Alibabacloud Resourcecenter Search

1. Prerequisites

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include:

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

[MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution.

Run the following commands before any other aliyun CLI invocation:

```bash

aliyun configure ai-mode enable

aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search"

```

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update,

or see references/cli-installation-guide.md for installation instructions.

Then [MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

Then [MUST] run aliyun plugin update to ensure that any existing plugins on your local machine are always up-to-date.

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

>

- NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

>

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

>

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed.

AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

```bash

aliyun configure ai-mode disable

```

---

2. Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks,

passwords, domain names, resource specifications, etc.) MUST be confirmed with the

user. Do NOT assume and use default values without explicit user approval.

---

3. RAM Policy

See references/ram-policies.md for full permission lists.

Recommended system policies:

• Read-only: AliyunResourceCenterReadOnlyAccess
• Full access: AliyunResourceCenterFullAccess

Opening Resource Center will auto-create the service-linked role AliyunServiceRoleForResourceMetaCenter.

Resource Visibility Scope

RAM policies (defined in ram-policies.md) control whether a user can call a Resource Center API. However, for search APIs (SearchResources, GetResourceCounts, GetResourceConfiguration, SearchMultiAccountResources, GetMultiAccountResourceCounts, GetMultiAccountResourceConfiguration), the scope of resources visible in results is determined by each cloud product's own permissions:

Single Account

• Cloud resource read permissions: A RAM user can only see resources in Resource Center for which they have read-only access on the corresponding cloud product. For example, granting ReadOnlyAccess lets the user see all resources they have access to; granting only AliyunVPCReadOnlyAccess limits visibility to VPC resources.
• Resource group scoped permissions: If resources are organized by resource groups, you can grant a RAM user read access scoped to a specific resource group. The user will only see resources within that group, achieving resource isolation.

Cross-Account

• Grant the system policy AliyunResourceCenterFullAccess to the RAM user of the Resource Directory management account to enable cross-account resource search.

---

4. Core Workflow

Step 1: Identify APIs Based on User Requirements

Determine which APIs are needed based on the user's specific scenario. Refer to the scenario cards below.

Step 2: [MUST] Read API Documentation Before Every CLI Call

CRITICAL WARNING: DO NOT execute any aliyun resourcecenter command without first reading the exact parameter format in references/related-apis.md.

>

Failure Pattern: Guessing parameters like --filter format will cause errors. The correct JSON structure MUST be copied from the documentation.

>

Mandatory Action: Open and read the specific API section in references/related-apis.md BEFORE constructing any CLI command.

---

Scenario Cards

Scenario 1: Service Activation

---

Scenario 2: ResourceType Discovery

Decision Logic:

• When you needs to filter by resource type but doesn't know the exact code -> Use this script first
• After discovering the correct ResourceType code -> Use it in search or count API with --filter parameter

---

Scenario 3: Resource Search

---

Scenario 4: View Resource Details

---

Scenario 5: Statistics and Analysis

---

Scenario 6: Tag Discovery

---

5. Success Verification

See references/verification-method.md for detailed verification steps and commands for each workflow step.

---

6. Precautions

[MUST] High-Risk Operation Confirmation — Before executing disable-resource-center or disable-multi-account-resource-center:

>

1. MUST explicitly inform the user of the impacts:

- Disable Impact

- After disabling Resource Center, resource data will no longer be viewable in Resource Center. Specifically:

- For a single Alibaba Cloud account, after disabling Resource Center, resource data in the current account will no longer be viewable.

- For the management account of a Resource Directory and the delegated administrator account of Resource Center, disabling Resource Center will also disable the cross-account resource search feature. Resource data in the current account and members of the Resource Directory will no longer be viewable. Additionally, members will not be able to view resource data in their own accounts.

- After disabling Resource Center, the resource management module on the console homepage, Config Audit service, and other related scenarios will also be unable to view resource data.

- Disable Restrictions

- If the management account of a Resource Directory or the delegated administrator account of Resource Center has cross-account resource features enabled by another account, Resource Center cannot be disabled.

- If there are cloud products or features that have strong dependencies on Resource Center, such as Config Audit and associated resource transfer, you must first disable those cloud products or features before you can disable Resource Center.

2. MUST obtain explicit user confirmation (e.g., user types "confirm disable" or similar clear affirmation)

3. DO NOT proceed without user's explicit acknowledgment

Disable Resource Center

Warning: Disabling will remove all resource data and affect dependent services (e.g., Config Audit). Must first disable cross-account if enabled.

aliyun resourcecenter disable-resource-center \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

Disable Cross-Account Resource Center

Must be done before disabling single-account resource center (if cross-account is enabled). Requires management account or delegated admin.

aliyun resourcecenter disable-multi-account-resource-center \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

7. Best Practices

1. `--user-agent` on every Resource Center CLI call — All aliyun resourcecenter examples in this skill include --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search. When executing commands for this skill, always pass the same flag so usage is consistent with verification, maintainers’ expectations, and any automated checks. 2. Use filters for targeted search — Combining ResourceType, RegionId, and Tag filters improves search efficiency 3. Use `GroupByKey` for quick statistics — Get resource distribution by type, region, or resource group without iterating 4. Cross-account scope selection — Use the most specific scope (member ID > folder ID > root folder ID > directory ID) to narrow search results 5. Wait after enabling — Resource Center needs a few minutes to build data after activation; large accounts may take longer 6. Prefer read-only policies — For daily search and statistics operations, use AliyunResourceCenterReadOnlyAccess for security 7. ResourceType discovery — When the exact resource type code is unknown, use the helper script documented in Section 8 (run from the skill root directory). 8. Tag discovery vs tag-filtered search — For “what tag keys/values exist”, use list-tag-keys / list-tag-values (and multi-account variants with --scope). Reserve search-resources for finding resources that match tag conditions.

---

8. Available scripts

---

9. Troubleshooting

When a Resource Center API call or aliyun resourcecenter command fails, read the response’s HTTP status, Code (error code), and Message, then match them against the catalog.

Full error list: references/error-codes.md

---

10. Reference Links

Acceptance Criteria: alibabacloud-resourcecenter-search

Scenario: Cross-region, Cross-product, Cross-account Global Resource Inventory, Search & Statistics Purpose: Skill testing acceptance criteria

---

Correct CLI Command Patterns

1. Product — resourcecenter

CORRECT

aliyun resourcecenter search-resources ...
aliyun resourcecenter enable-resource-center ...

INCORRECT

aliyun resource-center search-resources ...    # Wrong: product name has no hyphen
aliyun ResourceCenter SearchResources ...      # Wrong: not plugin mode

2. Commands — All verified via --help

3. Parameters — All verified via --help

search-resources

search-multi-account-resources

get-resource-counts

get-multi-account-resource-counts

get-resource-configuration

list-tag-values

4. Enum Values Verified

5. Filter Value Format Verified

The --filter parameter accepts a JSON array string:

CORRECT

--filter '[{"Key":"ResourceType","MatchType":"Equals","Value":["ACS::ECS::Instance"]}]'

INCORRECT

--filter Key=ResourceType MatchType=Equals Value=ACS::ECS::Instance    # Wrong: not JSON format
--filter '{"Key":"ResourceType","MatchType":"Equals","Value":["ACS::ECS::Instance"]}'  # Wrong: not array

6. --user-agent Flag

CORRECT

aliyun resourcecenter search-resources --max-results 50 --user-agent AlibabaCloud-Agent-Skills

INCORRECT

aliyun resourcecenter search-resources --max-results 50    # Missing --user-agent

All aliyun commands in the skill include --user-agent AlibabaCloud-Agent-Skills.

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

Resource Center API error codes

RAM Policies - Resource Center

Required Permissions

Single Account Operations

The following are the minimum RAM permissions required for single-account resource search and inventory:

resourcecenter:EnableResourceCenter resourcecenter:DisableResourceCenter resourcecenter:GetResourceConfiguration tag:ListTagKeys tag:ListTagValues

Cross-Account Operations (Requires Resource Directory Management Account or Delegated Admin)

The following are the RAM permissions required for cross-account resource search and inventory (must be executed by the Resource Directory management account or delegated admin account):

resourcecenter:EnableMultiAccountResourceCenter resourcecenter:DisableMultiAccountResourceCenter resourcecenter:GetMultiAccountResourceCenterServiceStatus resourcecenter:SearchMultiAccountResources resourcecenter:GetMultiAccountResourceCounts resourcecenter:GetMultiAccountResourceConfiguration

Read-Only Policy (Recommended for Search & Statistics Only)

If only search and statistics functionality is needed, the following read-only permissions can be used:

resourcecenter:GetResourceConfiguration resourcecenter:GetMultiAccountResourceCenterServiceStatus resourcecenter:SearchMultiAccountResources resourcecenter:GetMultiAccountResourceCounts resourcecenter:GetMultiAccountResourceConfiguration tag:ListTagKeys tag:ListTagValues

System Role

When enabling Resource Center, the system automatically creates the service-linked role AliyunServiceRoleForResourceMetaCenter. This role is used by Resource Center to call resource query or list APIs from cloud services to obtain resource metadata information.

Notes

• Enabling/disabling the Resource Center service requires an Alibaba Cloud account or a RAM user with EnableResourceCenter/DisableResourceCenter permissions
• Cross-account operations must use the Resource Directory management account or Resource Center delegated admin account
• It is recommended to use the system policy AliyunResourceCenterReadOnlyAccess for read-only access
• It is recommended to use the system policy AliyunResourceCenterFullAccess for full access

Related APIs - Resource Center

Single Account Operations

enable-resource-center

Enable Resource Center service.

Usage

# Enable Resource Center service
aliyun resourcecenter enable-resource-center \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

disable-resource-center

Disable Resource Center service.

Usage

# Disable Resource Center service
aliyun resourcecenter disable-resource-center \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

get-resource-center-service-status

Query Resource Center service status.

Usage

# Check if Resource Center is enabled
aliyun resourcecenter get-resource-center-service-status \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

search-resources

Search resources under the current account.

Usage

# Search all resources (paginated)
aliyun resourcecenter search-resources \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

# Search by resource type (ECS instances)
aliyun resourcecenter search-resources \
  --filter '[{"Key":"ResourceType","MatchType":"Equals","Value":["ACS::ECS::Instance"]}]' \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

# Combined search: ECS + Hangzhou region
aliyun resourcecenter search-resources \
  --filter '[{"Key":"ResourceType","MatchType":"Equals","Value":["ACS::ECS::Instance"]},{"Key":"RegionId","MatchType":"Equals","Value":["cn-hangzhou"]}]' \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

# Search by tag (Environment=Production)
aliyun resourcecenter search-resources \
  --filter '[{"Key":"Tag","MatchType":"Contains","Value":["{\"key\":\"env\",\"value\":\"prod\"}"]}]' \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

# Find untagged resources
aliyun resourcecenter search-resources \
  --filter '[{"Key":"Tag","MatchType":"NotExists"}]' \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

# Search including deleted resources (for auditing or recovery)
aliyun resourcecenter search-resources \
  --include-deleted-resources=true \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

get-resource-counts

Query resource count statistics for the current account.

Usage

# Count by resource type
aliyun resourcecenter get-resource-counts \
  --group-by-key ResourceType \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

# Count by region
aliyun resourcecenter get-resource-counts \
  --group-by-key RegionId \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

# Count ECS instance distribution by region
aliyun resourcecenter get-resource-counts \
  --group-by-key RegionId \
  --filter '[{"Key":"ResourceType","MatchType":"Equals","Value":["ACS::ECS::Instance"]}]' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

get-resource-configuration

Query single resource configuration details for the current account.

Usage

# Get single ECS instance configuration
aliyun resourcecenter get-resource-configuration \
  --resource-type ACS::ECS::Instance \
  --resource-region-id cn-hangzhou \
  --resource-id i-bp1xxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

batch-get-resource-configurations

Batch query resource configurations for the current account.

Usage

# Batch get multiple instance configurations
aliyun resourcecenter batch-get-resource-configurations \
  --resources RegionId=cn-hangzhou ResourceId=vtb-xxx ResourceType=ACS::VPC::RouteTable \
  --resources RegionId=cn-shanghai ResourceId=sg-xxx ResourceType=ACS::ECS::SecurityGroup \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

list-tag-keys

Query tag keys under the current account.

Usage

# List all tag keys
aliyun resourcecenter list-tag-keys \
  --max-results 100 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

list-tag-values

Query tag values under the current account.

Usage

# List all values for env tag
aliyun resourcecenter list-tag-values \
  --tag-key env \
  --max-results 100 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

Cross-Account Operations (Requires Resource Directory)

enable-multi-account-resource-center

Enable cross-account resource search.

Usage

# Enable cross-account resource search
aliyun resourcecenter enable-multi-account-resource-center \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

disable-multi-account-resource-center

Disable cross-account resource search.

Usage

# Disable cross-account resource search
aliyun resourcecenter disable-multi-account-resource-center \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

get-multi-account-resource-center-service-status

Query cross-account resource search service status.

Usage

# Check cross-account Resource Center status
aliyun resourcecenter get-multi-account-resource-center-service-status \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

search-multi-account-resources

Search resources across accounts.

Usage

# Cross-account resource search
aliyun resourcecenter search-multi-account-resources \
  --scope <ResourceDirectoryId> \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

get-multi-account-resource-counts

Query resource count statistics across accounts.

Usage

# Cross-account count by resource type
aliyun resourcecenter get-multi-account-resource-counts \
  --scope <ResourceDirectoryId> \
  --group-by-key ResourceType \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

get-multi-account-resource-configuration

Query single resource configuration across accounts.

Usage

# Get cross-account resource configuration
aliyun resourcecenter get-multi-account-resource-configuration \
  --account-id <AccountId> \
  --resource-type ACS::ECS::Instance \
  --resource-region-id cn-hangzhou \
  --resource-id i-bp1xxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

list-multi-account-tag-keys

Query tag keys across accounts.

Usage

# Cross-account list tag keys
aliyun resourcecenter list-multi-account-tag-keys \
  --scope <ResourceDirectoryId> \
  --max-results 100 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

list-multi-account-tag-values

Query tag values across accounts.

Usage

# Cross-account list tag values
aliyun resourcecenter list-multi-account-tag-values \
  --scope <ResourceDirectoryId> \
  --tag-key env \
  --max-results 100 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

---

Filter Parameter Definition

Multiple array elements are combined with logical AND

Filter Parameter Validation Rules — The --filter parameter uses Key + MatchType + Value structure. MUST follow the allowed combinations below. Using unsupported MatchType for a Key will cause API errors.

Tag filter examples (JSON array for --filter):

1. `Contains` and `NotContains` — Use the same Value shape: a JSON string for the tag (key-only or key+value).

   # key-only
   [{"Key":"Tag","MatchType":"Contains","Value":["{\"key\":\"env\"}"]}]
   # key+value
   [{"Key":"Tag","MatchType":"NotContains","Value":["{\"key\":\"env\",\"value\":\"prod\"}"]}]

2. `NotExists` — resources that have no user tags (untagged). Use only Key and MatchType; do not pass Value.

   [{"Key":"Tag","MatchType":"NotExists"}]

Verification Method - Resource Center

Step 1: Verify Resource Center is Enabled

aliyun resourcecenter get-resource-center-service-status \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

Expected Output:

{
  "ServiceStatus": "Enabled",
  "InitialStatus": "Finished",
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

• ServiceStatus being Enabled indicates that Resource Center is activated.
• InitialStatus being Finished indicates that Resource index is completed.

Response fields (per API definition):

How to interpret results:

• `ServiceStatus: Enabled` — Resource Center is activated; you may call search and statistics APIs.
• `InitialStatus: Pending` — Data is still being built after enablement (or a large inventory is catching up). Search or counts may be empty or incomplete; poll this API until InitialStatus becomes Finished before treating failures as permission or configuration issues. Allow several minutes (large accounts may take longer), consistent with the main skill workflow.
• `InitialStatus: Finished` — Metadata is ready; search and GetResourceCounts results should reflect inventory within normal service behavior.
• `ServiceStatus: Disabled` — Enable Resource Center first (enable-resource-center); InitialStatus is not applicable for operational search until the service is enabled.

Step 2: Verify Resource Search is Working

aliyun resourcecenter search-resources \
  --max-results 5 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

Expected Output: Returns JSON containing a Resources array, where each resource includes fields such as ResourceId, ResourceType, RegionId, etc.

Step 3: Verify Resource Count Statistics

aliyun resourcecenter get-resource-counts \
  --group-by-key ResourceType \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

Expected Output: Returns JSON containing a Filters array, where each item includes FilterKey (resource type) and FilterValue (count).

Step 4: Verify Cross-Account Resource Center Status (If Applicable)

This step is only applicable for management accounts that have set up a Resource Directory.

aliyun resourcecenter get-multi-account-resource-center-service-status \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

Expected Output:

{
  "ServiceStatus": "Enabled",
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

Step 5: Verify Cross-Account Resource Search (If Applicable)

The --scope parameter is required (Resource Directory ID, Root Folder ID, Folder ID, or Member ID).

aliyun resourcecenter search-multi-account-resources \
  --scope <ResourceDirectoryId> \
  --max-results 5 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

Expected Output: Returns JSON containing a Resources array with resources from multiple member accounts.

Step 6: Verify Cross-Account Resource Count Statistics (If Applicable)

aliyun resourcecenter get-multi-account-resource-counts \
  --scope <ResourceDirectoryId> \
  --group-by-key ResourceType \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-resourcecenter-search

Expected Output: Returns resource count statistics aggregated across multiple member accounts.

Common Failure Scenarios