alibabacloud-resourcecenter-search

Pre-check: Aliyun CLI >= 3.3.1 required Run

aliyun version

to verify >= 3.3.1. If not installed or version too low, see

references/cli-installation-guide.md

for installation instructions. Then [MUST] run

aliyun configure set --auto-plugin-install true

to enable automatic plugin installation.

Pre-check: Alibaba Cloud Credentials Required

Security Rules:

• NEVER read, echo, or print AK/SK values (e.g.,

  echo $ALIBABA_CLOUD_ACCESS_KEY_ID

  is FORBIDDEN)
• NEVER ask the user to input AK/SK directly in the conversation or command line
• NEVER use

  aliyun configure set

  with literal credential values
• ONLY use

  aliyun configure list

  to check credential status

bash

aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity).

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console
2. Configure credentials outside of this session (via

   aliyun configure

   in terminal or environment variables in shell profile)
3. Return and re-run after

   aliyun configure list

   shows a valid profile

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks, passwords, domain names, resource specifications, etc.) MUST be confirmed with the user. Do NOT assume and use default values without explicit user approval.

Scope

ResourceType

ACS::ECS::Instance

RegionId

cn-hangzhou

ResourceId

ResourceName

VpcId

vpc-xxx

VSwitchId

vsw-xxx

IpAddress

GroupByKey

ResourceType

RegionId

ResourceGroupId

MaxResults

• Read-only:

  AliyunResourceCenterReadOnlyAccess

• Full access:

  AliyunResourceCenterFullAccess

Opening Resource Center will auto-create the service-linked role

AliyunServiceRoleForResourceMetaCenter

.

• Cloud resource read permissions: A RAM user can only see resources in Resource Center for which they have read-only access on the corresponding cloud product. For example, granting

  ReadOnlyAccess

  lets the user see all resources they have access to; granting only

  AliyunVPCReadOnlyAccess

  limits visibility to VPC resources.
• Resource group scoped permissions: If resources are organized by resource groups, you can grant a RAM user read access scoped to a specific resource group. The user will only see resources within that group, achieving resource isolation.

• Grant the system policy

  AliyunResourceCenterFullAccess

  to the RAM user of the Resource Directory management account to enable cross-account resource search.

CRITICAL WARNING: DO NOT execute any

aliyun resourcecenter

command without first reading the exact parameter format in

references/related-apis.md

.

Failure Pattern: Guessing parameters like

--filter

format will cause errors. The correct JSON structure MUST be copied from the documentation.

Mandatory Action: Open and read the specific API section in references/related-apis.md BEFORE constructing any CLI command.

scripts/query-resource-types.py

• When you needs to filter by resource type but doesn't know the exact code -> Use this script first
• After discovering the correct

  ResourceType

  code -> Use it in search or count API with

  --filter

  parameter

[MUST] High-Risk Operation Confirmation — Before executing

disable-resource-center

or

disable-multi-account-resource-center

:

1. MUST explicitly inform the user of the impacts:

• Disable Impact
  • After disabling Resource Center, resource data will no longer be viewable in Resource Center. Specifically:
    • For a single Alibaba Cloud account, after disabling Resource Center, resource data in the current account will no longer be viewable.
    • For the management account of a Resource Directory and the delegated administrator account of Resource Center, disabling Resource Center will also disable the cross-account resource search feature. Resource data in the current account and members of the Resource Directory will no longer be viewable. Additionally, members will not be able to view resource data in their own accounts.
    • After disabling Resource Center, the resource management module on the console homepage, Config Audit service, and other related scenarios will also be unable to view resource data.
• Disable Restrictions
  • If the management account of a Resource Directory or the delegated administrator account of Resource Center has cross-account resource features enabled by another account, Resource Center cannot be disabled.
  • If there are cloud products or features that have strong dependencies on Resource Center, such as Config Audit and associated resource transfer, you must first disable those cloud products or features before you can disable Resource Center.

1. MUST obtain explicit user confirmation (e.g., user types "confirm disable" or similar clear affirmation)
2. DO NOT proceed without user's explicit acknowledgment

Warning: Disabling will remove all resource data and affect dependent services (e.g., Config Audit). Must first disable cross-account if enabled.

aliyun resourcecenter disable-resource-center \
  --user-agent AlibabaCloud-Agent-Skills

Must be done before disabling single-account resource center (if cross-account is enabled). Requires management account or delegated admin.

aliyun resourcecenter disable-multi-account-resource-center \
  --user-agent AlibabaCloud-Agent-Skills

1. --user-agent

   on every Resource Center CLI call — All

   aliyun resourcecenter

   examples in this skill include

   --user-agent AlibabaCloud-Agent-Skills

   . When executing commands for this skill, always pass the same flag so usage is consistent with verification, maintainers’ expectations, and any automated checks.
2. Use filters for targeted search — Combining

   ResourceType

   ,

   RegionId

   , and

   Tag

   filters improves search efficiency
3. Use

   GroupByKey

   for quick statistics — Get resource distribution by type, region, or resource group without iterating
4. Cross-account scope selection — Use the most specific scope (member ID > folder ID > root folder ID > directory ID) to narrow search results
5. Wait after enabling — Resource Center needs a few minutes to build data after activation; large accounts may take longer
6. Prefer read-only policies — For daily search and statistics operations, use

   AliyunResourceCenterReadOnlyAccess

   for security
7. ResourceType discovery — When the exact resource type code is unknown, use the helper script documented in Section 8 (run from the skill root directory).
8. Tag discovery vs tag-filtered search — For “what tag keys/values exist”, use

   list-tag-keys

   /

   list-tag-values

   (and multi-account variants with

   --scope

   ). Reserve

   search-resources

   for finding resources that match tag conditions.