Configure Alibaba Cloud CLI

RAM user permissions

Your account must have permissions to read RAM role policies. Without these permissions, the Tool Execution page displays the error "RAM permission verification failed. Configuration is not allowed." and the Alibaba Cloud CLI configuration becomes read-only. Ask the Alibaba Cloud account owner to grant the following permissions:

• ram:GetRole

• ram:ListPoliciesForRole

• ram:GetPolicyVersion

RAM role permissions

The RAM role associated with the digital employee must have the API permissions for the relevant products. Only actions listed in the RAM role policy are available for selection in the tool configuration interface.

To find the correct RAM action:

1. Identify the CLI tool that requires authorization, such as aliyun elasticsearch ListAllNode.

2. Go to the OpenAPI Explorer and search for the API name, such as ListAllNode.

3. On the API documentation page, find the Authorization Information section. The Action column shows the required RAM action.

4. Add the RAM action to the RAM role policy.

Example

To authorize the aliyun elasticsearch ListAllNode tool:

• Incorrect: Granting elasticsearch:ListAllNode directly fails because this RAM action does not exist.

• Correct: The OpenAPI documentation for the Elasticsearch service shows that the ListAllNode API requires the elasticsearch:DescribeInstance RAM action. Grant this action in the RAM role policy.

Entry 1: Configure during digital employee creation

1. In the digital employee creation flow, go to the Tool Execution step, find Alibaba Cloud CLI, and turn on the switch.

2. Configure the tool rules by using one of the following editing modes:

{
  "enable": true,
  "statements": [
    {
      "decision": "user_ack",
      "product": "Domain",
      "apiVersion": "2018-01-29",
      "actions": [
        "domain:QueryDomain",
        "domain:QueryCommonInfo"
      ]
    }
  ]
}

Entry 2: Configure an existing digital employee

1. Go to the details page of the target digital employee.

2. Click the Settings tab.

3. In the left-side navigation pane, click Tool Execution.

4. Configure the tool rules in either Visual Editor or Script Editor mode as described in the preceding sections.

Method 1: Trigger through a skill

In the SKILL.md file of a skill, specify the aliyun command for the target query or operation. The digital employee calls the corresponding CLI tool when it runs the skill.

Example skill description snippet:

**Verify instance exists and get basic information:**

```bash
aliyun ecs describe-instances \
  --biz-region-id <REGION_ID> \
  --region <REGION_ID> \
  --instance-ids '[\"<INSTANCE_ID>\"]'
```

Method 2: Test in the dialog

Run an aliyun command in the dialog with the digital employee:

aliyun ecs DescribeInstances --RegionId cn-hangzhou

A command fails after Alibaba Cloud CLI is configured

A command fails with the Forbidden.RAM error even though the API is already authorized in the Alibaba Cloud CLI tool rules. The error shows ImplicitDeny as the deny type and aliyunserviceroleforstarops as the current identity.

This error indicates that the RAM role associated with the digital employee does not have the RAM action that the API requires. Authorizing an action in the tool rules does not grant that permission to the RAM role.

To troubleshoot the issue, follow these steps:

1. Check whether the RAM role associated with the digital employee is granted the RAM action that the API requires. For example, aliyun ecs RunCommand requires the ecs:RunCommand permission. For information about how to look up the RAM action of an API in OpenAPI Explorer, see the RAM role permissions section of this topic.

2. Check whether the required permission is included in the default role. By default, a digital employee is associated with the AliyunServiceRoleForSTAROps service-linked role. Its system policy AliyunServiceRolePolicyForSTAROps grants only read-only permissions such as ecs:List*. Write permissions such as ecs:RunCommand are not included, so commands that modify resources are denied under the default permissions.