Call the SearchMultiAccountResources API to search for resources across multiple accounts - Resource Management - Alibaba Cloud - Resource Management

Searches for resources across the management account and multiple member accounts in a resource directory.

Operation description

Only cloud services and resource types supported by Resource Center can be searched.
If you are using a Resource Access Management (RAM) user or RAM role, you must be granted permissions on the SearchMultiAccountResources operation before you can execute cross-account resource searches. For more information, see RAM users using Resource Center.
The SearchMultiAccountResources operation returns a maximum of 20 entries by default. You can adjust the maximum number of returned entries by specifying the MaxResults parameter.
If the NextToken parameter is not returned in the response, no more data exists. Otherwise, more data exists. To query the next page, set the NextToken parameter of the SearchMultiAccountResources operation to the NextToken value returned in the previous response. If the NextToken parameter is not specified, the first page of data is returned by default.
You can narrow down the search scope by setting one or more filter conditions. For supported filter parameters and match types, see the following section. Multiple filter conditions are evaluated by using a logical AND. Only resources that meet all filter conditions are returned. Values within a single filter condition are evaluated by using a logical OR. Resources that meet any of the conditional filter values are returned.
You can obtain more query examples from OpenAPI Explorer.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

resourcecenter:SearchMultiAccountResources

list

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
Scope	string	Yes	The scope of accounts to search. Valid values: Resource directory ID: searches for resources across the management account and all member accounts. For more information, see GetResourceDirectory. Root folder ID: searches for resources across all member accounts in the Root folder and its subfolders. For more information, see ListFoldersForParent. Folder ID: searches for resources across all member accounts in the specified folder. For more information, see ListFoldersForParent. Member account ID: searches for resources in the specified member account. For more information, see ListAccounts.	rd-r4****
NextToken	string	No	The token for the next page of results. If the total number of results exceeds the MaxResults limit, the data is truncated. You can use NextToken to query the next page of data.	eyJzZWFyY2hBZnRlcnMiOlsiMTAwMTU2Nzk4MTU1OSJd****
MaxResults	integer	No	The maximum number of entries per page. Valid values: 1 to 100. Default value: 20.	10
Filter	array<object>	No	The filter conditions.
	object	No	The filter conditions.
Key	string	No	The key of the filter condition. For valid values, see `Supported filter parameters` below.	ResourceGroupId
MatchType	string	No	The match type. Set the value to Equals, which indicates an exact match.	Equals
Value	array	No	The values of the filter condition.
	string	No	The values of the filter condition.	rg-aekzmrjn4ns****
SortCriterion	object	No	The sorting parameter.
Key	string	No	The sorting criterion. Set the value to CreateTime, which indicates sorting by resource creation time.	CreateTime
Order	string	No	The sorting order. Valid values: ASC (default): ascending order. DESC: descending order.	ASC

Supported filter parameters

Parameter	Description	Supported match types
ResourceType	The resource type.	Equals
RegionId	The region ID.	Equals
ResourceId	The resource ID.	Equals, Prefix
ResourceGroupId	The resource group ID.	Equals, Exists, NotExists
ResourceName	The resource name.	Equals, Contains
Tag	The tag key-value pair. The JSON format is `{ "key": $key, "value": $value }`. At least one of key or value must be specified. For example, to query the tag key `foo` and tag value `bar`, pass `{ "key": "foo", "value": "bar" }`. To query only the tag key `foo`, pass `{ "key": "foo" }`.	Contains, NotContains, NotExists
VpcId	The VPC ID.	Equals
VSwitchId	The vSwitch ID.	Equals

Response elements

Element	Type	Description	Example
	object	The response parameters.
Filters	array<object>	The filter conditions.
	object	The filter conditions.
Key	string	The key of the filter condition.	RegionId
MatchType	string	The match type.	Equals
Values	array	The values of the filter condition.
	string	The values of the filter condition.	cn-hangzhou
MaxResults	integer	The maximum number of entries per page.	10
NextToken	string	The token for the next page of results.	The token for the next page of results
RequestId	string	The request ID.	EFA806B9-7F36-55AB-8B7A-D680C2C5EE57
Resources	array<object>	The resource information.
	array<object>	The resource information.
AccountId	string	The ID of the resource directory management account or member accounts in the resource directory.	151266687691****
CreateTime	string	The time when the resource was created. The time is displayed in ISO 8601 format, in UTC. The format is `yyyy-MM-ddTHH:mm:ssZ` or `yyyy-MM-ddTHH:mm:ss.SSSZ`. Note Whether this parameter is returned is determined by the cloud service to which the resource belongs.	2021-06-30T09:20:08Z
ExpireTime	string	The time when the resource expires. The time is displayed in ISO 8601 format, in UTC. The format is `yyyy-MM-ddTHH:mm:ssZ` or `yyyy-MM-ddTHH:mm:ss.SSSZ`.	2023-06-14T14:35:45Z
IpAddressAttributes	array<object>	The IP address attributes.
	object	The IP address attributes.
IpAddress	string	The IP address.	192.168.1.2
NetworkType	string	The network type. Valid values: Public: Internet. Private: Private network.	Public
Version	string	The IP address version.	Ipv4
IpAddresses	array	The IP addresses. Note Whether this parameter is returned is determined by the cloud service to which the resource belongs.
	string	The IP addresses. Note Whether this parameter is returned is determined by the cloud service to which the resource belongs.	192.168.1.2
RegionId	string	The region ID of the resource.	cn-hangzhou
ResourceGroupId	string	The resource group ID.	rg-acfmzawhxxc****
ResourceId	string	The resource ID.	vtb-bp11lbh452fr8940s****
ResourceName	string	The resource name.	group1
ResourceType	string	The resource type.	ACS::VPC::RouteTable
Tags	array<object>	The tags.
	object	The tags.
Key	string	The tag key.	test_key
Value	string	The tag value.	test_value
ZoneId	string	The zone ID. Note Whether this parameter is returned is determined by the cloud service to which the resource belongs.	cn-hangzhou-k
Scope	string	The scope of accounts to search. Valid values: Resource directory ID: searches for resources across the management account and all member accounts. Root folder ID: searches for resources across all member accounts in the Root folder and its subfolders. Folder ID: searches for resources across all member accounts in the specified folder. Member account ID: searches for resources in the specified member account.	rd-r4****

Examples

Success response

JSON format

{
  "Filters": [
    {
      "Key": "RegionId",
      "MatchType": "Equals",
      "Values": [
        "cn-hangzhou"
      ]
    }
  ],
  "MaxResults": 10,
  "NextToken": "eyJzZWFyY2hBZnRlcnMiOlsiMTAwMTU2Nzk4MTU1OSJd****",
  "RequestId": "EFA806B9-7F36-55AB-8B7A-D680C2C5EE57",
  "Resources": [
    {
      "AccountId": "151266687691****",
      "CreateTime": "2021-06-30T09:20:08Z",
      "ExpireTime": "2023-06-14T14:35:45Z",
      "IpAddressAttributes": [
        {
          "IpAddress": "192.168.1.2",
          "NetworkType": "Public",
          "Version": "Ipv4"
        }
      ],
      "IpAddresses": [
        "192.168.1.2"
      ],
      "RegionId": "cn-hangzhou",
      "ResourceGroupId": "rg-acfmzawhxxc****\t\n",
      "ResourceId": "vtb-bp11lbh452fr8940s****",
      "ResourceName": "group1",
      "ResourceType": "ACS::VPC::RouteTable",
      "Tags": [
        {
          "Key": "test_key",
          "Value": "test_value"
        }
      ],
      "ZoneId": "cn-hangzhou-k"
    }
  ],
  "Scope": "rd-r4****\n"
}

Error codes

HTTP status code	Error code	Error message	Description
400	NoPermission	You are not authorized to perform this operation.
400	InvalidParameter.MaxResults	The specified parameter MaxResults is not valid.	The MaxResults parameter is invalid.
400	MultiAccountServiceNotEnabled	Multi account ResourceCenter service is not enabled.
400	InvalidParameter.Filter.ResourceType	The specified parameter value of Filter.ResourceType is not valid.
400	InvalidParameter.Filter.CreateTime	The specified parameter Filter.n.CreateTime is not valid.	The specified parameter Filter.n.CreateTime is not valid.
400	InvalidParameter.Filter.IpAddress	The specified parameter Filter.n.IpAddress is not valid.	The specified parameter Filter.n.IpAddress is not valid.
400	InvalidParameter.Filter.Tag	The specified parameter Filter.n.Tag is not valid.	The specified parameter Filter.n.Tag is not valid.
403	NoPermission.AccountScope	The operator is not permitted for this account scope.	The operator is not permitted for this account scope.
404	NotExists.Resource	The specified resource does not exist.	The specified resource does not exist.
404	NotExists.ResourceDirectory	The resource directory for the account is not enabled.	No resource directory is enabled for the account.
404	NotExists.ResourceDirectory.FolderId	The specified folder does not exist.	The specified folder does not exist.
409	InvalidParameter.Scope	The Scope is invalid.
409	NoPermission.ResourceDirectory.MemberAccount	ResourceDirectory Member Account is not authorized to perform this operation.
409	InvalidParameter.SortCriterion.Key	The specified parameter SortCriterion.Key is not valid.
409	ExceedLimit.Filter	The maximum length of Filters is exceeded.	The number of objects specified in the Filter parameter exceeds the upper limit.
409	ServiceNotEnabled.SpecifiedAccount	ResourceCenter service of the specified account is not enabled.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.