{"id":111,"date":"2026-04-12T20:51:46","date_gmt":"2026-04-12T20:51:46","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/alibaba-cloud-operation-orchestration-service-oos-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-migration-o-m-management\/"},"modified":"2026-04-12T20:51:46","modified_gmt":"2026-04-12T20:51:46","slug":"alibaba-cloud-operation-orchestration-service-oos-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-migration-o-m-management","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/alibaba-cloud-operation-orchestration-service-oos-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-migration-o-m-management\/","title":{"rendered":"Alibaba Cloud Operation Orchestration Service (OOS) Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Migration &#038; O&#038;M Management"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Migration &amp; O&amp;M Management<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What this service is<\/h3>\n\n\n\n<p>Alibaba Cloud <strong>Operation Orchestration Service (OOS)<\/strong> is a managed automation service for executing operational tasks reliably at scale. It helps you standardize and automate common IT operations\u2014such as starting or stopping resources, performing routine maintenance, running scripts, enforcing governance, and orchestrating multi-step workflows\u2014across your Alibaba Cloud environment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Simple explanation (one paragraph)<\/h3>\n\n\n\n<p>Think of Operation Orchestration Service (OOS) as a \u201crunbook automation\u201d platform: you define steps once (a template), provide parameters (like instance IDs or tag filters), and OOS runs those steps safely and repeatedly\u2014so humans don\u2019t have to perform the same procedures manually in the console at 2 a.m.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Technical explanation (one paragraph)<\/h3>\n\n\n\n<p>Technically, OOS executes <strong>orchestration templates<\/strong> (automation documents) composed of <strong>tasks<\/strong> that call Alibaba Cloud APIs and operational actions. Executions are tracked, auditable, and parameterized, enabling repeatable operations with consistent outcomes. OOS commonly integrates with <strong>Resource Access Management (RAM)<\/strong> for authorization, and with logging\/auditing services (for example <strong>ActionTrail<\/strong>) so that changes are traceable. Many automations indirectly use other services (ECS, RDS, VPC, etc.) through API calls.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What problem it solves<\/h3>\n\n\n\n<p>OOS solves the operational pain of:\n&#8211; Manual, error-prone runbooks (copy\/paste commands, inconsistent steps)\n&#8211; Inconsistent operational governance (different engineers doing tasks differently)\n&#8211; Limited auditability (hard to prove what happened and when)\n&#8211; Difficulty scaling operations (one operator can\u2019t safely manage thousands of resources)\n&#8211; Automating standard ops during migrations and ongoing O&amp;M (start\/stop, patching flows, configuration tasks, governance checks)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Operation Orchestration Service (OOS)?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Official purpose<\/h3>\n\n\n\n<p>Operation Orchestration Service (OOS) is Alibaba Cloud\u2019s service for <strong>automating operations<\/strong> using <strong>orchestration templates<\/strong> to execute API-driven tasks in a controlled, repeatable, and auditable manner. For the latest official definition and scope, verify in the product documentation:<br\/>\nhttps:\/\/www.alibabacloud.com\/help\/en\/oos\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<p>Common, currently documented capability areas (verify exact availability per region and account type in official docs):\n&#8211; <strong>Template-based automation<\/strong>: create reusable operational runbooks as templates.\n&#8211; <strong>Execution management<\/strong>: run templates on demand and track each execution\u2019s status, inputs, and outputs.\n&#8211; <strong>Parameterized workflows<\/strong>: pass parameters (IDs, tags, regions, thresholds) to reuse the same template across environments.\n&#8211; <strong>API orchestration<\/strong>: orchestrate multiple Alibaba Cloud API calls in sequence (and sometimes with branching\/conditions depending on template features available in your region\/console).\n&#8211; <strong>Operational governance<\/strong>: standardize how routine tasks are performed and audited.\n&#8211; <strong>Cross-service automation<\/strong>: coordinate changes across ECS, networking, storage, security configurations\u2014where supported by OpenAPI actions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Major components<\/h3>\n\n\n\n<p>While naming and UI labels can vary over time, OOS usage typically revolves around these building blocks:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Component<\/th>\n<th>What it is<\/th>\n<th>Why it matters<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Template<\/strong><\/td>\n<td>An automation document defining tasks and logic<\/td>\n<td>Encodes your runbook into a repeatable workflow<\/td>\n<\/tr>\n<tr>\n<td><strong>Task \/ Step<\/strong><\/td>\n<td>A single unit of work (often an API call or command)<\/td>\n<td>Enables predictable, testable operations<\/td>\n<\/tr>\n<tr>\n<td><strong>Execution<\/strong><\/td>\n<td>A specific run of a template with parameters<\/td>\n<td>Provides observability, audit trail, and outcomes<\/td>\n<\/tr>\n<tr>\n<td><strong>Parameters<\/strong><\/td>\n<td>Inputs to a template (strings, lists, IDs, tags, etc.)<\/td>\n<td>Reusability and environment separation<\/td>\n<\/tr>\n<tr>\n<td><strong>Outputs<\/strong><\/td>\n<td>Returned values from tasks\/execution<\/td>\n<td>Enables chaining and verification<\/td>\n<\/tr>\n<tr>\n<td><strong>Permissions context<\/strong><\/td>\n<td>RAM roles\/policies used by OOS to call APIs<\/td>\n<td>Controls blast radius and supports least privilege<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Managed orchestration \/ automation service<\/strong> in the <strong>Migration &amp; O&amp;M Management<\/strong> category.<\/li>\n<li>Works primarily by calling Alibaba Cloud <strong>OpenAPI<\/strong> actions and executing operational steps in an automated fashion.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scope (regional\/global\/account\/project)<\/h3>\n\n\n\n<p>Scope details can vary by how Alibaba Cloud presents the console and data plane at the time you use it. In most real deployments:\n&#8211; OOS is typically <strong>region-scoped<\/strong> in the console (templates\/executions are created\/viewed in a region).\n&#8211; Templates can often target resources in the same region; some API-based actions can target other regions by passing a <code>RegionId<\/code> parameter to the underlying API call (verify in official docs and test carefully).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Alibaba Cloud ecosystem<\/h3>\n\n\n\n<p>OOS sits in the \u201cautomation layer\u201d above many Alibaba Cloud services:\n&#8211; <strong>Compute<\/strong>: ECS operations (start\/stop\/resize), security group updates, Cloud Assistant command flows (where used).\n&#8211; <strong>Network<\/strong>: VPC operations (route changes, EIP association), load balancer workflows.\n&#8211; <strong>Database<\/strong>: operational actions around RDS instances (depending on available APIs and permissions).\n&#8211; <strong>Governance<\/strong>: integrates with <strong>RAM<\/strong> for access control and can be audited through services like <strong>ActionTrail<\/strong>.\n&#8211; <strong>Infrastructure-as-Code<\/strong>: complements <strong>Resource Orchestration Service (ROS)<\/strong>. ROS provisions infrastructure; OOS automates ongoing operations and runbooks after provisioning.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Operation Orchestration Service (OOS)?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce operational cost<\/strong>: fewer repetitive manual tasks; faster execution.<\/li>\n<li><strong>Reduce risk<\/strong>: consistent runbooks reduce human error in production.<\/li>\n<li><strong>Improve time-to-change<\/strong>: deploy routine changes and maintenance quickly and reliably.<\/li>\n<li><strong>Audit readiness<\/strong>: standardized, logged operations help with internal controls and external audits.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Repeatable automation<\/strong>: templates are reusable and parameterized.<\/li>\n<li><strong>API-driven<\/strong>: orchestration relies on stable APIs rather than fragile click-ops.<\/li>\n<li><strong>Composable workflows<\/strong>: multi-step operations can be defined as a single execution.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Standard operating procedures (SOPs)<\/strong> become executable artifacts.<\/li>\n<li><strong>Scalability<\/strong>: run operations across fleets (with batching\/targeting patterns where supported).<\/li>\n<li><strong>Consistency<\/strong>: fewer one-off scripts that only one engineer understands.<\/li>\n<li><strong>Troubleshooting<\/strong>: execution history makes it easier to analyze failures.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Least privilege<\/strong> via RAM roles\/policies scoped to exact API actions.<\/li>\n<li><strong>Traceability<\/strong> through audit logs (for example ActionTrail events for API calls).<\/li>\n<li><strong>Change control<\/strong>: templates can be reviewed and versioned (capabilities depend on how you manage templates; verify if built-in versioning is available in your environment).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Handles automation without requiring you to build and operate your own workflow engine.<\/li>\n<li>Avoids running persistent servers just to execute operational runbooks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose OOS when you need:\n&#8211; Standardized operational automation (start\/stop, lifecycle operations, governance tasks)\n&#8211; Controlled, auditable workflows for production operations\n&#8211; A managed orchestration tool integrated with Alibaba Cloud IAM (RAM)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<p>Consider alternatives when:\n&#8211; You need <strong>full application workflow orchestration<\/strong> with complex business logic and long-lived human approvals (a dedicated workflow engine may fit better).\n&#8211; Your automation is primarily <strong>configuration management<\/strong> across OS-level state (tools like Ansible\/Salt may be more appropriate), though OOS can still orchestrate them.\n&#8211; Your operations require deep integration with non-Alibaba systems without reliable API endpoints (you may need Function Compute + custom code, or an external automation platform).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Operation Orchestration Service (OOS) used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<p>OOS is commonly used anywhere repeatable operations matter:\n&#8211; Financial services (tight audit controls, controlled changes)\n&#8211; E-commerce (fleet operations, cost control via scheduling)\n&#8211; SaaS and internet companies (standardizing SRE runbooks)\n&#8211; Gaming (burst scaling operations, maintenance windows)\n&#8211; Education\/research (scheduled lab environments, budget control)\n&#8211; Manufacturing\/IoT (distributed fleets, standardized patch windows)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DevOps\/platform engineering teams<\/li>\n<li>SRE\/operations teams<\/li>\n<li>Cloud infrastructure teams<\/li>\n<li>Security operations teams (where automation is safe and governed)<\/li>\n<li>FinOps teams (cost-control automations)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ECS-based applications (web tiers, microservices)<\/li>\n<li>Batch and data workloads (schedule-based start\/stop, housekeeping)<\/li>\n<li>Multi-account or multi-environment setups (dev\/test\/prod)<\/li>\n<li>Migration projects (repeatable cutover steps, rollback runbooks)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Traditional 3-tier apps on ECS + SLB + RDS<\/li>\n<li>Containerized workloads with supporting ECS nodes and infrastructure<\/li>\n<li>Multi-VPC segmented networks with standardized change processes<\/li>\n<li>Landing zones with governance automation (tagging, policy checks)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production<\/strong>: controlled runbooks, maintenance tasks, safe automation with strict IAM and approval process (often external).<\/li>\n<li><strong>Dev\/Test<\/strong>: cost-savings schedules and bulk operations are common and low-risk.<\/li>\n<li><strong>Migration &amp; O&amp;M Management<\/strong>: codify migration runbooks (pre-checks, snapshot steps, firewall changes, DNS cutover steps) and ongoing maintenance runbooks (patching windows, restarts, scaling procedures).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios for Operation Orchestration Service (OOS). Exact feasibility depends on the actions\/templates available and the APIs of target services\u2014verify against current OOS actions and Alibaba Cloud OpenAPI docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Start\/stop ECS instances on a schedule (cost control)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Dev\/test instances run 24\/7, wasting budget.<\/li>\n<li><strong>Why OOS fits<\/strong>: A template can call ECS APIs to stop instances matching tags (and start them later).<\/li>\n<li><strong>Example<\/strong>: Stop all instances tagged <code>Env=Dev<\/code> at 20:00 and start at 08:00 on weekdays.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Standardized \u201csafe restart\u201d runbook for application fleets<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Restarting services is done inconsistently and causes outages.<\/li>\n<li><strong>Why OOS fits<\/strong>: Encodes the exact steps (drain, stop, start, health-check) as a repeatable execution.<\/li>\n<li><strong>Example<\/strong>: Restart a 10-node API fleet one AZ at a time, verifying health between steps (where your template features support such logic).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Bulk security group rule updates with auditability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Emergency IP allowlist updates are error-prone.<\/li>\n<li><strong>Why OOS fits<\/strong>: Template performs controlled security group modifications through OpenAPI calls, with logged execution.<\/li>\n<li><strong>Example<\/strong>: Add a temporary CIDR allow rule for a vendor VPN for 4 hours, then remove it.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Pre-migration readiness checks<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Migrations fail due to missed prerequisites (disk space, CPU architecture, agent presence).<\/li>\n<li><strong>Why OOS fits<\/strong>: Automates checks via APIs and\/or instance command execution and returns standardized outputs.<\/li>\n<li><strong>Example<\/strong>: Validate ECS instances have required tags, are in correct VPC, and meet minimum instance type before cutover.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Snapshot automation before risky changes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Teams forget to snapshot disks\/instances before major updates.<\/li>\n<li><strong>Why OOS fits<\/strong>: Template orchestrates snapshot creation and records snapshot IDs as outputs.<\/li>\n<li><strong>Example<\/strong>: Create snapshots of all disks attached to instances in an application group before deploying a kernel update.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Automated remediation for common alerts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Repeated incidents (disk full, stuck service) require the same manual steps.<\/li>\n<li><strong>Why OOS fits<\/strong>: A runbook can be executed consistently when an alert triggers (integration depends on your eventing setup; verify).<\/li>\n<li><strong>Example<\/strong>: When CPU stays &gt;90% for 10 minutes, run a diagnostics command and scale out if needed.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) \u201cGolden\u201d operations for compliance (tag enforcement)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Resources are created without required tags (Owner\/CostCenter\/DataClass).<\/li>\n<li><strong>Why OOS fits<\/strong>: Template can scan resources and apply tags or open tickets.<\/li>\n<li><strong>Example<\/strong>: Find ECS instances missing <code>Owner<\/code> tag and apply a default or notify owners.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Post-deployment operational hardening<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: After provisioning, teams forget to set backups\/logging policies.<\/li>\n<li><strong>Why OOS fits<\/strong>: Orchestrate API calls to enable or validate required settings.<\/li>\n<li><strong>Example<\/strong>: After new RDS instances are created, enforce backup retention and create monitoring alarms (where APIs allow).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Controlled change windows (maintenance orchestration)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Maintenance requires multiple coordinated steps and teams.<\/li>\n<li><strong>Why OOS fits<\/strong>: Templates provide a single execution record for the whole maintenance sequence.<\/li>\n<li><strong>Example<\/strong>: Put SLB backend servers in draining state, patch ECS, reboot, verify, then re-add.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Fleet-level diagnostics collection<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: During incidents, engineers need logs and system info from many instances quickly.<\/li>\n<li><strong>Why OOS fits<\/strong>: Orchestrates remote commands and gathers outputs.<\/li>\n<li><strong>Example<\/strong>: Collect <code>dmesg<\/code>, <code>df -h<\/code>, and application logs from 50 instances and store results (storage integration depends on your implementation).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Environment teardown runbook for temporary stacks<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Temporary environments are not cleaned up, causing ongoing cost.<\/li>\n<li><strong>Why OOS fits<\/strong>: Runs a decommission runbook that stops\/terminates resources in correct order.<\/li>\n<li><strong>Example<\/strong>: After a QA test window, deallocate instances and release EIPs (verify policies and safeguards).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Cross-team operational self-service<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Central ops becomes a bottleneck for routine tasks.<\/li>\n<li><strong>Why OOS fits<\/strong>: Teams can execute approved templates with restricted parameters instead of having broad console access.<\/li>\n<li><strong>Example<\/strong>: Developers can restart their service only in <code>Dev<\/code> by running an OOS template, without permissions to modify networking.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>The exact feature names in the console may change. The items below describe the <strong>core, durable<\/strong> capabilities of Operation Orchestration Service (OOS). Always verify current feature availability in your region: https:\/\/www.alibabacloud.com\/help\/en\/oos\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Orchestration templates (runbooks)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Defines a multi-step operational workflow (tasks, parameters, outputs).<\/li>\n<li><strong>Why it matters<\/strong>: Turns tribal knowledge into standardized automation.<\/li>\n<li><strong>Practical benefit<\/strong>: New engineers can execute operations safely without memorizing steps.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: Template syntax and supported actions are strict; validate templates in a non-prod environment first.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Parameterization and reuse<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Lets you define inputs (instance ID, tag key\/value, region, thresholds).<\/li>\n<li><strong>Why it matters<\/strong>: Same runbook can be used across dev\/test\/prod with different inputs.<\/li>\n<li><strong>Practical benefit<\/strong>: Fewer duplicated scripts and less maintenance.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: Use guardrails (allowed values, constraints) when supported, otherwise enforce via process.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Execution history and status tracking<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Records each run, including start time, end time, result, and often step-by-step progress.<\/li>\n<li><strong>Why it matters<\/strong>: Improves visibility and simplifies audits and incident reviews.<\/li>\n<li><strong>Practical benefit<\/strong>: You can answer \u201cwhat changed?\u201d quickly.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: Retention and export behavior can be subject to service defaults\u2014verify retention and how to archive if needed.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) API orchestration (OpenAPI calls)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Executes operational actions by calling Alibaba Cloud OpenAPI for services like ECS, VPC, RDS, etc.<\/li>\n<li><strong>Why it matters<\/strong>: API calls are consistent, auditable, and automatable.<\/li>\n<li><strong>Practical benefit<\/strong>: Works even when you don\u2019t have agents installed on instances.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: Requires correct RAM permissions; API throttling\/quotas can affect large executions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Integration with RAM roles and policies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Uses RAM authorization to control which resources and APIs an execution can access.<\/li>\n<li><strong>Why it matters<\/strong>: Least privilege and separation of duties are achievable.<\/li>\n<li><strong>Practical benefit<\/strong>: Teams can run automation without receiving broad cloud admin access.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: Misconfigured permissions cause failures; overly broad permissions create security risk.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Public templates \/ best-practice runbooks (if available)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Provides prebuilt templates for common operational scenarios.<\/li>\n<li><strong>Why it matters<\/strong>: Faster start and consistency with recommended approaches.<\/li>\n<li><strong>Practical benefit<\/strong>: Use as a baseline and customize.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: Names and availability of public templates change; validate before relying on them in production.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Scheduling \/ event-driven execution (capability varies)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Executes templates automatically on a schedule or in response to events.<\/li>\n<li><strong>Why it matters<\/strong>: Enables \u201cset and forget\u201d cost control and standard maintenance windows.<\/li>\n<li><strong>Practical benefit<\/strong>: Automation triggers even when humans forget.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: Exact scheduling features and event integrations can vary\u2014verify in your region and account.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Output handling for downstream steps<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Captures outputs from tasks (like snapshot IDs, instance lists).<\/li>\n<li><strong>Why it matters<\/strong>: Enables multi-step workflows where later tasks depend on earlier results.<\/li>\n<li><strong>Practical benefit<\/strong>: Makes runbooks robust and less manual.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: Output format and referencing rules are template-syntax dependent.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Safety and control mechanisms (timeouts, failure handling)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Provides guardrails such as task timeouts and stopping on failure (exact mechanics depend on template features).<\/li>\n<li><strong>Why it matters<\/strong>: Prevents runaway automations.<\/li>\n<li><strong>Practical benefit<\/strong>: Reduces blast radius and improves reliability.<\/li>\n<li><strong>Limitations\/caveats<\/strong>: You must design for idempotency and safe retries; not all operations are safely repeatable.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>At a high level:\n1. An operator (or automated trigger) starts an <strong>OOS execution<\/strong> of a <strong>template<\/strong>.\n2. OOS evaluates the template logic and executes tasks in order.\n3. Each task typically calls an Alibaba Cloud API (OpenAPI) against target services (ECS\/VPC\/RDS\/etc.).\n4. Results are recorded as execution status and outputs.\n5. Auditing and monitoring services record API events and operational logs (depending on your environment configuration).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane<\/strong>: OOS template definitions and executions.<\/li>\n<li><strong>Data plane<\/strong>: Target resources (ECS, VPC, RDS, SLB, etc.) that OOS modifies via APIs.<\/li>\n<li><strong>Identity plane<\/strong>: RAM policies\/roles determine what OOS can do.<\/li>\n<\/ul>\n\n\n\n<p>Typical flow:\n1. User triggers execution (console\/API\/CLI).\n2. OOS assumes\/uses the configured RAM role context.\n3. OOS calls OpenAPI actions (e.g., ECS <code>StopInstance<\/code>, VPC <code>DescribeVpcs<\/code>, etc.).\n4. Target service performs the operation; response returned to OOS.\n5. OOS logs task success\/failure; emits outputs; completes execution.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<p>Common integrations in Alibaba Cloud environments include:\n&#8211; <strong>RAM (Resource Access Management)<\/strong>: execution authorization.\n&#8211; <strong>ActionTrail<\/strong>: auditing API calls made during OOS execution.\n&#8211; <strong>CloudMonitor<\/strong>: metrics\/alerts used to trigger runbooks (trigger mechanism may use additional services; verify current recommended integration).\n&#8211; <strong>EventBridge<\/strong> (or equivalent eventing): event-driven automation patterns (verify current docs).\n&#8211; <strong>ROS<\/strong>: provision infra with ROS, then run OOS for day-2 operations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>OOS itself is managed, but your automation may depend on:\n&#8211; Target services (ECS\/RDS\/VPC\/etc.) being available in the selected region\n&#8211; Network reachability <strong>only<\/strong> when your steps require instance-level access (e.g., via Cloud Assistant\/remote commands); pure API orchestration does not require VPC routing<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Users authenticate via Alibaba Cloud (console\/API).<\/li>\n<li>OOS executes tasks using a <strong>RAM role\/policy context<\/strong> (often a service-linked role and\/or a role you configure).<\/li>\n<li>Each underlying API call is authorized by RAM policies.<\/li>\n<li>Auditing is done via API event logs (ActionTrail) and execution records.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>For API-only operations: OOS calls Alibaba Cloud APIs; you typically do not manage network paths.<\/li>\n<li>For instance command execution patterns: networking depends on how the command is executed (agent-based vs. SSH, etc.). If your runbook uses Cloud Assistant-type capabilities, it generally relies on the instance agent and Alibaba Cloud control channels rather than inbound SSH. Verify the current recommended method in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>execution history<\/strong> as the first line of operational logging.<\/li>\n<li>Enable <strong>ActionTrail<\/strong> to audit all API calls, including those invoked by OOS.<\/li>\n<li>Consider <strong>naming conventions<\/strong> and <strong>tags<\/strong> so templates can target resources safely (e.g., only <code>Env=Dev<\/code>).<\/li>\n<li>Implement change management: require reviews for template modifications.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  U[Engineer \/ Scheduler] --&gt;|Start execution| OOS[Operation Orchestration Service (OOS)]\n  OOS --&gt;|Assume RAM role \/ authorize| RAM[Resource Access Management (RAM)]\n  OOS --&gt;|OpenAPI calls| ECS[ECS \/ Other Alibaba Cloud services]\n  OOS --&gt;|Execution status| U\n  OOS --&gt;|API events| AT[ActionTrail (Audit Logs)]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Ops[Operations &amp; Governance]\n    ITSM[Change\/Approval Process\\n(external or internal)]\n    Repo[Template Source Control\\n(optional, best practice)]\n    Monitor[CloudMonitor Alerts]\n    Eventing[EventBridge or equivalent\\n(verify availability)]\n  end\n\n  subgraph AlibabaCloud[Alibaba Cloud Account]\n    OOS[Operation Orchestration Service (OOS)]\n    RAM[RAM Roles &amp; Policies]\n    AT[ActionTrail]\n    CM[CloudMonitor]\n    Resources[Target Resources:\\nECS, VPC, SLB, RDS, OSS...]\n  end\n\n  ITSM --&gt;|approved change window| OOS\n  Repo --&gt;|publish\/update templates| OOS\n  Monitor --&gt; CM\n  CM --&gt;|alarm triggers| Eventing\n  Eventing --&gt;|trigger execution| OOS\n\n  OOS --&gt;|assume role| RAM\n  OOS --&gt;|OpenAPI actions| Resources\n  OOS --&gt;|audit trail| AT\n  OOS --&gt;|execution metrics\/status| CM\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Account requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Alibaba Cloud account<\/strong> with billing enabled.<\/li>\n<li>Access to the Alibaba Cloud console for the target region(s).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM (RAM) requirements<\/h3>\n\n\n\n<p>You typically need:\n&#8211; Permission to use OOS itself (view\/create templates, start executions).\n&#8211; Permission for the underlying API actions your templates will call (e.g., ECS <code>StartInstance<\/code>, <code>StopInstance<\/code>, <code>DescribeInstances<\/code>).<\/p>\n\n\n\n<p>Common patterns:\n&#8211; Use a <strong>service-linked role<\/strong> created\/managed for OOS (if your account supports it).\n&#8211; Or create a <strong>custom RAM role<\/strong> and attach least-privilege policies that allow only the necessary OpenAPI actions and only for the intended resources.<\/p>\n\n\n\n<p>Because role names and service-linked role behavior can change, <strong>verify in official docs<\/strong> how OOS assumes roles in your account:\nhttps:\/\/www.alibabacloud.com\/help\/en\/oos\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OOS may have its own pricing model (free or usage-based) depending on current Alibaba Cloud pricing.<\/li>\n<li>Even if OOS is free, the actions you run can create costs in dependent services (ECS runtime, snapshots, logs, bandwidth, etc.).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CLI\/SDK\/tools needed (optional but recommended)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Alibaba Cloud CLI (<code>aliyun<\/code>) for verification and troubleshooting:<\/li>\n<li>CLI overview: https:\/\/www.alibabacloud.com\/help\/en\/cli\/<\/li>\n<li>(Optional) API access keys for CLI usage (securely stored), or use RAM roles and secure auth methods as recommended by Alibaba Cloud.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm <strong>OOS is available in your chosen region<\/strong> in official documentation.<\/li>\n<li>Confirm target services (ECS\/RDS\/etc.) are also available in that region.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Quotas can include:\n&#8211; Number of templates\n&#8211; Concurrent executions\n&#8211; API rate limits (often inherited from target services)\n&#8211; Execution timeouts or step limits<\/p>\n\n\n\n<p>Because quotas change, verify current limits here:\nhttps:\/\/www.alibabacloud.com\/help\/en\/oos\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<p>For the lab in this tutorial:\n&#8211; ECS (at least one test instance) in a region you can operate.\n&#8211; RAM configured for the role\/policy used by OOS.\n&#8211; (Recommended) ActionTrail enabled for auditing.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Current pricing model (how to verify)<\/h3>\n\n\n\n<p>Alibaba Cloud pricing changes over time and can be region-dependent. Do <strong>not<\/strong> rely on third-party summaries. Always confirm current pricing from:\n&#8211; <strong>OOS official documentation<\/strong>: https:\/\/www.alibabacloud.com\/help\/en\/oos\/\n&#8211; <strong>Alibaba Cloud Pricing<\/strong> (search for OOS on the pricing site): https:\/\/www.alibabacloud.com\/pricing<br\/>\n&#8211; <strong>Alibaba Cloud Price Calculator<\/strong> (if applicable): https:\/\/www.alibabacloud.com\/pricing\/calculator<\/p>\n\n\n\n<p>If the official pricing page states OOS is free in your region\/account type, treat it as \u201cno additional service fee,\u201d but still account for the costs below.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (typical for automation services)<\/h3>\n\n\n\n<p>Depending on Alibaba Cloud\u2019s current model, OOS charges could be based on:\n&#8211; Number of executions\n&#8211; Number of steps\/tasks executed\n&#8211; Advanced features (scheduling\/event triggers) if billed separately (verify)\n&#8211; API calls are usually billed by the <strong>target services<\/strong> (often not by OOS directly), but rate limits apply<\/p>\n\n\n\n<p>Because this varies, <strong>verify in official pricing<\/strong> before production rollout.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (direct and indirect)<\/h3>\n\n\n\n<p>Even when OOS service fees are low, automation frequently triggers costs elsewhere:<\/p>\n\n\n\n<p><strong>Compute and storage<\/strong>\n&#8211; ECS running hours (starting instances costs money)\n&#8211; Snapshots (charged by snapshot storage)\n&#8211; Additional disks, images, or backups created by automation<\/p>\n\n\n\n<p><strong>Networking<\/strong>\n&#8211; Public bandwidth\/egress if automation moves data or triggers downloads\n&#8211; Cross-region data transfer if your automation interacts across regions<\/p>\n\n\n\n<p><strong>Logging\/auditing<\/strong>\n&#8211; ActionTrail delivery to OSS \/ Log Service (SLS) can create storage and ingestion costs\n&#8211; Log Service ingestion if you centralize execution logs (verify your chosen approach)<\/p>\n\n\n\n<p><strong>API rate and operational risk<\/strong>\n&#8211; Not a direct cost, but throttling can cause retries\/timeouts (which can cause longer maintenance windows and operational overhead)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs to plan for<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Accidentally starting large fleets (cost spike)<\/li>\n<li>Accidentally creating snapshots repeatedly (snapshot storage growth)<\/li>\n<li>Overly frequent schedules (e.g., start\/stop loops)<\/li>\n<li>Mis-scoped permissions causing repeated failed executions (time cost)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use strict <strong>resource targeting<\/strong> (tags, explicit IDs).<\/li>\n<li>Add pre-check steps (e.g., verify <code>Env=Dev<\/code> before stopping).<\/li>\n<li>Use guardrails: run in dry-run mode if supported; otherwise emulate with \u201cDescribe\u201d calls first.<\/li>\n<li>Limit concurrency\/batch sizes to reduce throttling and operational risk.<\/li>\n<li>Prefer turning off nonessential resources in dev\/test outside working hours.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A \u201cstarter\u201d OOS setup can be close to zero incremental cost if:\n&#8211; You run a small number of executions per day\n&#8211; You target existing dev\/test ECS instances\n&#8211; You avoid creating billable artifacts (snapshots, extra storage)\nYour actual spend will be dominated by ECS runtime and any snapshot\/logging storage. Use the pricing calculator and your ECS billing to estimate.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, you should budget for:\n&#8211; Logging and audit retention (ActionTrail + OSS\/SLS costs)\n&#8211; Snapshot\/backup retention if runbooks create recovery points\n&#8211; Operations overhead from guardrails, staging, and testing\n&#8211; Potential cross-region considerations if automations span regions<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab is designed to be <strong>beginner-friendly<\/strong>, <strong>low-risk<\/strong>, and <strong>low-cost<\/strong> by focusing on <strong>read-only verification<\/strong> first, then performing a controlled <strong>stop\/start<\/strong> operation on a single <strong>non-production<\/strong> ECS instance.<\/p>\n\n\n\n<p>Because OOS template syntax and UI labels can evolve, you must compare the steps with current official docs and your console experience. The core ideas and workflow remain the same.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Create and run an OOS template that:\n1. Verifies an ECS instance exists (Describe)\n2. Stops the instance (optional step you can run only if safe)\n3. Starts the instance again\n4. Captures outputs for verification<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Target<\/strong>: One ECS instance in a dev\/test environment<\/li>\n<li><strong>Method<\/strong>: OOS template that invokes ECS OpenAPI using an API-execution task (commonly provided as an OOS action; verify exact action name in your region)<\/li>\n<li><strong>Verification<\/strong>: Check instance status in both OOS execution output and ECS console\/CLI<\/li>\n<li><strong>Cleanup<\/strong>: Delete template (and ensure instance is left in the intended state)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Prepare a non-production ECS instance<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the Alibaba Cloud console, open <strong>Elastic Compute Service (ECS)<\/strong>.<\/li>\n<li>Pick a region (example: <code>cn-hangzhou<\/code>) and locate a <strong>non-production<\/strong> instance you\u2019re allowed to stop\/start.<\/li>\n<li>Record:\n   &#8211; <strong>InstanceId<\/strong>\n   &#8211; <strong>RegionId<\/strong>\n   &#8211; (Optional) Tags like <code>Env=Dev<\/code> (recommended)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You have an ECS <code>InstanceId<\/code> in a region where you can operate it.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; In ECS console, confirm the instance status is <strong>Running<\/strong> (or note its current state).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Ensure RAM permissions for OOS executions<\/h3>\n\n\n\n<p>You need a permission model so OOS can call ECS APIs.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Option A (commonly used): Service-linked role for OOS<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Many Alibaba Cloud managed services create a service-linked role automatically the first time you use them.<\/li>\n<li>Check in <strong>RAM<\/strong> whether a service-linked role for OOS exists and whether OOS can use it.<\/li>\n<\/ul>\n\n\n\n<p>Because role names and behavior can change, <strong>verify the current OOS RAM authorization model here<\/strong>:<br\/>\nhttps:\/\/www.alibabacloud.com\/help\/en\/oos\/<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Option B: Create a least-privilege custom RAM policy (recommended for lab safety)<\/h4>\n\n\n\n<p>Create a RAM policy that allows only these ECS actions:\n&#8211; <code>DescribeInstances<\/code> (read-only verification)\n&#8211; <code>StopInstance<\/code>\n&#8211; <code>StartInstance<\/code><\/p>\n\n\n\n<p>The exact RAM policy syntax and action names should be taken from official RAM + ECS OpenAPI docs (do not guess in production). Start from:\n&#8211; RAM overview: https:\/\/www.alibabacloud.com\/help\/en\/ram\/\n&#8211; ECS API reference: https:\/\/www.alibabacloud.com\/help\/en\/ecs\/<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; OOS can execute ECS API calls with least privilege.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Run the template\u2019s first \u201cDescribe\u201d step (in Step 5) to confirm permissions work before using Stop\/Start.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Open Operation Orchestration Service (OOS) and create a template<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>Operation Orchestration Service (OOS)<\/strong> in the Alibaba Cloud console (region selector matters).<\/li>\n<li>Go to <strong>Templates<\/strong> (or similarly named section).<\/li>\n<li>Click <strong>Create Template<\/strong>.<\/li>\n<li>Choose a template format supported by the console editor (often JSON; sometimes YAML may be supported\u2014verify in your environment).<\/li>\n<li>Name the template, for example:\n   &#8211; <code>Lab-StartStopECS-ByInstanceId<\/code><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\">Template example (API-driven approach)<\/h4>\n\n\n\n<p>Below is an example template pattern that uses a generic \u201cexecute API\u201d task style. The exact action keyword (for example <code>ACS::ExecuteAPI<\/code>) and schema fields must match your region\u2019s supported OOS template schema. If your console editor provides schema hints or a template wizard, use that as the source of truth.<\/p>\n\n\n\n<pre><code class=\"language-json\">{\n  \"FormatVersion\": \"OOS-2019-06-01\",\n  \"Description\": \"Lab: Describe, Stop, then Start an ECS instance by InstanceId.\",\n  \"Parameters\": {\n    \"RegionId\": {\n      \"Type\": \"String\",\n      \"Description\": \"The region of the ECS instance.\"\n    },\n    \"InstanceId\": {\n      \"Type\": \"String\",\n      \"Description\": \"The ECS InstanceId to operate on.\"\n    },\n    \"DoStopStart\": {\n      \"Type\": \"Boolean\",\n      \"Description\": \"If true, stop and then start the instance. If false, only describe it.\",\n      \"Default\": false\n    }\n  },\n  \"Tasks\": {\n    \"DescribeBefore\": {\n      \"Action\": \"ACS::ExecuteAPI\",\n      \"Properties\": {\n        \"Service\": \"ECS\",\n        \"API\": \"DescribeInstances\",\n        \"Parameters\": {\n          \"RegionId\": \"{{ RegionId }}\",\n          \"InstanceIds\": \"[\\\"{{ InstanceId }}\\\"]\"\n        }\n      }\n    },\n    \"StopInstance\": {\n      \"Action\": \"ACS::ExecuteAPI\",\n      \"Properties\": {\n        \"Service\": \"ECS\",\n        \"API\": \"StopInstance\",\n        \"Parameters\": {\n          \"RegionId\": \"{{ RegionId }}\",\n          \"InstanceId\": \"{{ InstanceId }}\"\n        }\n      },\n      \"When\": \"{{ DoStopStart }}\"\n    },\n    \"StartInstance\": {\n      \"Action\": \"ACS::ExecuteAPI\",\n      \"Properties\": {\n        \"Service\": \"ECS\",\n        \"API\": \"StartInstance\",\n        \"Parameters\": {\n          \"RegionId\": \"{{ RegionId }}\",\n          \"InstanceId\": \"{{ InstanceId }}\"\n        }\n      },\n      \"When\": \"{{ DoStopStart }}\"\n    },\n    \"DescribeAfter\": {\n      \"Action\": \"ACS::ExecuteAPI\",\n      \"Properties\": {\n        \"Service\": \"ECS\",\n        \"API\": \"DescribeInstances\",\n        \"Parameters\": {\n          \"RegionId\": \"{{ RegionId }}\",\n          \"InstanceIds\": \"[\\\"{{ InstanceId }}\\\"]\"\n        }\n      }\n    }\n  },\n  \"Outputs\": {\n    \"Before\": {\n      \"Type\": \"String\",\n      \"Value\": \"{{ DescribeBefore }}\"\n    },\n    \"After\": {\n      \"Type\": \"String\",\n      \"Value\": \"{{ DescribeAfter }}\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n<p><strong>Important notes (do not skip)<\/strong>\n&#8211; The fields <code>FormatVersion<\/code>, <code>When<\/code>, and the action name <code>ACS::ExecuteAPI<\/code> are representative of a common OOS pattern, but <strong>you must validate them against the template schema shown in your OOS console<\/strong>.\n&#8211; If your environment does not support <code>When<\/code> conditions, split this into two templates:\n  &#8211; <code>Lab-DescribeECS<\/code>\n  &#8211; <code>Lab-StopStartECS<\/code><\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The template is created and saved successfully.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; The console shows the template in your template list without validation errors.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Execute the template in \u201cDescribe-only\u201d mode (safe test)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In OOS, select your template and click <strong>Execute<\/strong>.<\/li>\n<li>Provide parameters:\n   &#8211; <code>RegionId<\/code>: your region (e.g., <code>cn-hangzhou<\/code>)\n   &#8211; <code>InstanceId<\/code>: your instance ID\n   &#8211; <code>DoStopStart<\/code>: <code>false<\/code><\/li>\n<li>Choose the execution role\/permission context (service-linked role or your custom role).<\/li>\n<li>Start the execution.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The execution completes successfully and returns output containing \u201cBefore\u201d and \u201cAfter\u201d Describe results.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; In the execution detail view:\n  &#8211; <code>DescribeBefore<\/code> succeeds\n  &#8211; <code>DescribeAfter<\/code> succeeds\n&#8211; In ECS console, the instance state is unchanged.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Execute stop\/start (only for dev\/test, carefully)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Execute the same template again with:\n   &#8211; <code>DoStopStart<\/code>: <code>true<\/code><\/li>\n<li>Start execution and monitor the progress.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The instance transitions:\n  &#8211; Running \u2192 Stopped \u2192 Running (or Running \u2192 Stopping \u2192 Stopped \u2192 Starting \u2192 Running)\n&#8211; The execution ends in <strong>Success<\/strong>.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; In ECS console, confirm the instance status is <strong>Running<\/strong> at the end.\n&#8211; In OOS execution outputs, compare \u201cBefore\u201d vs \u201cAfter\u201d states.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Verify using Alibaba Cloud CLI (optional but recommended)<\/h3>\n\n\n\n<p>Install and configure <code>aliyun<\/code> CLI per official docs. Then:<\/p>\n\n\n\n<pre><code class=\"language-bash\">aliyun ecs DescribeInstances \\\n  --RegionId cn-hangzhou \\\n  --InstanceIds '[\"i-xxxxxxxxxxxxxxx\"]'\n<\/code><\/pre>\n\n\n\n<p>Look for the instance <code>Status<\/code> field.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; CLI output confirms the final expected status.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:\n&#8211; [ ] OOS execution shows each task succeeded\n&#8211; [ ] Instance state matches your intent in ECS console\n&#8211; [ ] ActionTrail (if enabled) shows ECS API calls (<code>DescribeInstances<\/code>, <code>StopInstance<\/code>, <code>StartInstance<\/code>) initiated by the assumed role\/user context\n&#8211; [ ] No unintended instances were impacted (use explicit InstanceId in this lab)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Error: \u201cAccessDenied\u201d \/ \u201cForbidden\u201d<\/h4>\n\n\n\n<p><strong>Cause<\/strong>\n&#8211; The execution role\/user does not have permission for <code>ecs:DescribeInstances<\/code>, <code>ecs:StopInstance<\/code>, or <code>ecs:StartInstance<\/code>.<\/p>\n\n\n\n<p><strong>Fix<\/strong>\n&#8211; Update the RAM policy attached to the role used by OOS.\n&#8211; Re-run the template in Describe-only mode first.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Error: Template validation fails<\/h4>\n\n\n\n<p><strong>Cause<\/strong>\n&#8211; Template schema fields (e.g., <code>FormatVersion<\/code>, <code>Action<\/code>, <code>When<\/code>, <code>Outputs<\/code>) do not match current OOS requirements.<\/p>\n\n\n\n<p><strong>Fix<\/strong>\n&#8211; Use the OOS console\u2019s template editor schema validation and official docs examples:\n  https:\/\/www.alibabacloud.com\/help\/en\/oos\/\n&#8211; Start from a minimal template: only one <code>DescribeInstances<\/code> task, then add steps.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Error: Stop\/Start succeeds but application is down<\/h4>\n\n\n\n<p><strong>Cause<\/strong>\n&#8211; Restarting compute does not guarantee application readiness.<\/p>\n\n\n\n<p><strong>Fix<\/strong>\n&#8211; Add application-level health checks (outside the scope of this basic API-only lab).\n&#8211; Prefer load balancer drain + health check orchestration for production.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Error: API throttling \/ rate limit exceeded<\/h4>\n\n\n\n<p><strong>Cause<\/strong>\n&#8211; Too many concurrent operations or repeated retries.<\/p>\n\n\n\n<p><strong>Fix<\/strong>\n&#8211; Reduce concurrency, batch operations, and add wait\/backoff steps if supported by the template system.\n&#8211; Verify service quotas for ECS API and OOS execution behavior.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In OOS, delete the lab template if you don\u2019t need it.<\/li>\n<li>Ensure the ECS instance is left in the desired state (usually <strong>Running<\/strong> for ongoing dev work or <strong>Stopped<\/strong> for cost control).<\/li>\n<li>If you created a custom RAM role\/policy only for this lab:\n   &#8211; Detach and delete it if not needed.<\/li>\n<li>Review ActionTrail logs to confirm only intended API calls were made (recommended).<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Separate <strong>provisioning<\/strong> from <strong>operations<\/strong>:<\/li>\n<li>Use <strong>ROS\/Terraform<\/strong> to provision<\/li>\n<li>Use <strong>OOS<\/strong> for day-2 operations and runbooks<\/li>\n<li>Design runbooks to be <strong>idempotent<\/strong> where possible:<\/li>\n<li>\u201cEnsure instance is stopped\u201d is safer than \u201cstop instance\u201d if your template language supports checks.<\/li>\n<li>Prefer <strong>small, composable templates<\/strong> over one giant workflow:<\/li>\n<li>Easier testing, faster troubleshooting, safer changes<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>least privilege<\/strong> RAM policies:<\/li>\n<li>Only required APIs (Describe, Start, Stop)<\/li>\n<li>Scope to specific resources where possible (resource-level permissions vary by service; verify)<\/li>\n<li>Separate roles per environment:<\/li>\n<li><code>OOSRole-Dev<\/code>, <code>OOSRole-Prod<\/code><\/li>\n<li>Avoid giving OOS broad admin permissions in production.<\/li>\n<li>Restrict who can <strong>edit templates<\/strong> vs who can only <strong>execute approved templates<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use tags and targeting to avoid accidental fleet-wide starts.<\/li>\n<li>Avoid automations that create recurring billable artifacts unless needed (snapshots, backups).<\/li>\n<li>For cost-savings schedules:<\/li>\n<li>Exclude production and shared services explicitly (tags like <code>DoNotStop=true<\/code>).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Batch large operations:<\/li>\n<li>Prefer a controlled batch size (e.g., 10\u201350 instances per batch) depending on API quotas.<\/li>\n<li>Add \u201cDescribe\u201d pre-check steps to avoid unnecessary calls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Treat templates like code:<\/li>\n<li>review, test in staging, and roll out gradually<\/li>\n<li>Add guardrails:<\/li>\n<li>precondition checks (tags, environment checks)<\/li>\n<li>explicit allowlists for sensitive operations<\/li>\n<li>Plan rollback:<\/li>\n<li>templates should return outputs that enable rollback (e.g., snapshot IDs)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centralize visibility:<\/li>\n<li>track OOS execution success\/failure rates<\/li>\n<li>Use ActionTrail for audit and incident analysis.<\/li>\n<li>Document ownership:<\/li>\n<li>Who maintains templates?<\/li>\n<li>Who approves production changes?<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Adopt naming conventions:<\/li>\n<li><code>OOS-&lt;Team&gt;-&lt;Env&gt;-&lt;Purpose&gt;<\/code><\/li>\n<li>Tag resources consistently so targeting is safe:<\/li>\n<li><code>Env<\/code>, <code>App<\/code>, <code>Owner<\/code>, <code>CostCenter<\/code>, <code>Criticality<\/code><\/li>\n<li>Tag templates too (if supported) or maintain a template catalog in a repo\/wiki.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OOS operations are authorized via <strong>RAM<\/strong>.<\/li>\n<li>Secure design principle: users should not need broad console privileges if they can execute approved OOS templates with controlled parameters.<\/li>\n<li>Prefer:<\/li>\n<li>Separate permissions for <strong>template authoring<\/strong> vs <strong>template execution<\/strong><\/li>\n<li>Explicit execution roles with least privilege<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OOS itself is a control-plane service; encryption requirements mostly relate to:<\/li>\n<li>Any data written to storage (OSS, Log Service)<\/li>\n<li>Any secrets passed as parameters (avoid if possible)<\/li>\n<li>Use Alibaba Cloud\u2019s standard encryption options for dependent services (OSS server-side encryption, KMS where applicable). Verify current recommendations in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>API orchestration does not require inbound access to your instances.<\/li>\n<li>Avoid patterns that require opening SSH\/RDP to the internet for automation.<\/li>\n<li>If you must run commands on instances, use Alibaba Cloud-managed methods (commonly Cloud Assistant patterns) rather than exposing management ports. Verify current best practice.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<p>Common mistakes:\n&#8211; Passing passwords\/API keys as plain template parameters\n&#8211; Storing secrets in templates<\/p>\n\n\n\n<p>Recommendations:\n&#8211; Use RAM roles and temporary credentials (STS) rather than static keys when possible.\n&#8211; Use a secrets manager service if your design requires secrets injection (verify Alibaba Cloud options and recommended integrations).\n&#8211; If OOS supports secure parameter types or references, use them (verify in docs).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable <strong>ActionTrail<\/strong> to record API calls invoked by OOS.<\/li>\n<li>Ensure logs are retained according to compliance needs (financial\/regulated industries often need longer retention).<\/li>\n<li>Consider sending ActionTrail logs to OSS\/SLS for centralized retention and analytics.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Separation of duties: template authors vs executors<\/li>\n<li>Change management: review\/approval for production templates<\/li>\n<li>Evidence: keep execution logs and API audit logs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Running OOS with <code>AdministratorAccess<\/code><\/li>\n<li>Allowing templates to target \u201call instances\u201d without tag filters<\/li>\n<li>No approvals or reviews for template changes<\/li>\n<li>No auditing enabled<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with read-only templates (Describe) and progressively add actions.<\/li>\n<li>Use environment guardrails:<\/li>\n<li>Dev templates cannot touch prod resources.<\/li>\n<li>Add explicit parameter allowlists (where template schema supports it).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Because OOS capabilities evolve, treat these as common real-world constraints and verify specifics in the official docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations (typical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Regional scope<\/strong>: templates\/executions are often managed per region.<\/li>\n<li><strong>API coverage<\/strong>: OOS can only do what underlying OpenAPI actions allow.<\/li>\n<li><strong>Quotas<\/strong>: execution concurrency, template counts, and API throttling can limit large-scale operations.<\/li>\n<li><strong>Long-running workflows<\/strong>: very long processes may hit execution timeouts or become hard to manage; consider splitting.<\/li>\n<li><strong>Idempotency<\/strong>: not all operations are safely repeatable (e.g., \u201ccreate snapshot\u201d every retry creates more snapshots).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>API throttling is frequently the real bottleneck for fleet operations.<\/li>\n<li>Always test with a small sample first, then scale.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional constraints<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some actions\/features may not be available in all regions.<\/li>\n<li>Service-linked role behavior can vary by region\/account.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The automation itself may be cheap\/free, but it can trigger large dependent costs:<\/li>\n<li>Starting fleets<\/li>\n<li>Creating snapshots\/backups<\/li>\n<li>Increased log ingestion<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If your runbook depends on instance-level command execution, ensure the instance supports the method (agent installed, OS supported, etc.). Verify against ECS\/Cloud Assistant requirements.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u201cStop instance\u201d in dev\/test may break shared dependencies (shared DB, bastion, NAT). Tag and target carefully.<\/li>\n<li>Race conditions: multiple executions targeting the same instance can conflict. Implement locking patterns if available (or enforce via process).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>During migrations, automation can amplify mistakes quickly. Use:<\/li>\n<li>explicit allowlists<\/li>\n<li>staged rollouts<\/li>\n<li>human approval gates (often external)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Vendor-specific nuances<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Alibaba Cloud IAM and API semantics differ from AWS\/Azure\/GCP; avoid \u201ctranslating\u201d runbooks without verifying exact API behavior.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Nearest services in Alibaba Cloud<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Resource Orchestration Service (ROS)<\/strong>: Infrastructure provisioning (IaC). Not primarily for day-2 operations.<\/li>\n<li><strong>Cloud Assistant (ECS)<\/strong>: Command execution and OS-level automation on ECS (agent-based). OOS can orchestrate API-level changes and may orchestrate command runs depending on available actions.<\/li>\n<li><strong>Event-based automation<\/strong> using <strong>EventBridge + Function Compute<\/strong>: Great for event-driven custom logic; more code to maintain.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Nearest services in other clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Systems Manager (Automation\/Run Command)<\/strong>: Closest conceptual match.<\/li>\n<li><strong>Azure Automation \/ Logic Apps<\/strong>: Automation accounts and workflows.<\/li>\n<li><strong>Google Cloud Workflows \/ Cloud Scheduler + Functions<\/strong>: Workflow orchestration and triggers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Open-source\/self-managed alternatives<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Ansible\/AWX<\/strong>, <strong>Salt<\/strong>, <strong>Rundeck<\/strong>, <strong>Jenkins pipelines<\/strong>, <strong>Apache Airflow<\/strong> (for certain workflow patterns), <strong>Terraform<\/strong> (IaC not ops runbooks).<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Comparison table<\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Alibaba Cloud OOS<\/strong><\/td>\n<td>Standardized cloud ops runbooks on Alibaba Cloud<\/td>\n<td>Managed, auditable executions; RAM-integrated; API-driven<\/td>\n<td>Feature set and schema are Alibaba-specific; some complex logic may be limited<\/td>\n<td>You want managed automation for Alibaba Cloud O&amp;M with governance<\/td>\n<\/tr>\n<tr>\n<td><strong>ROS (Alibaba Cloud)<\/strong><\/td>\n<td>Provisioning infrastructure<\/td>\n<td>Strong IaC provisioning; repeatable deployments<\/td>\n<td>Not ideal for operational runbooks and ongoing remediation<\/td>\n<td>You need to create\/update stacks and infrastructure declaratively<\/td>\n<\/tr>\n<tr>\n<td><strong>Cloud Assistant (ECS)<\/strong><\/td>\n<td>OS-level commands across ECS<\/td>\n<td>Executes scripts\/commands at scale on instances<\/td>\n<td>Requires agent; focused on ECS; not cross-service orchestration<\/td>\n<td>You need patching\/commands\/host automation<\/td>\n<\/tr>\n<tr>\n<td><strong>EventBridge + Function Compute<\/strong><\/td>\n<td>Event-driven custom automation<\/td>\n<td>Highly flexible; integrates with many event sources<\/td>\n<td>You must write\/maintain code, handle retries, security, and ops<\/td>\n<td>You need custom logic beyond OOS template capabilities<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Systems Manager<\/strong><\/td>\n<td>Ops automation on AWS<\/td>\n<td>Deep AWS integration; mature runbook ecosystem<\/td>\n<td>Not applicable to Alibaba Cloud directly<\/td>\n<td>Multi-cloud team standardizes on AWS tooling for AWS workloads<\/td>\n<\/tr>\n<tr>\n<td><strong>Rundeck \/ AWX (self-managed)<\/strong><\/td>\n<td>Cross-cloud\/on-prem runbooks<\/td>\n<td>Highly customizable; plugin ecosystems<\/td>\n<td>You manage infrastructure and security; higher ops overhead<\/td>\n<td>You need a central runbook tool across multiple environments<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: regulated fintech standardizes production runbooks<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA fintech running hundreds of ECS instances across multiple environments must prove change control and auditability. Manual console operations make audits painful and increase outage risk.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; OOS templates for:\n  &#8211; pre-change validation (Describe, tag checks)\n  &#8211; controlled scaling actions\n  &#8211; snapshot-before-change\n  &#8211; rollback steps\n&#8211; RAM roles:\n  &#8211; <code>OOS-Executor-Prod<\/code> with least privilege\n  &#8211; <code>OOS-Authoring<\/code> for a small platform team only\n&#8211; ActionTrail enabled with delivery to centralized log storage for retention\n&#8211; External approval process (ITSM) triggers OOS execution only within approved windows<\/p>\n\n\n\n<p><strong>Why OOS was chosen<\/strong>\n&#8211; Alibaba Cloud-native automation integrated with RAM and API audit trails\n&#8211; Execution history provides a consistent evidence trail\n&#8211; Reduced need for broad console permissions<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Reduced change-related incidents via standardized workflows\n&#8211; Faster audit evidence collection (execution IDs + ActionTrail events)\n&#8211; Lower operational toil for repetitive tasks<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: dev\/test cost control with safe automation<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA startup runs dev\/test ECS instances continuously and wants to reduce spend without hiring a full-time ops engineer.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; Tagging policy: <code>Env=Dev<\/code>, <code>DoNotStop=true<\/code> for exceptions\n&#8211; OOS templates:\n  &#8211; Stop instances by tag every evening\n  &#8211; Start instances by tag every morning\n&#8211; Minimal RAM policy allowing only Start\/Stop\/Describe for instances with specific tags (where supported)<\/p>\n\n\n\n<p><strong>Why OOS was chosen<\/strong>\n&#8211; No need to operate a scheduler server\n&#8211; Easy to implement standardized start\/stop procedures\n&#8211; Clear visibility into what automation ran and when<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Lower ECS runtime spend\n&#8211; Fewer \u201cforgotten instances\u201d\n&#8211; Less manual effort<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is Operation Orchestration Service (OOS) the same as ROS?<\/strong><br\/>\nNo. <strong>ROS<\/strong> focuses on provisioning infrastructure (IaC). <strong>OOS<\/strong> focuses on operational runbooks and automation (day-2 operations), typically via API-driven steps and tracked executions.<\/p>\n\n\n\n<p>2) <strong>Is OOS agent-based? Do I need to install anything on ECS?<\/strong><br\/>\nFor API-only orchestration (Start\/Stop\/Describe), no agent is required. If your runbook needs OS-level command execution, you may rely on ECS\/Cloud Assistant mechanisms and their prerequisites\u2014verify in official docs.<\/p>\n\n\n\n<p>3) <strong>Can OOS manage resources across regions?<\/strong><br\/>\nOften OOS is operated per region in the console, but API-based steps may target other regions if the API supports a <code>RegionId<\/code> parameter. Verify and test carefully.<\/p>\n\n\n\n<p>4) <strong>How do I restrict OOS so it can\u2019t touch production?<\/strong><br\/>\nUse separate RAM roles\/policies per environment and enforce tag-based or resource-scoped permissions where available. Also separate template sets and execution permissions.<\/p>\n\n\n\n<p>5) <strong>Does OOS provide an audit trail?<\/strong><br\/>\nOOS provides execution history. For API-level audit trails, enable <strong>ActionTrail<\/strong> to record the underlying API calls.<\/p>\n\n\n\n<p>6) <strong>Can developers run OOS templates without being cloud admins?<\/strong><br\/>\nYes, if you set up RAM permissions so developers can only execute specific templates with constrained parameters and without broad resource permissions.<\/p>\n\n\n\n<p>7) <strong>What\u2019s the safest first OOS template to create?<\/strong><br\/>\nA read-only template that uses <code>Describe*<\/code> APIs to inventory or validate resources. Then add controlled actions.<\/p>\n\n\n\n<p>8) <strong>Can OOS automatically remediate CloudMonitor alerts?<\/strong><br\/>\nThis depends on how you connect alarms to OOS executions (often via an eventing service or webhook-style trigger). Verify current Alibaba Cloud recommended integration.<\/p>\n\n\n\n<p>9) <strong>How do I prevent stopping critical shared services in dev\/test schedules?<\/strong><br\/>\nUse explicit exclusions: tags like <code>DoNotStop=true<\/code>, separate VPCs\/accounts, and runbooks that target only explicit allowlisted tags.<\/p>\n\n\n\n<p>10) <strong>What happens if an execution fails halfway?<\/strong><br\/>\nYou will see task-level failure details in execution history. Design templates to be safe to re-run or provide rollback steps. Exact retry\/rollback features depend on OOS template capabilities\u2014verify in docs.<\/p>\n\n\n\n<p>11) <strong>Is OOS suitable for database maintenance automation?<\/strong><br\/>\nIt can be, as long as required RDS (or other DB) operations are exposed via OpenAPI and you design safe procedures (backups, windows, checks). Always test in staging.<\/p>\n\n\n\n<p>12) <strong>How do I version-control OOS templates?<\/strong><br\/>\nA common pattern is storing templates as code in Git and deploying\/publishing updates through controlled processes. Whether OOS provides built-in versioning or export\/import depends on current features\u2014verify.<\/p>\n\n\n\n<p>13) <strong>Can OOS run at scale across thousands of instances?<\/strong><br\/>\nYes for many API-driven operations, but you must design around API throttling, quotas, batching, and safe targeting.<\/p>\n\n\n\n<p>14) <strong>How do I estimate the cost impact of an OOS automation?<\/strong><br\/>\nOOS fees (if any) plus the downstream resource changes: ECS runtime, snapshots, log retention, bandwidth. Use the official pricing calculator and model the runbook\u2019s effects.<\/p>\n\n\n\n<p>15) <strong>What\u2019s a common pitfall when migrating to automated runbooks?<\/strong><br\/>\nAutomating a flawed manual process just makes failures faster. Stabilize the process, add validations, and roll out gradually.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Operation Orchestration Service (OOS)<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>Alibaba Cloud OOS Documentation<\/td>\n<td>Primary source for features, template schema, actions, and limits: https:\/\/www.alibabacloud.com\/help\/en\/oos\/<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Alibaba Cloud Pricing (search OOS)<\/td>\n<td>Confirms whether OOS has direct service fees and pricing dimensions: https:\/\/www.alibabacloud.com\/pricing<\/td>\n<\/tr>\n<tr>\n<td>Pricing calculator<\/td>\n<td>Alibaba Cloud Pricing Calculator<\/td>\n<td>Helps estimate downstream service costs and total runbook impact: https:\/\/www.alibabacloud.com\/pricing\/calculator<\/td>\n<\/tr>\n<tr>\n<td>IAM documentation<\/td>\n<td>RAM Documentation<\/td>\n<td>Required to design least-privilege roles and policies: https:\/\/www.alibabacloud.com\/help\/en\/ram\/<\/td>\n<\/tr>\n<tr>\n<td>Compute API docs<\/td>\n<td>ECS Documentation &amp; API Reference<\/td>\n<td>Used for Start\/Stop\/Describe and operational APIs: https:\/\/www.alibabacloud.com\/help\/en\/ecs\/<\/td>\n<\/tr>\n<tr>\n<td>Audit logging<\/td>\n<td>ActionTrail Documentation<\/td>\n<td>Audit API calls invoked by OOS and support compliance: https:\/\/www.alibabacloud.com\/help\/en\/actiontrail\/<\/td>\n<\/tr>\n<tr>\n<td>CLI tooling<\/td>\n<td>Alibaba Cloud CLI Documentation<\/td>\n<td>Useful for verification and troubleshooting: https:\/\/www.alibabacloud.com\/help\/en\/cli\/<\/td>\n<\/tr>\n<tr>\n<td>Architecture guidance<\/td>\n<td>Alibaba Cloud Architecture Center<\/td>\n<td>Patterns for governance\/ops vary; browse for automation and operations references: https:\/\/www.alibabacloud.com\/architecture<\/td>\n<\/tr>\n<tr>\n<td>Community learning<\/td>\n<td>Alibaba Cloud Blog<\/td>\n<td>Practical articles and examples; validate against docs: https:\/\/www.alibabacloud.com\/blog<\/td>\n<\/tr>\n<tr>\n<td>SDK reference<\/td>\n<td>Alibaba Cloud SDK Center<\/td>\n<td>If you integrate OOS via API or build tooling around it: https:\/\/www.alibabacloud.com\/product\/sdk<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, platform teams<\/td>\n<td>DevOps tooling, automation, cloud operations, pipelines<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate DevOps learners<\/td>\n<td>SCM, CI\/CD foundations, DevOps practices<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud ops practitioners<\/td>\n<td>Cloud operations, monitoring, automation<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, reliability engineers<\/td>\n<td>SRE practices, incident response, automation, SLOs<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops teams exploring AIOps<\/td>\n<td>AIOps concepts, automation, operations analytics<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud coaching and consulting-style training (verify offerings)<\/td>\n<td>DevOps engineers, automation learners<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training programs (verify exact courses)<\/td>\n<td>Beginners to intermediate DevOps learners<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps guidance and delivery (as a resource)<\/td>\n<td>Teams needing practical implementation help<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and training resource (verify services)<\/td>\n<td>Ops teams needing hands-on support<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>DevOps and cloud consulting (verify service catalog)<\/td>\n<td>Automation strategy, CI\/CD, operations modernization<\/td>\n<td>OOS runbook design, IAM guardrails, migration automation planning<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps consulting and training<\/td>\n<td>Platform engineering, DevOps transformation<\/td>\n<td>Standardizing runbooks, building governance, integrating audit trails<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting services (verify details)<\/td>\n<td>DevOps delivery support, tooling integrations<\/td>\n<td>Automation pipelines, operational process improvements, cloud operations enablement<\/td>\n<td>https:\/\/www.devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before OOS<\/h3>\n\n\n\n<p>To use Operation Orchestration Service (OOS) effectively, you should know:\n&#8211; Alibaba Cloud fundamentals: regions, VPC, ECS, security groups\n&#8211; <strong>RAM<\/strong> basics: users, roles, policies, least privilege\n&#8211; API basics: how OpenAPI calls map to console actions\n&#8211; Operational hygiene: tagging strategies, naming conventions\n&#8211; Change management basics for production operations<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after OOS<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Advanced governance: landing zones, multi-account controls, centralized auditing<\/li>\n<li>Event-driven operations: EventBridge + Function Compute patterns (verify current Alibaba Cloud services)<\/li>\n<li>Observability: CloudMonitor, log pipelines, incident response workflows<\/li>\n<li>IaC tooling: ROS and\/or Terraform for lifecycle provisioning<\/li>\n<li>Security engineering: KMS, secrets management, policy-as-code patterns (where applicable)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud engineer \/ cloud operations engineer<\/li>\n<li>DevOps engineer<\/li>\n<li>SRE \/ production engineer<\/li>\n<li>Platform engineer<\/li>\n<li>Security engineer (automation + governance)<\/li>\n<li>FinOps engineer (cost-control automation)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Alibaba Cloud certifications change over time. Check Alibaba Cloud\u2019s official certification portal for current offerings and whether OOS is covered explicitly:\nhttps:\/\/edu.alibabacloud.com\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a dev\/test scheduler: start\/stop instances by tags with exclusions.<\/li>\n<li>Create a \u201csnapshot-before-change\u201d runbook returning snapshot IDs as outputs.<\/li>\n<li>Implement a compliance runbook: verify required tags, security group baselines, and report deviations.<\/li>\n<li>Build a standardized restart runbook for an ECS-based service with health checks (requires additional integrations).<\/li>\n<li>Create a migration pre-check runbook for a fleet (collect instance metadata, validate prerequisites).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Term<\/th>\n<th>Definition<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>OOS (Operation Orchestration Service)<\/strong><\/td>\n<td>Alibaba Cloud service for defining and executing automation runbooks as templates with tracked executions.<\/td>\n<\/tr>\n<tr>\n<td><strong>Template<\/strong><\/td>\n<td>A document that defines an automation workflow: tasks\/steps, parameters, and outputs.<\/td>\n<\/tr>\n<tr>\n<td><strong>Task\/Step<\/strong><\/td>\n<td>A single unit of work in a template, often an API call to an Alibaba Cloud service.<\/td>\n<\/tr>\n<tr>\n<td><strong>Execution<\/strong><\/td>\n<td>A single run of a template with specific parameter values and resulting status\/output.<\/td>\n<\/tr>\n<tr>\n<td><strong>RAM (Resource Access Management)<\/strong><\/td>\n<td>Alibaba Cloud identity and access management service controlling permissions via users\/roles\/policies.<\/td>\n<\/tr>\n<tr>\n<td><strong>Service-linked role<\/strong><\/td>\n<td>A RAM role created for a specific Alibaba Cloud service to access other services securely (exact role name varies).<\/td>\n<\/tr>\n<tr>\n<td><strong>OpenAPI<\/strong><\/td>\n<td>Alibaba Cloud\u2019s programmatic APIs for services like ECS\/VPC\/RDS. OOS commonly orchestrates these APIs.<\/td>\n<\/tr>\n<tr>\n<td><strong>ActionTrail<\/strong><\/td>\n<td>Alibaba Cloud auditing service that records API calls for governance and compliance.<\/td>\n<\/tr>\n<tr>\n<td><strong>CloudMonitor<\/strong><\/td>\n<td>Alibaba Cloud monitoring service for metrics and alarms, often used for operational triggers and visibility.<\/td>\n<\/tr>\n<tr>\n<td><strong>Least privilege<\/strong><\/td>\n<td>Security principle of granting only the minimum permissions required to perform a task.<\/td>\n<\/tr>\n<tr>\n<td><strong>Idempotency<\/strong><\/td>\n<td>Property where running the same operation multiple times results in the same final state (important for safe retries).<\/td>\n<\/tr>\n<tr>\n<td><strong>Tagging<\/strong><\/td>\n<td>Applying key\/value metadata to resources for cost allocation, governance, and safe targeting in automation.<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Operation Orchestration Service (OOS) in <strong>Alibaba Cloud<\/strong> is a managed automation platform for <strong>Migration &amp; O&amp;M Management<\/strong> that turns operational runbooks into <strong>templates<\/strong> and executes them as auditable, repeatable workflows. It matters because it reduces human error, improves operational consistency, supports least-privilege execution with <strong>RAM<\/strong>, and strengthens auditability when paired with <strong>ActionTrail<\/strong>.<\/p>\n\n\n\n<p>Cost-wise, your main drivers are often not OOS itself but the downstream effects of automation\u2014ECS runtime, snapshots, logging retention, and network transfer. Security-wise, the most important control is carefully designed RAM roles\/policies that constrain what OOS executions can do, plus clear resource targeting (tags\/allowlists).<\/p>\n\n\n\n<p>Use OOS when you need standardized cloud operations at scale on Alibaba Cloud. Start with read-only \u201cDescribe\u201d templates, add guardrails, and gradually expand to controlled operational actions. Next, deepen your skills by integrating monitoring\/auditing, practicing staged rollouts, and treating templates like code with reviews and testing.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Migration &#038; O&#038;M Management<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,19],"tags":[],"class_list":["post-111","post","type-post","status-publish","format-standard","hentry","category-alibaba-cloud","category-migration-o-m-management"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/111","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=111"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/111\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}