/alibabacloud-cadt-probe

name: alibabacloud-cadt-probe
description: |
  Use CADT probe service to discover cloud resources under an Alibaba Cloud account. Use this skill when users need to:
  (1) Discover existing cloud resources via CADT probe
  (2) Inventory existing resource list
  (3) Export resource list for CADT architecture import
  (4) Understand resource distribution within an account
  (5) Query related/associated resources for a specific resource (e.g., find security groups and vswitches linked to an ECS instance)
  
  Trigger words: resource probe, CADT probe, probe, resource inventory, list resources, view cloud resources, related resources, associated resources, resource relationships

CADT Alibaba Cloud Resource Probe

Use the CADT probe service (BPStudio API) to discover cloud resources under an Alibaba Cloud account.

Quick Start

Prerequisites

pip install alibabacloud_bpstudio20210931==8.1.1 alibabacloud_credentials==1.0.5

Configure credentials using the Alibaba Cloud default credential chain. Choose one of the following methods:

• Run `aliyun configure` to set up a credential profile
• Set environment variables `ALIBABA_CLOUD_ACCESS_KEY_ID` and `ALIBABA_CLOUD_ACCESS_KEY_SECRET` (auto-detected by the default chain)
• Use an ECS instance RAM role (when running on ECS)
• Configure `~/.alibabacloud/credentials` file

Pre-conditions

The **Cloud Config** service must be enabled in the Alibaba Cloud console, as CADT probe relies on resource data provided by Cloud Config:

• Enable at: https://config.console.aliyun.com/
• Monitoring scope must be set to "All resources in account"
• After initial activation, wait 30-60 minutes for the initial scan to complete

RAM Policy

This skill requires the following RAM permissions to execute BPStudio probe operations and discover cloud resources across 20+ Alibaba Cloud services.

For the complete permission list including a least-privilege RAM policy JSON, see [references/ram-policies.md](references/ram-policies.md).

**Key permissions:**

| Service | Action | Purpose | |---------|--------|---------| | BPStudio | `bpstudio:ExecuteOperation` | Execute all probe sync operations (CreateOneClickJob, GetOneClickStatus, GetProbeResourceSummary, GetProbeRelatedItems, GetLastProbeTime, GetProbeRegions, GetProbeResult) | | Config | `config:ListDiscoveredResources` + 5 others | Resource discovery via Cloud Config | | VPC / SLB / ALB / NLB / ACK / ... | Various Describe/List actions | Product-specific resource discovery and relation queries |

> **[MUST] Permission Failure Handling:** When any command or API call fails due to permission errors at any point during execution, follow this process: > 1. Read `references/ram-policies.md` to get the full list of permissions required by this SKILL > 2. Use `ram-permission-diagnose` skill to guide the user through requesting the necessary permissions > 3. Pause and wait until the user confirms that the required permissions have been granted

Run Probe

python scripts/probe.py

Parameters

| Parameter | Required | Description | |-----------|----------|-------------| | `--regions` | No | Comma-separated list of regions to probe and filter results (e.g., cn-hangzhou,cn-beijing). Probes all regions when not specified | | `--output` | No | Output JSON file path. Prints to console only when not specified | | `--list-types` | No | Comma-separated resource type filter list (serviceTypes) for GetProbeResult / GetProbeResourceSummary; empty means no filter | | `--skip-probe` | No | Skip task creation and polling, directly pull existing probe results (suitable for previously probed scenarios) | | `-q`, `--quiet` | No | Quiet mode: suppress console decorative output, only output pure JSON to stdout (suitable for Agent/script calls). [debug] output is disabled by default in this mode | | `--debug` | No | Enable debug output: print [debug] details of API responses (with full response body) to stderr. Disabled by default in quiet mode (-q) | | `--summary` | No | Summary mode: only output aggregated statistics (skip GetProbeResult detailed resource list), significantly reducing output size | | `--keep-attributes` | No | Retain the original attributes field for each resource (stripped by default to reduce output size) | | `--related-resource-id` | No | Resource ID for querying related resources (GetProbeRelatedItems). When specified, skips full probe and only queries related resources for this resource (e.g., `i-xxx` for ECS, `sg-xxx` for security group, `vpc-xxx` for VPC) | | `--related-types` | No | Comma-separated resource type filter for `--related-resource-id` (e.g., `security_group,vswitch`). Empty means return all related resource types |

Usage Examples

1. Basic Probe

python scripts/probe.py

2. Export JSON Results

python scripts/probe.py --output probe_result.json

3. Skip Probe and Pull Existing Results

If you have previously probed (resource data is cached on the server side), you can directly pull existing results without creating a new task:

python scripts/probe.py --skip-probe
python scripts/probe.py --skip-probe --output result.json
python scripts/probe.py --skip-probe --list-types ecs,vpc

4. Agent Mode (Quiet Mode)

Use the `-q` flag to suppress all human-readable output, printing only pure JSON to stdout for easy Agent or script parsing. By default, the `attributes` field of each resource is stripped to reduce output size:

python scripts/probe.py -q
python scripts/probe.py -q --output result.json
python scripts/probe.py -q --regions cn-hangzhou --list-types ecs,vpc

To retain full attributes, use `--keep-attributes`:

python scripts/probe.py -q --keep-attributes

Output Auto-Degradation (Agent Mode)

When the JSON output is large (e.g., 127 security groups with Permissions arrays + 100 vswitches), the script automatically degrades output to prevent terminal truncation:

| Output Size