Automated Dify Setup Using DMS Workspace - Data Management

Prerequisites

Before you begin, make sure that you have:

An Alibaba Cloud account with the required RAM permissions (see Grant permissions)
Service-Linked Role (SLR) and Service Role (SR) authorization. Manage RAM role permissions
(If using existing resources) The DMS Administrator or DBA system role, with existing instances added to DMS and security hosting enabled

Grant permissions

A RAM user needs permissions to view pricing and create a Dify instance. If not granted, click Grant Permission on the deployment page.

Grant permissions using either method:

System policies: In the RAM console, attach the following system policies to the RAM user:

Click to view the required system policies

AliyunKvstoreReadOnlyAccess
AliyunRDSReadOnlyAccess
AliyunGPDBReadOnlyAccess
AliyunROSReadOnlyAccess
AliyunComputeNestUserReadOnlyAccess
AliyunVPCReadOnlyAccess
AliyunECSReadOnlyAccess
AliyunRAMReadOnlyAccess
AliyunDMSFullAccess

Custom policy (least-privilege): In the RAM console, create a custom policy with the following permissions and attach it to the RAM user:

Click to view the policy in JSON

{
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dms:ListWorkspaces",
          "dms:DescribeDifyDefaultVpc",
          "dms:CreateDifyInstance",
          "dms:ListInstances"
        ],
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": "ram:GetRole",
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": [
          "vpc:DescribeVpcs",
          "vpc:DescribeVSwitches",
          "vpc:DescribeVSwitchAttributes",
          "vpc:ListTagResources",
          "ecs:DescribeSecurityGroups"
        ],
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": [
          "computenest:GetServiceEstimateCost",
          "computenest:CheckServiceDeployable"
        ],
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": "ros:GetTemplateEstimateCost",
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": "gpdb:GetPrice",
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": "rds:PreCheckCreateOrder",
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": "kvstore:GetPrice",
        "Resource": "*"
      }
    ]
  }

Region availability

Dify on DMS is available in the following regions: China (Hangzhou), China (Hong Kong), Singapore, Indonesia (Jakarta), and Japan (Tokyo).

Billing

Resources are billed based on the specifications you select. The price shown on the purchase page at the time of order placement is final. Billing items (DMS).

Create a Dify instance

Purchased instances are automatically added to DMS with security hosting enabled. Default control mode: Flexible Management.

Deployment takes 15--30 minutes after purchase.

Step 1: Open the deployment page

Log on to the Alibaba Cloud console and open the Dify on DMS deployment page.

Step 2: Configure basic settings

Field	Description
Billing Method	Billing method for provisioned resources.
Region	Region for all Dify resources. All resources must share the same region.
Deployed Version	Dify version. The Enterprise Edition targets medium-to-large organizations and requires a separate license.
Logon Method	Authentication method for Dify. See the comparison table below.
SR Authorization	Service Role authorization. Grants permissions to the current service. If not authorized, click Grant Permission.
SLR Authorization	Service-Linked Role authorization. Delegates operations on other service resources. If not authorized, click Grant Permission.
Activate Related Services	Whether dependent services are activated. If not, click Grant Permission.
Workspace Creation Method	Deploy Dify in an existing workspace or create a new one.
Workspace Name	A unique name to identify the workspace.
Network Type	Network type. Currently fixed to VPC.
VPC	The ID of the VPC instance where the service runs.
Zone and vSwitch	Primary availability zone and vSwitch. Hosts the primary node.
Standby Zone and vSwitch	Standby zone and vSwitch for disaster recovery.
Internet NAT Gateway	Enables Internet access for resources in the VPC.
Endpoint	Enable internal and public access by activating PrivateZone, EIP, and ALB. This generates pay-as-you-go bills. Pricing: PrivateZone billing, EIP billing, ALB billing rules.

Login method comparison

	DMS Account	Dify Account
Authentication	Uses DMS identity verification	Uses email and password
Account setup	No additional setup required	Users manage their own accounts
Access	Through DMS	Through internal or public endpoint or IP address
Reference	This topic uses DMS Account as an example	See Dify Account Version User Manual

Step 3: Configure Dify settings

Configure Dify data storage. Options: ESSD or OSS.

Field	Description
Dify Version	Dify version to deploy.
Storage Configuration	Storage type: ESSD or OSS.
Number Of Replicas	Number of data copies for high reliability.
Deployment Resource Specification	Computing resources. Affects performance and concurrency.

If you select OSS, also configure the following fields:

Field	Description
Path	Storage path in OSS.
OSS Bucket	Bucket for static resources, attachments, and backups.

Step 4: Configure databases

Configure the metadata database, cache, and vector database for Dify. You can create new instances or import existing ones. To import existing instances, see Preparations for creating a Dify instance based on an existing database.

Metadata database (RDS for PostgreSQL)
- New instance: Select the specifications, storage class, and storage space based on your workload.
- Existing instance: Select a PostgreSQL instance that has security hosting enabled.
Redis cache
- New instance: Select the appropriate Redis configuration.
- Existing instance: Select a Redis instance that has security hosting enabled.
Vector database (AnalyticDB for PostgreSQL)
- New instance: Select the appropriate AnalyticDB configuration.
- Existing instance: Select a vector database instance that has security hosting enabled.

Step 5: Configure security settings

Field	Description
Database Account	A unified account created for all newly purchased databases.
Password	Password for the database account.
Security Group	Virtual firewall controlling inbound and outbound traffic for associated resources.

Step 6: Purchase and deploy

Review the estimated cost on the right.
Confirm the configuration and click Buy Now.
Complete payment. You are automatically redirected to the deployment details page to monitor real-time deployment progress.

Verify the deployment

After deployment completes, verify all components:

In the DMS console, confirm your workspace is listed.
Confirm that RDS for PostgreSQL, Redis, and AnalyticDB for PostgreSQL instances show Running status under the workspace.
Access the Dify login page using your configured endpoint.

Next steps

After deployment:

Configure LLM model providers in Dify to connect to AI models
Create your first AI application
Invite team members to the workspace