FAQ

Sign in with enterprise identity systems

Configure SSO through Alibaba Cloud RAM so employees can sign in with corporate accounts from Okta or Microsoft Entra ID.

Enterprise single sign-on to Alibaba Cloud using your own identity system.

APIConnectionError: Connection error when calling Alibaba Cloud Model Studio models

APIConnectionError: Connection error

Runtime VPC lacks internet access. Alibaba Cloud Model Studio models require outbound connectivity.

Configure SNAT to enable internet access. Use the SNAT feature of an Internet NAT gateway to access the Internet.

Choose between Faiss and Milvus

Start with Faiss for testing. Switch to Milvus when moving to production or working with larger datasets.

The run failed due to reaching the timeout: 300 with Faiss-based knowledge bases

The run failed due to reaching the timeout: 300

Insufficient runtime resources. Faiss loads vector data from OSS into memory, which is resource-intensive.

Increase runtime resource specification:

• Upgrade the existing runtime: In the runtime list, click the runtime name, then click Change Settings in the upper-right corner. Select a larger Instance Type, such as 8-core or 16-core CPU.

• Replace the runtime: Delete the current runtime, create a new one with a higher specification, and update your application flow to use it.

ToolLoadError... (AccessDenied) with Faiss-based knowledge bases

Tool load failed in 'index_lookup': (ToolLoadError) Failed to load package tool 'Index Lookup': (AccessDenied)

The application flow lacks permissions to save the index file to the specified OSS path.

Recreate the knowledge base index with correct permissions:

1. Recreate the knowledge base index using the default PAI role.

2. Set Output OSS Path to a directory within the OSS Bucket that serves as your workspace's default storage path.

3. Reconfigure the knowledge base index node in the application flow to use the new index.

Knowledge base index management - Create a knowledge base index.

Unexpected PAI-DSW charges

LangStudio runtimes run on PAI-DSW instances. Starting a runtime launches a DSW instance, and billing begins immediately.

Stop the DSW instance from the DSW instance list when not in use to avoid charges.

Execution failure in 'iqs_generic_search': (ClientException) Error: Retrieval.NotActivate code: 403, Please activate AI search service

• Cause: Web search service is not activated.

• Solution: Activate the service. Web search activation guide.

Execution failure in 'iqs_generic_search': (ClientException) Error: Retrieval.NotAuthorised code: 403, No Permission

• Cause: Missing permissions for web search service.

• Solution: Application flows support RAM roles (more secure) or api_key for IQS web search. Check the runtime RAM role configuration.

  • If using the PAI default role, use an api_key to access web search.

    1. On the Connection tab, choose Custom Connection > New Connection. Enter api_key as the custom key. Get the value from Information Query Service - Credential Management.

       

       

    2. Configure this IQS connection in the standard search node.

  • If using a custom role, verify it meets these requirements:

    • Required trust policy:

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": "pai.aliyuncs.com"
            }
          },
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": "eas.pai.aliyuncs.com"
            }
          }
        ],
        "Version": "1"
      }

    • Attach these three access policies: AliyunIQSFullAccess, AliyunOSSFullAccess, and AliyunPAIFullAccess.