Architecture:

OSS Bucket + DashScope (Bailian API Key) + FC App (ComfyUI + WebUI — two functions deployed via Devs template)

Prerequisites (scripts/ runtime dependencies):

Dependency	Min Version	Check Command	Purpose
bash	4.0+	bash --version	Script runtime
aliyun CLI	>= 3.3.7	aliyun version	Alibaba Cloud resource operations (3.3.7+ required for ai-mode subcommand)
python3	3.6+	python3 --version	JSON parsing
curl	any	curl --version	HTTP API calls

If Aliyun CLI is not installed or version too low, see

references/cli-installation-guide.md

for installation instructions. Then [MUST] run

aliyun configure set --auto-plugin-install true

to enable automatic plugin installation.

Pre-check: Alibaba Cloud Credentials Required

Security Rules:

• NEVER read, echo, or print AK/SK values
• NEVER ask the user to input AK/SK directly in the conversation or command line
• NEVER use

  aliyun configure set

  with literal credential values
• ONLY use

  aliyun configure list

  to check credential status

bash

aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity).

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console
2. Configure credentials outside of this session
3. Return and re-run after

   aliyun configure list

   shows a valid profile

references/ram-policies.md

AliyunFCFullAccess

AliyunOSSFullAccess

devs:CreateProject

devs:RenderServicesByTemplate

devs:UpdateEnvironment

devs:DeployEnvironment

devs:ListEnvironments

devs:GetEnvironment

bash scripts/attach-policies.sh

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

1. Read

   references/ram-policies.md

   to get the full list of permissions required by this SKILL
2. Use

   ram-permission-diagnose

   skill to guide the user through requesting the necessary permissions
3. Pause and wait until the user confirms that the required permissions have been granted

IMPORTANT: Parameter Confirmation — Before executing any command or API call, all parameters are either fixed values or auto-generated/created — no manual user input required.

RegionId

cn-hangzhou

BUCKET_NAME

animation-story-<6 random lowercase letters>

API_KEY

aliyun modelstudio create-api-key

PROJECT_NAME

animation-creation-<6 random lowercase letters>

undefined

aliyun modelstudio

source scripts/create-api-key.sh

Note: Use

source

to ensure the

API_KEY

variable is exported to the current shell. The script automatically fetches the default workspace (or creates one if none exists), creates an API Key, and prints the full value.

Note: The OSS CLI plugin uses the

--ua

flag (not

--user-agent

) to set the User-Agent.

ORDER.OPEND

aliyun ossadmin open-oss-service --endpoint oss-admin.aliyuncs.com --force --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy 2>&1 || true

aliyun oss mb "oss://$BUCKET_NAME" --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

aliyun oss stat "oss://$BUCKET_NAME" --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

CreateProject

templateConfig

production

Note: CreateProject only creates the project and an empty environment — it does NOT trigger deployment automatically. You must follow up with RenderServicesByTemplate + UpdateEnvironment + DeployEnvironment to complete deployment.

aliyun devs create-project --body "{
  \"name\": \"$PROJECT_NAME\",
  \"spec\": {
    \"templateConfig\": {
      \"templateName\": \"animation-creation\",
      \"parameters\": {
        \"region\": \"cn-hangzhou\",
        \"bailian_api_key\": \"$API_KEY\",
        \"ossBucket\": \"$BUCKET_NAME\"
      }
    }
  }
}" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Template parameter notes (confirmed — do not modify):

• region

  : Fixed

  cn-hangzhou

• bailian_api_key

  : Bailian API Key auto-created in Step 1

• ossBucket

  : OSS Bucket name created in Step 2 (without

  oss://

  prefix)
• All parameters are passed via

  parameters

  , not

  variableValues

All commands in this step use shell variables

MY_UID

,

PROJECT_NAME

,

BUCKET_NAME

,

API_KEY

— make sure Step 1 and Parameter Confirmation have been executed.

source scripts/setup-role.sh

Note: Use

source

to ensure the

MY_UID

variable is exported to the current shell. The script automatically checks whether the role exists and creates it if not. This role is the standard Devs role, typically auto-created when using the FC console's application feature for the first time.

The following script automatically: renders the template → filters out custom-domain → adds roleArn → calls UpdateEnvironment. The agent does not need to handle JSON manually.

bash scripts/render-and-update.sh

Key notes (built into the script — no manual handling needed):

• custom-domain

  service is automatically filtered out (causes "Unknown service type" error)

• roleArn

  is automatically added
• Uses

  --body

  to pass data (

  --spec

  cannot correctly pass deeply nested JSON)

Built-in rate-limit protection: The script retries up to 3 times with 60-second intervals, and stops immediately on 404. Run the script directly — do not call

deploy-environment

manually.

bash scripts/deploy-environment.sh

Why is a custom domain needed? FC trigger URLs (

*.fcapp.run

) force a

Content-Disposition: attachment

response header, causing the browser to download the HTML instead of rendering it. A custom domain (

*.devsapp.net

) is required for the application to work properly.

Must use FC 2.0 API (

aliyun fc-open

) to create the helper function: FC 3.0 does not support

$

in function names. The

fc-open

plugin will be auto-installed via the

--auto-plugin-install true

configuration.

MY_UID

PROJECT_NAME

bash scripts/create-custom-domain.sh

http://${PROJECT_NAME}-web.fcv3.${MY_UID}.cn-hangzhou.fc.devsapp.net/

⚠️ 安全提醒 — 展示访问 URL 时必须告知用户： 该 URL 可通过公网直接访问，请勿随意分享给不信任的人。未经授权的访问可能导致：

• 云资源被消耗： 每次访问都会消耗函数计算资源和百炼 API 调用额度，可能产生额外费用。
• 隐私信息泄露： 生成的动画故事、上传的图片等内容可能包含个人或敏感信息。

references/related-commands.md

Key limitation: First-time activation of FC has no CLI/API support — users must activate it manually in the console.

Auto-activated: OSS service via

aliyun ossadmin open-oss-service

(built into Step 2). Bailian workspace via

aliyun modelstudio create-workspace

(built into Step 1).

1. Region is fixed to

   cn-hangzhou

   (FC and OSS in the same region)
2. DashScope API Key is passed via Devs template parameters — not hardcoded
3. OSS Bucket names include a random suffix to avoid conflicts
4. Record the access URL and created resources after deployment completes