aliyun Multi-Account Resource Query
Query Alibaba Cloud resources across member accounts in a Resource Directory (RD) organization. When the user refers to an account by its display name (alias) rather than its UID, this skill resolves the alias first, then assumes into the target account to execute the actual resource query.
Scope Check Before You Start
This skill resolves the cross-account routing layer only — alias→UID,
plus the assume-role hop. If the user's actual request is a multi-account
solution pattern — key rotation across all members, drift / cost / RAM
audits, billing aggregation, organization-wide compliance scans — invoke
alibabacloud-find-skills first; a packaged multi-account-ops skill captures
the full workflow (iteration, error rollup, reporting), not just the
cross-account hop. Use this skill directly only when the user just needs the
routing primitive for a single-shot query. Full trigger conditions are in
mcp-core-best-practices → Skill Discovery.
Prerequisites
- The current credentials must belong to an RD management account (or a delegated
administrator) with
resourcedirectory:ListAccountspermission. - A cross-account assume role (default:
ResourceDirectoryAccountAccessRole) must exist in target member accounts.
Workflow
1. Determine Whether Cross-Account Access Is Needed
If the user explicitly provides an account ID (UID), skip to step 3.
If the user refers to an account by display name, alias, or any non-numeric identifier, proceed to step 2 to resolve it.
2. Resolve Account Alias to UID
Use AlibabaCloud___CallCLI to list member accounts. The API returns at most 100
accounts per page, so always set --page-size 100 and handle pagination when the
organization has more than 100 accounts:
aliyun resourcedirectorymaster list-accounts --page-size 100 --page-number 1
From the response, find the account whose DisplayName matches the user's input.
Extract its AccountId field — this is the UID needed for cross-account access.
If the target is not found in the first page, increment --page-number and continue
fetching until the target is found or all pages are exhausted (total account count is
returned in the response's TotalCount field).
If no match is found, report to the user and ask for clarification. Do not guess account IDs.
3. Execute the Resource Query in the Target Account
When calling AlibabaCloud___CallCLI for the actual resource query, pass the
x_assume_account_id parameter with the resolved UID. This tells the MCP server
to assume into the target account before executing the command.
Example — list ECS instances in member account "dev-team":
# Step 1: Resolve "dev-team" to its UID
AlibabaCloud___CallCLI(command="aliyun resourcedirectorymaster list-accounts --page-size 100 --page-number 1")
# → find AccountId where DisplayName == "dev-team", e.g. "1234567890123456"
# → if not found and TotalCount > 100, continue with --page-number 2, 3, ...
# Step 2: Query resources in that account
AlibabaCloud___CallCLI(
command="aliyun ecs describe-instances --region cn-hangzhou",
x_assume_account_id="1234567890123456"
)
4. Present Results
Return the query results to the user. If the user asks about multiple accounts, repeat steps 2–3 for each account, or iterate over all accounts from the ListAccounts response.
Parameter Reference
| Parameter | Description |
|---|---|
x_assume_account_id |
Target member account UID. The MCP server assumes into this account using the default cross-account role. |
x_assume_role_name |
Override the default role name if the target account uses a custom role (default: ResourceDirectoryAccountAccessRole). |
x_assume_role_arn |
Full ARN of the role to assume. Takes highest priority over account_id + role_name. |
Error Handling
- AccessDenied on ListAccounts: The current credentials lack RD read permission. Ask the user to verify they are using the management account.
- AssumeRole failed: The target account may not have the expected role, or the role trust policy does not allow the current account. Report the error and suggest the user check the role configuration.
- Account not found: The display name does not match any member account. List available account names to help the user pick the correct one.
Guardrails
- Always resolve aliases via the ListAccounts API. Never guess or hardcode account IDs.
- Do not cache account lists across conversations — accounts can be added or removed at any time.
- When iterating over multiple accounts, include the account display name and ID in the output so the user can verify correctness.
- Respect the principle of least privilege: only query the resources the user asked about, do not enumerate all resources in all accounts unless explicitly requested.