An AgenticBucket Volume stores the mount configuration of a BucketSpace in an AgenticBucket, so that you can mount the volume by name when you create a Sandbox.
How it works
CreateVolume creates only the volume metadata. It does not create the AgenticBucket or the BucketSpace. The AgenticBucket must be created in advance. The BucketSpace does not need to be created in advance. If the BucketSpace does not exist on the first mount, the system creates it automatically.
Prerequisites
-
A team is created in the Agent Sandbox console. For more information, see Create a team. Record the team ID.
-
An AgenticBucket is created, and you know the full name of the AgenticBucket. For more information about the product and resource management, see OSS Agentic Bucket overview.
-
The full name of the BucketSpace to be used is determined. The BucketSpace does not need to be created in advance.
-
The Object Storage Service (OSS) endpoint of the region in which the AgenticBucket resides is obtained. Use the internal endpoint for access within the same region, such as
https://oss-<REGION>-internal.aliyuncs.com. -
The Resource Access Management (RAM) identity that calls the volume API has the required permissions. For more information, see Grant a RAM user access to the console.
-
A RAM role is configured as described in Configure a RAM role, and the role has the access permissions on the target storage. For the storage permission policy, see Configure storage access permissions in this topic.
Procedure
Step 1: Configure storage access permissions
Add the following permission policy to the RAM role configured for the volume:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"oss:GetObject",
"oss:ListObjects",
"oss:AbortMultipartUpload",
"oss:CompleteMultipartUpload",
"oss:DeleteObject",
"oss:InitiateMultipartUpload",
"oss:ListParts",
"oss:PutObject",
"oss:UploadPart",
"oss:PutBucket"
],
"Resource": "*"
}
]
}
Step 2: Install the SDK
This topic uses the Alibaba Cloud Python SDK to call the volume API operations. Install the SDK and configure the access credentials as described in Alibaba Cloud SDK and API Guide.
Step 3: Create an AgenticBucket Volume
For more information about the request parameters, response parameters, and error codes, see the CreateVolume - Create a volume topic in the OpenAPI portal.
Storage configuration
The fields of agenticBucketVolumeConfig correspond to the Python SDK parameters as follows:
|
API field |
Python SDK field |
Required |
Description |
|
|
|
Yes |
The full name of the AgenticBucket. |
|
|
|
Yes |
The full name of the BucketSpace. |
|
|
|
No |
The path to mount in the BucketSpace. If you do not specify this parameter, the default value |
|
|
|
Yes |
The OSS endpoint, which must match the region and network environment of the AgenticBucket. |
|
|
|
No |
Specifies whether the mount is read-only. Valid values: |
Mount configuration
mountConfig stores the Alibaba Cloud Resource Name (ARN) of the RAM role required for the mount. The corresponding Python SDK parameter is mount_config, which is of the models.CreateVolumeInputMountConfig type.
|
API field |
Python SDK field |
Required |
Description |
|
|
|
No |
The ARN of the RAM role used to access the storage. |
An AgenticBucket Volume does not support mountConfig.vpcConfig.
The role configuration is stored when the volume is created, and is reused when a Sandbox mounts the volume. For more information about how to create a role and the role selection rules, see Configure a RAM role.
Environment variables
The example in this topic reads the following environment variables. Configure the access credentials as described in the SDK instructions above, and set the other parameters in the creation example.
|
Environment variable |
Purpose |
Source or value |
|
|
The AccessKey ID used to call the volume API. |
Configure the access credentials of the calling identity as described in Alibaba Cloud SDK and API Guide. |
|
|
The AccessKey secret that matches the AccessKey ID. |
Obtain the secret together with the AccessKey ID. |
|
|
The security token used with Security Token Service (STS) temporary credentials. |
Set this variable only if you use STS temporary credentials. Use the token from the same set of temporary credentials. |
|
|
The region in which the volume API is called. |
Enter the ID of the destination region, such as |
|
|
The endpoint of the volume API. |
Enter |
|
|
The team that owns the volume. |
Obtain the ID of the destination team from the Agent Sandbox console. |
|
|
The storage access role stored in the volume. |
After you complete the configuration described in Configure a RAM role, obtain the role ARN from the RAM console. |
|
|
The name of the volume to create. |
Specify a name. The name must be unique within the team. |
|
|
The destination AgenticBucket. |
Obtain the full name of the existing AgenticBucket from the OSS console. |
|
|
The destination BucketSpace. |
Enter the full name of the BucketSpace to use. If the BucketSpace does not exist on the first mount, the system creates it automatically. |
|
|
The OSS endpoint used to access the AgenticBucket. |
Enter the endpoint of the region in which the AgenticBucket resides. Use |
Creation example
In a terminal in which the access credentials are configured, set the following parameters and replace the placeholders with actual values. For the value of each variable, see Environment variables.
export SANDBOX_REGION_ID="<REGION>"
export SANDBOX_ENDPOINT="sandbox.${SANDBOX_REGION_ID}.aliyuncs.com"
export SANDBOX_TEAM_ID="<TEAM-ID>"
export SANDBOX_ROLE_ARN="acs:ram::<ACCOUNT-UID>:role/<ROLE-NAME>"
export SANDBOX_VOLUME_NAME="<VOLUME-NAME>"
export AGENTIC_BUCKET_NAME="<AGENTIC-BUCKET-FULL-NAME>"
export BUCKET_SPACE_NAME="<BUCKET-SPACE-FULL-NAME>"
export OSS_ENDPOINT="https://oss-<REGION>-internal.aliyuncs.com"
Save the following code as 10_create_agentic_bucket_volume.py:
import os
from alibabacloud_sandbox20260820 import models
from alibabacloud_sandbox20260820.client import Client as SandboxClient
from alibabacloud_tea_openapi import utils_models as open_api_models
def require_env(name: str) -> str:
value = os.environ.get(name, "").strip()
if not value:
raise RuntimeError(f"Missing environment variable: {name}")
return value
config = open_api_models.Config(
access_key_id=require_env("ALIBABA_CLOUD_ACCESS_KEY_ID"),
access_key_secret=require_env("ALIBABA_CLOUD_ACCESS_KEY_SECRET"),
security_token=os.environ.get("ALIBABA_CLOUD_SECURITY_TOKEN"),
region_id=require_env("SANDBOX_REGION_ID"),
endpoint=require_env("SANDBOX_ENDPOINT"),
)
pop_client = SandboxClient(config)
response = pop_client.create_volume(
models.CreateVolumeRequest(
body=models.CreateVolumeInput(
team_id=require_env("SANDBOX_TEAM_ID"),
volume_name=require_env("SANDBOX_VOLUME_NAME"),
mount_config=models.CreateVolumeInputMountConfig(
role=require_env("SANDBOX_ROLE_ARN"),
),
agentic_bucket_volume_config=models.AgenticBucketVolumeConfig(
agentic_bucket=require_env("AGENTIC_BUCKET_NAME"),
bucket_name=require_env("BUCKET_SPACE_NAME"),
bucket_path="/",
endpoint=require_env("OSS_ENDPOINT"),
read_only=False,
),
)
)
)
if response.body is None or response.body.volume is None:
raise RuntimeError("CreateVolume did not return a volume")
volume = response.body.volume
print(f"request_id={response.body.request_id}")
print(f"volume_id={volume.volume_id}")
print(f"volume_name={volume.volume_name}")
print(f"storage_class={volume.storage_class}")
print(f"status={volume.status}")
In the same terminal, create the AgenticBucket Volume:
python 10_create_agentic_bucket_volume.py
A successful creation only indicates that the volume configuration is stored. To verify that the mount works, create a Sandbox and mount the volume by name as described in Mount an AgenticBucket Volume. Then confirm that files can be read and written.
Manage volumes
Query the volume list by using ListVolumes, view the details of a volume by using GetVolume. Update the volume configuration by using UpdateVolume, and delete volumes that are no longer in use by using DeleteVolume.
Deleting a volume removes only the mount configuration on the Agent Sandbox side. The AgenticBucket, the BucketSpace, and the data in them are not deleted.
Limits
-
The AgenticBucket, the BucketSpace, and the Sandbox must use matching regions and network environments. The OSS endpoint must match the region and network environment of the AgenticBucket.
-
An AgenticBucket Volume does not require a Virtual Private Cloud (VPC) configuration and does not accept
mountConfig.vpcConfig. -
Volume names cannot be duplicated within the same team.
FAQ
Why does CreateVolume report that exactly one storage configuration is required?
If the error message is request must contain exactly one volume config, the request does not contain a storage configuration, or it contains storage configurations of multiple types. To create an AgenticBucket Volume, provide agenticBucketVolumeConfig only, and do not provide configurations for other storage types.
mountConfig stores the RAM role required for the mount, and cannot replace the storage configuration. For more information about the fields, see Storage configuration in this topic.
Why does CreateVolume report that the volume name already exists?
If the response returns VolumeConflict and the error message contains already exists, a volume that has the same name already exists in the team. Query the configuration and status of that volume to check whether it can be reused. If an independent resource is required, use another name.
Why does CreateVolume report that the team cannot be found?
If the response returns TeamNotFound, check the teamID, the account to which the calling credentials belong, and the region of the request. Make sure that the destination team exists and belongs to the current account.
CreateVolume is denied. Which identity should be granted permissions?
Check whether the RAM identity that calls the API operation has the sandbox:CreateVolume permission, and whether the authorization scope covers the destination team. For more information about how to grant permissions, see Grant a RAM user access to the console.
mountConfig.role is used by the Sandbox to access the underlying storage. Adding storage permissions to this role does not grant volume management permissions to the caller.
To troubleshoot the issue further, retain the complete error message and the request ID.