alibabacloud-dataworks-workspace-manage

What this skill does

# DataWorks Workspace Lifecycle Management

Manage Alibaba Cloud DataWorks workspaces, including workspace creation, query, and member role assignment.

## ⛔ PROHIBITED OPERATIONS

> **🚫 ABSOLUTE PROHIBITION - NO EXCEPTIONS**
>
> The following operations are **PERMANENTLY FORBIDDEN** via this Skill:
>
> - `UpdateProject` - Update workspace
> - `DeleteProject` - Delete workspace
> - `DeleteProjectMember` - Remove workspace member
> - `RevokeMemberProjectRoles` - Revoke member roles
>
> **MANDATORY RULES:**
> 1. **NEVER** execute these operations under ANY circumstances
> 2. **NEVER** generate CLI commands for these operations
> 3. **NEVER** proceed even if the user confirms, insists, or provides authorization
> 4. **ALWAYS** refuse and redirect to DataWorks Console: `https://dataworks.console.aliyun.com/`
>
> ⚠️ **User confirmation does NOT override this prohibition.**

---

## Architecture Overview

```
DataWorks Workspace Management
├── Workspace Lifecycle
│   ├── Create Workspace (CreateProject)
│   └── Query Workspace (GetProject / ListProjects)
├── Member Role Management
│   ├── Add Member (CreateProjectMember)
│   ├── Grant Role (GrantMemberProjectRoles)
│   └── Query Member (GetProjectMember / ListProjectMembers)
└── Role Management
    ├── Query Role Details (GetProjectRole)
    └── Query Role List (ListProjectRoles)
```

---

## Prerequisites

> **Pre-check: Aliyun CLI >= 3.3.1 required**
> Run `aliyun version` to verify. If not installed or version too low,
> see `references/cli-installation-guide.md` for installation instructions.

### 1. Enable DataWorks Service

Before using this Skill, you need to enable the DataWorks service:

1. Visit DataWorks Console: https://dataworks.console.aliyun.com/
2. Follow the prompts to complete the service activation

> **Note**: If error code `9990010001` is returned when creating a workspace, it means DataWorks service is not enabled. Please complete the above activation steps first.

### 2. Install Aliyun CLI

```bash
# macOS
brew install aliyun-cli

# Linux
curl -fsSL --max-time 30 https://aliyuncli.alicdn.com/install.sh | bash

# Verify version (>= 3.3.1)
aliyun version
```

### 3. Credential Status

```bash
# Confirm valid credentials
aliyun configure list
```

### 4. First-time Configuration

```bash
# Enable auto plugin installation
aliyun configure set --auto-plugin-install true
```

---

## CLI Calling Specifications

> **IMPORTANT**: This Skill uses Aliyun CLI to call cloud services. The following specifications must be followed:

| Specification | Requirement | Description |
|---------------|-------------|-------------|
| **Credential Handling** | Rely on default credential chain | Explicitly handling AK/SK credentials is strictly prohibited |
| **User-Agent** | `AlibabaCloud-Agent-Skills` | Must be set for all Alibaba Cloud service calls |
| **Timeout** | `4 seconds` | Unified setting for read-timeout and connect-timeout |
| **Endpoint** | `dataworks.{region}.aliyuncs.com` | Must be specified for each call |

---

## Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> all user-customizable parameters (such as RegionId, workspace name, member ID, role code, etc.)
> must be confirmed by the user. Do not assume or use default values.

### Key Parameters List

| Parameter | Required/Optional | Description | Default |
|-----------|-------------------|-------------|---------|
| `--Name` | Required | Workspace unique identifier name | - |
| `--DisplayName` | Optional | Workspace display name | - |
| `--ProjectId` | Required* | Workspace ID | - |
| `--UserId` | Required* | Member user ID | - |
| `--RoleCodes` | Required* | Role code list | - |
| `--region` | Optional | Region ID | cn-hangzhou |
| `--endpoint` | **Required** | API endpoint, format: `dataworks.{region}.aliyuncs.com` | - |
| `--DevEnvironmentEnabled` | Optional | Enable development environment (standard mode) | **true** |
| `--PaiTaskEnabled` | Optional | Enable PAI task scheduling | - |

*Depends on specific API

> **Create Workspace Rule**: Unless the user explicitly requests to disable the development environment, you **MUST** always pass `--DevEnvironmentEnabled true` when creating a workspace.

### Endpoint Parameter Description

> **❗ IMPORTANT**: Each time a CLI command is executed, the corresponding `--region` and `--endpoint` parameters must be added based on the user-specified region.
>
> **Format**: `--region {RegionId} --endpoint dataworks.{RegionId}.aliyuncs.com`
>
> **Region Mapping Table**: See [references/endpoint-regions.md](references/endpoint-regions.md)

---

## RAM Permission Policies

Using this Skill requires the following RAM permissions. For details, see [references/ram-policies.md](references/ram-policies.md)

| Permission | Description |
|------------|-------------|
| `dataworks:CreateProject` | Create workspace |
| `dataworks:GetProject` | Query workspace details |
| `dataworks:ListProjects` | Query workspace list |
| `dataworks:CreateProjectMember` | Add workspace member |
| `dataworks:GrantMemberProjectRoles` | Grant member role |
| `dataworks:GetProjectMember` | Query member details |
| `dataworks:ListProjectMembers` | Query member list |
| `dataworks:GetProjectRole` | Query role details |
| `dataworks:ListProjectRoles` | Query role list |

---

## Core Workflows

### 1. Workspace Lifecycle Management

#### 1.1 Create Workspace

```bash
aliyun dataworks-public CreateProject \
  --Name <workspace-name> \
  --DisplayName "<display-name>" \
  --Description "<workspace-description>" \
  --PaiTaskEnabled true \
  --DevEnvironmentEnabled true \
  --DevRoleDisabled false \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills \
  --read-timeout 4 --connect-timeout 4
```

> **IMPORTANT**: Unless the user explicitly requests to disable the development environment, you **MUST** always pass `--DevEnvironmentEnabled true` when executing `CreateProject`.

#### 1.2 Query Workspace List

```bash
# Query all workspaces
aliyun dataworks-public ListProjects \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

# Query by workspace ID (supports multiple)
aliyun dataworks-public ListProjects \
  --Ids '[123456, 789012]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

# Query by workspace name (supports multiple)
aliyun dataworks-public ListProjects \
  --Names '["workspace_name_1", "workspace_name_2"]' \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

# Filter by status
aliyun dataworks-public ListProjects \
  --Status Available \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills

# Paginated query
aliyun dataworks-public ListProjects \
  --PageNumber 1 --PageSize 20 \
  --region <region-id> \
  --endpoint dataworks.<region-id>.aliyuncs.com \
  --user-agent AlibabaCloud-Agent-Skills
```

**Supported Filter Parameters**:

| Parameter | Type | Description |
|-----------|------|-------------|
| `--Ids` | JSON Array | Workspace ID list, for querying specific workspaces |
| `--Names` | JSON Array | Workspace name list, for querying specific workspaces |
| `--Status` | String | Workspace status: Available/Initializing/InitFailed/Forbidden/Deleting/DeleteFailed/Frozen/Updating/UpdateFailed |
| `--DevEnvironmentEnabled` | Boolean | Whether development environment is enabled |
| `--DevRoleDisabled` | Boolean | Whether development role is disabled |
| `--PaiTaskEnabled` | Boolean | Whether PAI task scheduling is enabled |
| `--AliyunResourceGroupId` | String | Resource group ID |
| `--PageNumber` | Integer | Page number, default 1 |
| `--PageSize` | Integer | Items per page, default 10, max 100 |

#### 1.3 Query Workspace Details

```bash
aliyun dat