Use Alibaba Cloud CLI to call Resource Group OpenAPI operations-Resource Management(ResourceManagement)-阿里云帮助中心

Background

Alibaba Cloud CLI is a general-purpose command-line tool built on OpenAPI that lets you automate Resource Group management. For more information, see What is Alibaba Cloud CLI.

Step 1: Install Alibaba Cloud CLI

Install the Alibaba Cloud CLI package for your operating system.

Windows: Install Alibaba Cloud CLI on Windows.
Linux: Install, update, and uninstall Alibaba Cloud CLI.
macOS: Install Alibaba Cloud CLI on macOS.

Cloud Shell comes pre-installed with Alibaba Cloud CLI and automatically configures your identity credentials. You can use Cloud Shell to run and debug Alibaba Cloud CLI commands without manual configuration. For more information, see What is Cloud Shell?.

Step 2: Configure Alibaba Cloud CLI

Important

An Alibaba Cloud account has full access to all OpenAPI operations, which poses a high security risk. We strongly recommend that you create a RAM user, grant permissions to the RAM user based on the principle of least privilege, and then use the RAM user to call API operations. For more information about the permission policies that Resource Group supports, see Manage resource groups with a RAM user and Resource group authorization.

Configure your identity credentials and a default region ID. Alibaba Cloud CLI supports multiple credential types. For more information, see Credential types. This topic uses AccessKey credentials as an example.

Create a RAM user and an AccessKey pair to configure your identity credentials. For more information, see Create a RAM user and Create an AccessKey.
In this example, the RAM user must have the Resource Group CreateResourceGroup permission.
1. Create a custom policy that grants the CreateResourceGroup permission for Resource Group. For more information, see Create a custom policy. The following is a sample policy:
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:CreateResourceGroup",
      "Resource": "*"
    }
  ]
}
```
2. Attach the custom policy to the RAM user. For more information, see Manage RAM user permissions.
Obtain an available region ID. Alibaba Cloud CLI sends API requests to the region that you specify. For a list of supported regions, see Endpoints.

Note
When you use Alibaba Cloud CLI, you can add the --region option to specify a region for a request. This option overrides the region settings in your configuration profile and environment variables. For more information, see Command-line options.
Use the RAM user's AccessKey pair and the region ID to configure your credentials. Name the configuration profile AkProfile. For more information, see Configuration examples.

Step 3: Generate a sample command

In the OpenAPI Portal, go to the CreateResourceGroup debugging page .
On the Parameter Configuration tab, enter the request parameters. Then, click the CLI Example tab to view the generated sample command.
Copy the CLI command example or run it quickly in Cloud Shell:
- Click the Run command button to open Cloud Shell and quickly debug the command.
- Click the Copy button to copy the CLI command example, then paste it into your local shell to run.
Note
- When you copy the CLI command example to a local shell, make sure the parameter formats are correct. For more information, see Parameter formats.
- The example generated in OpenAPI Portal includes the --region option by default. This option overrides the region configured in your profile and environment variables. You can keep or remove it.

Step 4: Call Resource Group OpenAPI

For a list of Resource Group OpenAPI operations available in the Alibaba Cloud CLI, see List of operations by function.

The following example creates a resource group for the current account by calling the Resource Group CreateResourceGroup operation.

Run the following command.

aliyun resourcemanager CreateResourceGroup --Name 'cli-test-project' --DisplayName 'cli-test-project'

Expected output:

{
  "RequestId": "04F0F334-1335-436C-A1D7-6C044FE73368",
  "ResourceGroup": {
    "DisplayName": "cli-test-project",
    "Status": "Creating",
    "RegionStatuses": {
      "RegionStatus": [
        {
          "Status": "Creating",
          "RegionId": "cn-qingdao"
        }
      ]
    },
    "AccountId": "151266687691****",
    "Name": "cli-test-project",
    "CreateDate": "2021-06-05T14:39:13+08:00",
    "Id": "rg-9gLOoK****"
  }
}

Note

If a Resource Group OpenAPI operation returns an error, verify the request parameters and values against the returned error code.
Record the returned RequestId or the SDK error message, and then run self-service diagnostics in OpenAPI Troubleshoot.