FAQ

Sign in with enterprise identity systems

Configure Single Sign-On (SSO) through Alibaba Cloud RAM to let employees sign in with corporate accounts from Okta or Microsoft Entra ID.

See Enterprise single sign-on to Alibaba Cloud using your own identity system.

APIConnectionError: Connection error when calling Alibaba Cloud Model Studio models

APIConnectionError: Connection error

Runtime VPC lacks internet access. Alibaba Cloud Model Studio models require outbound connectivity.

Configure SNAT to enable internet access. Use the SNAT feature of an Internet NAT gateway to access the Internet.

Choose between Faiss and Milvus

Start with Faiss for testing. Switch to Milvus when moving to production or working with larger datasets.

The run failed due to reaching the timeout: 300 with Faiss-based knowledge bases

The run failed due to reaching the timeout: 300

Insufficient runtime resources. Faiss loads vector data from OSS into memory, which requires significant resources.

Increase runtime resource specification:

• Upgrade the existing runtime: In the runtime list, click the runtime name, then click Change Settings in the upper-right corner. Select a larger Instance Type, such as 8-core or 16-core CPU.

• Replace the runtime: Delete the current runtime, create a new one with higher specification, and update your application flow to use the new runtime.

ToolLoadError... (AccessDenied) with Faiss-based knowledge bases

Tool load failed in 'index_lookup': (ToolLoadError) Failed to load package tool 'Index Lookup': (AccessDenied)

The application flow lacks permissions to save the index file to the specified OSS path.

Recreate the knowledge base index with correct permissions:

1. Recreate the knowledge base index using the default PAI role.

2. Set Output OSS Path to a directory within the OSS Bucket that serves as your workspace's default storage path.

3. Reconfigure the knowledge base index node in the application flow to use the newly created index.

See Knowledge base index management - Create a knowledge base index.

Unexpected PAI-DSW charges

LangStudio application flow development runs on PAI-DSW instances. Starting a runtime launches a DSW instance, and billing begins immediately.

Stop the DSW instance from the DSW instance list when not in use to avoid charges.

Execution failure in 'iqs_generic_search': (ClientException) Error: Retrieval.NotActivate code: 403, Please activate AI search service

• Cause: Web search service is not activated.

• Solution: Activate service following Web search activation guide.

Execution failure in 'iqs_generic_search': (ClientException) Error: Retrieval.NotAuthorised code: 403, No Permission

• Cause: Missing permissions for web search service.

• Solution: Application flows support RAM roles (more secure) or api_key for IQS web search. Check runtime instance RAM role configuration.

  • If using the PAI default role, use an api_key to access the web search service.

    1. On the Connection tab, choose Custom Connection > New Connection. Enter api_key as the custom key. View the custom value in Information Query Service - Credential Management.

       

    2. Configure the IQS connection created in the previous step in the standard search node.

  • If using a custom role, verify that the role meets these requirements:

    • The trust policy is as follows:

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": "pai.aliyuncs.com"
            }
          },
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": "eas.pai.aliyuncs.com"
            }
          }
        ],
        "Version": "1"
      }

    • Attach these three access policies: AliyunIQSFullAccess, AliyunOSSFullAccess, and AliyunPAIFullAccess.