---
name: multi-account-query
description: >
  Query Alibaba Cloud resources across multiple accounts in a Resource Directory.
  Resolves member account aliases to UIDs via ResourceDirectory ListAccounts,
  then uses x_assume_account_id to assume into the target account for CLI calls.
  Use when the user references a member account by display name or alias, or
  explicitly asks to query resources in another account under the same RD.
  MUST be loaded for any cross-account or member-account operation before
  calling AlibabaCloud___CallCLI with x_assume_account_id.
triggers: >
  成员账号, member account, 跨账号, cross-account, 资源目录, resource directory,
  x_assume_account_id, assume role, 其他账号, other account, 子账号资源,
  ListAccounts, 账号下的, 查询账号, account alias, 多账号, multi-account,
  某个账号的, 切换账号
allowed-tools: "mcp__plugin_alibabacloud-core_alibabacloud-core__AlibabaCloud___CallCLI,mcp__plugin_alibabacloud-core_alibabacloud-core__AlibabaCloud___SearchApis,mcp__plugin_alibabacloud-core_alibabacloud-core__AlibabaCloud___GetApiDefinition,mcp__plugin_alibabacloud-core_alibabacloud-core__AlibabaCloud___GenerateCLICommand"
---

# Multi-Account Resource Query

Query Alibaba Cloud resources across member accounts in a Resource Directory (RD)
organization. When the user refers to an account by its display name (alias)
rather than its UID, this skill resolves the alias first, then assumes into the
target account to execute the actual resource query.

## Scope Check Before You Start

This skill resolves the **cross-account routing layer only** — alias→UID,
plus the assume-role hop. If the user's actual request is a **multi-account
solution pattern** — key rotation across all members, drift / cost / RAM
audits, billing aggregation, organization-wide compliance scans — invoke
`alibabacloud-find-skills` first; a packaged multi-account-ops skill captures
the full workflow (iteration, error rollup, reporting), not just the
cross-account hop. Use this skill directly only when the user just needs the
routing primitive for a single-shot query. Full trigger conditions are in
`mcp-core-best-practices` → Skill Discovery.

## Prerequisites

- The current credentials must belong to an RD management account (or a delegated
  administrator) with `resourcedirectory:ListAccounts` permission.
- A cross-account assume role (default: `ResourceDirectoryAccountAccessRole`) must
  exist in target member accounts.

## Workflow

### 1. Determine Whether Cross-Account Access Is Needed

If the user explicitly provides an account ID (UID), skip to step 3.

If the user refers to an account by display name, alias, or any non-numeric
identifier, proceed to step 2 to resolve it.

### 2. Resolve Account Alias to UID

Use `AlibabaCloud___CallCLI` to list member accounts. The API returns at most 100
accounts per page, so always set `--page-size 100` and handle pagination when the
organization has more than 100 accounts:

```
aliyun resourcedirectorymaster list-accounts --page-size 100 --page-number 1
```

From the response, find the account whose `DisplayName` matches the user's input.
Extract its `AccountId` field — this is the UID needed for cross-account access.

If the target is not found in the first page, increment `--page-number` and continue
fetching until the target is found or all pages are exhausted (total account count is
returned in the response's `TotalCount` field).

If no match is found, report to the user and ask for clarification. Do not guess
account IDs.

### 3. Execute the Resource Query in the Target Account

When calling `AlibabaCloud___CallCLI` for the actual resource query, pass the
`x_assume_account_id` parameter with the resolved UID. This tells the MCP server
to assume into the target account before executing the command.

Example — list ECS instances in member account "dev-team":

```
# Step 1: Resolve "dev-team" to its UID
AlibabaCloud___CallCLI(command="aliyun resourcedirectorymaster list-accounts --page-size 100 --page-number 1")
# → find AccountId where DisplayName == "dev-team", e.g. "1234567890123456"
# → if not found and TotalCount > 100, continue with --page-number 2, 3, ...

# Step 2: Query resources in that account
AlibabaCloud___CallCLI(
  command="aliyun ecs describe-instances --region cn-hangzhou",
  x_assume_account_id="1234567890123456"
)
```

### 4. Present Results

Return the query results to the user. If the user asks about multiple accounts,
repeat steps 2–3 for each account, or iterate over all accounts from the
ListAccounts response.

## Parameter Reference

| Parameter | Description |
|-----------|-------------|
| `x_assume_account_id` | Target member account UID. The MCP server assumes into this account using the default cross-account role. |
| `x_assume_role_name` | Override the default role name if the target account uses a custom role (default: `ResourceDirectoryAccountAccessRole`). |
| `x_assume_role_arn` | Full ARN of the role to assume. Takes highest priority over account_id + role_name. |

## Error Handling

- **AccessDenied on ListAccounts**: The current credentials lack RD read
  permission. Ask the user to verify they are using the management account.
- **AssumeRole failed**: The target account may not have the expected role, or
  the role trust policy does not allow the current account. Report the error and
  suggest the user check the role configuration.
- **Account not found**: The display name does not match any member account.
  List available account names to help the user pick the correct one.

## Guardrails

- Always resolve aliases via the ListAccounts API. Never guess or hardcode
  account IDs.
- Do not cache account lists across conversations — accounts can be added or
  removed at any time.
- When iterating over multiple accounts, include the account display name and ID
  in the output so the user can verify correctness.
- Respect the principle of least privilege: only query the resources the user
  asked about, do not enumerate all resources in all accounts unless explicitly
  requested.