All Products
Search
Document Center

Agent Sandbox:Create an AgenticBucket Volume

Last Updated:Oct 13, 2026

An AgenticBucket Volume stores the mount configuration of a BucketSpace in an AgenticBucket, so that you can mount the volume by name when you create a Sandbox.

How it works

CreateVolume creates only the volume metadata. It does not create the AgenticBucket or the BucketSpace. The AgenticBucket must be created in advance. The BucketSpace does not need to be created in advance. If the BucketSpace does not exist on the first mount, the system creates it automatically.

Prerequisites

  • A team is created in the Agent Sandbox console. For more information, see Create a team. Record the team ID.

  • An AgenticBucket is created, and you know the full name of the AgenticBucket. For more information about the product and resource management, see OSS Agentic Bucket overview.

  • The full name of the BucketSpace to be used is determined. The BucketSpace does not need to be created in advance.

  • The Object Storage Service (OSS) endpoint of the region in which the AgenticBucket resides is obtained. Use the internal endpoint for access within the same region, such as https://oss-<REGION>-internal.aliyuncs.com.

  • The Resource Access Management (RAM) identity that calls the volume API has the required permissions. For more information, see Grant a RAM user access to the console.

  • A RAM role is configured as described in Configure a RAM role, and the role has the access permissions on the target storage. For the storage permission policy, see Configure storage access permissions in this topic.

Procedure

Step 1: Configure storage access permissions

Add the following permission policy to the RAM role configured for the volume:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:ListObjects",
        "oss:AbortMultipartUpload",
        "oss:CompleteMultipartUpload",
        "oss:DeleteObject",
        "oss:InitiateMultipartUpload",
        "oss:ListParts",
        "oss:PutObject",
        "oss:UploadPart",
        "oss:PutBucket"
      ],
      "Resource": "*"
    }
  ]
}

Step 2: Install the SDK

This topic uses the Alibaba Cloud Python SDK to call the volume API operations. Install the SDK and configure the access credentials as described in Alibaba Cloud SDK and API Guide.

Step 3: Create an AgenticBucket Volume

For more information about the request parameters, response parameters, and error codes, see the CreateVolume - Create a volume topic in the OpenAPI portal.

Storage configuration

The fields of agenticBucketVolumeConfig correspond to the Python SDK parameters as follows:

API field

Python SDK field

Required

Description

agenticBucket

agentic_bucket

Yes

The full name of the AgenticBucket.

bucketName

bucket_name

Yes

The full name of the BucketSpace.

bucketPath

bucket_path

No

The path to mount in the BucketSpace. If you do not specify this parameter, the default value / is used.

endpoint

endpoint

Yes

The OSS endpoint, which must match the region and network environment of the AgenticBucket.

readOnly

read_only

No

Specifies whether the mount is read-only. Valid values: true (read-only) and false (read/write). If you do not specify this parameter, the default value false is used.

Mount configuration

mountConfig stores the Alibaba Cloud Resource Name (ARN) of the RAM role required for the mount. The corresponding Python SDK parameter is mount_config, which is of the models.CreateVolumeInputMountConfig type.

API field

Python SDK field

Required

Description

mountConfig.role

mount_config.role

No

The ARN of the RAM role used to access the storage.

An AgenticBucket Volume does not support mountConfig.vpcConfig.

The role configuration is stored when the volume is created, and is reused when a Sandbox mounts the volume. For more information about how to create a role and the role selection rules, see Configure a RAM role.

Environment variables

The example in this topic reads the following environment variables. Configure the access credentials as described in the SDK instructions above, and set the other parameters in the creation example.

Environment variable

Purpose

Source or value

ALIBABA_CLOUD_ACCESS_KEY_ID

The AccessKey ID used to call the volume API.

Configure the access credentials of the calling identity as described in Alibaba Cloud SDK and API Guide.

ALIBABA_CLOUD_ACCESS_KEY_SECRET

The AccessKey secret that matches the AccessKey ID.

Obtain the secret together with the AccessKey ID.

ALIBABA_CLOUD_SECURITY_TOKEN

The security token used with Security Token Service (STS) temporary credentials.

Set this variable only if you use STS temporary credentials. Use the token from the same set of temporary credentials.

SANDBOX_REGION_ID

The region in which the volume API is called.

Enter the ID of the destination region, such as cn-hangzhou.

SANDBOX_ENDPOINT

The endpoint of the volume API.

Enter sandbox.<REGION>.aliyuncs.com. The region must be the same as that of SANDBOX_REGION_ID. Do not include the protocol prefix.

SANDBOX_TEAM_ID

The team that owns the volume.

Obtain the ID of the destination team from the Agent Sandbox console.

SANDBOX_ROLE_ARN

The storage access role stored in the volume.

After you complete the configuration described in Configure a RAM role, obtain the role ARN from the RAM console.

SANDBOX_VOLUME_NAME

The name of the volume to create.

Specify a name. The name must be unique within the team.

AGENTIC_BUCKET_NAME

The destination AgenticBucket.

Obtain the full name of the existing AgenticBucket from the OSS console.

BUCKET_SPACE_NAME

The destination BucketSpace.

Enter the full name of the BucketSpace to use. If the BucketSpace does not exist on the first mount, the system creates it automatically.

OSS_ENDPOINT

The OSS endpoint used to access the AgenticBucket.

Enter the endpoint of the region in which the AgenticBucket resides. Use https://oss-<REGION>-internal.aliyuncs.com for access within the same region.

Creation example

In a terminal in which the access credentials are configured, set the following parameters and replace the placeholders with actual values. For the value of each variable, see Environment variables.

export SANDBOX_REGION_ID="<REGION>"
export SANDBOX_ENDPOINT="sandbox.${SANDBOX_REGION_ID}.aliyuncs.com"

export SANDBOX_TEAM_ID="<TEAM-ID>"
export SANDBOX_ROLE_ARN="acs:ram::<ACCOUNT-UID>:role/<ROLE-NAME>"
export SANDBOX_VOLUME_NAME="<VOLUME-NAME>"

export AGENTIC_BUCKET_NAME="<AGENTIC-BUCKET-FULL-NAME>"
export BUCKET_SPACE_NAME="<BUCKET-SPACE-FULL-NAME>"
export OSS_ENDPOINT="https://oss-<REGION>-internal.aliyuncs.com"

Save the following code as 10_create_agentic_bucket_volume.py:

import os

from alibabacloud_sandbox20260820 import models
from alibabacloud_sandbox20260820.client import Client as SandboxClient
from alibabacloud_tea_openapi import utils_models as open_api_models


def require_env(name: str) -> str:
    value = os.environ.get(name, "").strip()
    if not value:
        raise RuntimeError(f"Missing environment variable: {name}")
    return value


config = open_api_models.Config(
    access_key_id=require_env("ALIBABA_CLOUD_ACCESS_KEY_ID"),
    access_key_secret=require_env("ALIBABA_CLOUD_ACCESS_KEY_SECRET"),
    security_token=os.environ.get("ALIBABA_CLOUD_SECURITY_TOKEN"),
    region_id=require_env("SANDBOX_REGION_ID"),
    endpoint=require_env("SANDBOX_ENDPOINT"),
)

pop_client = SandboxClient(config)

response = pop_client.create_volume(
    models.CreateVolumeRequest(
        body=models.CreateVolumeInput(
            team_id=require_env("SANDBOX_TEAM_ID"),
            volume_name=require_env("SANDBOX_VOLUME_NAME"),
            mount_config=models.CreateVolumeInputMountConfig(
                role=require_env("SANDBOX_ROLE_ARN"),
            ),
            agentic_bucket_volume_config=models.AgenticBucketVolumeConfig(
                agentic_bucket=require_env("AGENTIC_BUCKET_NAME"),
                bucket_name=require_env("BUCKET_SPACE_NAME"),
                bucket_path="/",
                endpoint=require_env("OSS_ENDPOINT"),
                read_only=False,
            ),
        )
    )
)

if response.body is None or response.body.volume is None:
    raise RuntimeError("CreateVolume did not return a volume")

volume = response.body.volume
print(f"request_id={response.body.request_id}")
print(f"volume_id={volume.volume_id}")
print(f"volume_name={volume.volume_name}")
print(f"storage_class={volume.storage_class}")
print(f"status={volume.status}")

In the same terminal, create the AgenticBucket Volume:

python 10_create_agentic_bucket_volume.py

A successful creation only indicates that the volume configuration is stored. To verify that the mount works, create a Sandbox and mount the volume by name as described in Mount an AgenticBucket Volume. Then confirm that files can be read and written.

Manage volumes

Query the volume list by using ListVolumes, view the details of a volume by using GetVolume. Update the volume configuration by using UpdateVolume, and delete volumes that are no longer in use by using DeleteVolume.

Deleting a volume removes only the mount configuration on the Agent Sandbox side. The AgenticBucket, the BucketSpace, and the data in them are not deleted.

Limits

  • The AgenticBucket, the BucketSpace, and the Sandbox must use matching regions and network environments. The OSS endpoint must match the region and network environment of the AgenticBucket.

  • An AgenticBucket Volume does not require a Virtual Private Cloud (VPC) configuration and does not accept mountConfig.vpcConfig.

  • Volume names cannot be duplicated within the same team.

FAQ

Why does CreateVolume report that exactly one storage configuration is required?

If the error message is request must contain exactly one volume config, the request does not contain a storage configuration, or it contains storage configurations of multiple types. To create an AgenticBucket Volume, provide agenticBucketVolumeConfig only, and do not provide configurations for other storage types.

mountConfig stores the RAM role required for the mount, and cannot replace the storage configuration. For more information about the fields, see Storage configuration in this topic.

Why does CreateVolume report that the volume name already exists?

If the response returns VolumeConflict and the error message contains already exists, a volume that has the same name already exists in the team. Query the configuration and status of that volume to check whether it can be reused. If an independent resource is required, use another name.

Why does CreateVolume report that the team cannot be found?

If the response returns TeamNotFound, check the teamID, the account to which the calling credentials belong, and the region of the request. Make sure that the destination team exists and belongs to the current account.

CreateVolume is denied. Which identity should be granted permissions?

Check whether the RAM identity that calls the API operation has the sandbox:CreateVolume permission, and whether the authorization scope covers the destination team. For more information about how to grant permissions, see Grant a RAM user access to the console.

mountConfig.role is used by the Sandbox to access the underlying storage. Adding storage permissions to this role does not grant volume management permissions to the caller.

To troubleshoot the issue further, retain the complete error message and the request ID.