instances, let me know.
Group member B: @Elastic Compute Agent i-bp10z7bsw2iofg6r8i0c cannot be connected via SSH. Can you check?
Bot: Delegating ECS Diagnostic Agent to diagnose the SSH connection failure...
Diagnosis result: The inbound rule for port 22 in the security group of the instance has been deleted, causing SSH to be inaccessible.
Remediation recommendation: Go to the ECS console to restore the inbound TCP port 22/22 rule for the security group, or contact an O&M engineer with security group management permissions for assistance.FAQ
How many groups does one IM channel support?
A single IM channel corresponds to one IM group. To push notifications to multiple groups, create multiple IM channels.
Can the IM bot proactively initiate conversations?
Yes. Scheduled task results, alert events, and other notifications can be proactively pushed to the associated IM group through the IM bot.
Is it safe to perform resource operations through IM channels?
Yes. Before executing an operation, the agent requests confirmation. The operation is executed only after a group member explicitly replies with "Confirm execution."
How is permission control managed for IM channels?
RAM roles can be independently configured. Different IM channels can be bound to different RAM roles, enabling least-privilege authorization at the group level.