# Cross Account Inventory Compare

> Query the same AWS resource type (EC2, RDS, VPC, subnets, security

- **Type:** Skill
- **Install:** `agentstack add skill-aws-samples-sample-skills-for-aws-devops-agent-cross-account-inventory-compare`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [aws-samples](https://agentstack.voostack.com/s/aws-samples)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [aws-samples](https://github.com/aws-samples)
- **Source:** https://github.com/aws-samples/sample-skills-for-AWS-Devops-agent/tree/main/devops-agent-cn-management/cross-account-inventory-compare

## Install

```sh
agentstack add skill-aws-samples-sample-skills-for-aws-devops-agent-cross-account-inventory-compare
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Cross-Account Resource Inventory & Comparison

Routing behavior (endpoint ↔ region mapping, disambiguation rules, output
labeling) is governed by the `china-region-multi-account-routing` skill;
this skill assumes that routing is already in effect and focuses on
**how to query, correlate, and diff resources across both accounts**.

## When to use

Use this skill whenever the user's intent requires data from both China
region accounts and a comparative or unified view of that data. Examples:

- "对比两个账号的 VPC CIDR"
- "两个中国区账号各自有几个 EC2 在跑"
- "北京账号有没有和宁夏同名的 security group"
- "哪些 S3 bucket 只在一个账号里存在"
- "两边的 IAM role 一致吗"

Do **not** use this skill when the user asks about a single explicitly-named
account ("查宁夏的 EC2") — that is single-account inventory, not comparison.

## Procedure

### Step 1 — Identify the resource type and scope

Parse the user's request to extract:
- **Resource type** (EC2 instance, RDS DB, VPC, S3 bucket, IAM role, …)
- **Scope** (全部 / 运行中 / 某 tag / 某 name prefix / 某 region)
- **Comparison key** (name, tag `Name`, ID, ARN, configuration field)

If any of these is ambiguous, ask one clarifying question before proceeding.

### Step 2 — Run the equivalent describe/list on both endpoints in parallel

Call the same AWS API on both `aws-cn` and `aws-cn-2` MCP endpoints
concurrently (not sequentially). Use the narrowest filter the user's
request allows — avoid listing all resources of a type if a tag or name
filter works.

Examples:
- EC2: `aws ec2 describe-instances --filters Name=instance-state-name,Values=running`
- RDS: `aws rds describe-db-instances`
- VPC: `aws ec2 describe-vpcs`
- S3:  `aws s3api list-buckets` (plus `get-bucket-location` per bucket
       since S3 is regional in China)
- IAM: `aws iam list-roles` (partition-wide, same per account)

### Step 3 — Correlate across accounts

Match resources across the two accounts using the comparison key from
Step 1. Partition the results into three buckets:

1. **Only in aws-cn** — present in Ningxia, absent in Beijing
2. **Only in aws-cn-2** — present in Beijing, absent in Ningxia
3. **In both** — present in both accounts (matched by key)

For bucket 3, surface any **configuration differences** the user asked
about (e.g., different CIDRs, different instance types, different tags).

### Step 4 — Present the diff

Use a table when comparing configuration:

| Resource (by name) | aws-cn (Ningxia) | aws-cn-2 (Beijing) |
|--------------------|------------------|--------------------|
| `prod-web-sg`      | `0.0.0.0/0:443` allowed | `0.0.0.0/0:443` allowed |
| `prod-db-sg`       | exists            | **missing**        |

Use grouped sections when listing disjoint sets:

```
### Only in aws-cn (Ningxia)
- i-0aaa... (t3.medium)
- i-0bbb... (t3.small)

### Only in aws-cn-2 (Beijing)
- i-0xxx... (t3.large)

### In both
(none, or list matched pairs)
```

### Step 5 — Summarize findings

End the response with 1–3 sentences of interpretation: is the drift
expected (e.g. DR-style asymmetry) or unexpected (e.g. missing resource)?
Do not remediate — this skill is read-only analysis.

## Things not to do

- **Do not** assume two resources with the same name are "the same" — they
  are different AWS resources in different accounts. Say "matched by name"
  or "matched by tag X", never "the same resource".
- **Do not** silently drop resources from one side if the API fails on
  that side. If `aws-cn-2` returned an error, report "aws-cn-2: failed
  with " and still show aws-cn's data — do not pretend aws-cn-2
  has no resources.
- **Do not** iterate sequentially on the two accounts when parallel is
  possible. Users expect one round-trip latency, not two.
- **Do not** reformat IDs or ARNs when presenting — they need to be
  copy-pasteable back into AWS CLI.

## Examples

**Input**: "对比两个账号的 VPC CIDR"

**Action**: Parallel `aws ec2 describe-vpcs` on both. Extract `CidrBlock`
and `Tags[Name]` per VPC. Match by tag `Name`. Output:

| VPC Name  | aws-cn (Ningxia) | aws-cn-2 (Beijing) |
|-----------|------------------|--------------------|
| `default` | `172.31.0.0/16`  | `172.31.0.0/16`    |
| `prod`    | `10.0.0.0/16`    | `10.1.0.0/16`      |
| `dev`     | `10.10.0.0/16`   | — (absent)         |

Summary: "aws-cn-2 is missing the `dev` VPC; `default` overlaps (expected,
both accounts use AWS's default). `prod` CIDRs are distinct (no overlap,
safe to peer later if needed)."

**Input**: "两个账号各自多少个 running EC2"

**Action**: Parallel `describe-instances --filters state=running`. Output
just counts plus instance IDs:

```
aws-cn (Ningxia):   3 running — i-0a, i-0b, i-0c
aws-cn-2 (Beijing): 1 running — i-0x
```

**Input**: "哪些 IAM role 只存在于宁夏账号，北京账号没有"

**Action**: Parallel `aws iam list-roles` on both. Compute set difference.
Output:

```
### Only in aws-cn (Ningxia) — 2 roles
- mcp-pod-reader
- eks-node-group-extra

### Only in aws-cn-2 (Beijing) — 0 roles

### In both — 14 roles
(not listed unless requested)
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [aws-samples](https://github.com/aws-samples)
- **Source:** [aws-samples/sample-skills-for-AWS-Devops-agent](https://github.com/aws-samples/sample-skills-for-AWS-Devops-agent)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-aws-samples-sample-skills-for-aws-devops-agent-cross-account-inventory-compare
- Seller: https://agentstack.voostack.com/s/aws-samples
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.