alibabacloud-oss-cross-account-auth-diagnosisv0.0.1

A partner or company account reports AccessDenied when reading a bucket owned by another Alibaba Cloud account. The skill inspects GetBucketInfo to confirm the caller UID differs from the bucket owner UID, checks whether a Bucket Policy exists via GetBucketPolicy, and attributes the failure to a trust-policy gap, RAM policy scope issue, or missing dual-grant.

An OSS Cross-Region Replication (CRR) rule keeps failing with NoPermission because the replication role's trust policy or the destination bucket policy is incomplete. The skill diagnoses the trust policy and bucket policy combination and emits ready-to-apply authorization templates without modifying live resources.

A peer account attempts to assume a RAM role to access OSS but receives an 'AssumeRole not authorized' error. The skill routes the failure to the correct trust-policy, caller-identity, or dual-grant attribution, verifies the service principal, and provides a corrected trust-policy template for manual application.

A company is migrating data between Alibaba Cloud accounts and migration tooling is blocked by authorization errors. The skill identifies whether the blocker is a RAM-policy resource-granularity mistake, a missing bucket policy, or a trust-policy gap, and outputs the exact RAM and bucket policy templates needed to unblock the migration.

An OSS error response contains an EncodedDiagnosticMessage that hides the actual cross-account authorization cause. The skill decodes the diagnostic evidence, correlates it with GetBucketInfo/GetBucketPolicy facts, and attributes the denial to a trust-policy, RAM-policy, or Bucket-Policy+RAM dual-grant root cause without fabricating conclusions.

Cloud service providers or MSPs offer this skill as a read-only diagnostic capability within a managed OSS support portal. It reduces the mean time to resolution for cross-account authorization tickets by automatically attributing the root cause and generating templates, while guaranteeing no configuration changes are made.

Large enterprises with multiple Alibaba Cloud accounts deploy this skill internally so application teams can self-diagnose cross-account access and replication authorization issues without raising tickets to the cloud platform team. It enforces read-only safety and standardizes authorization templates across the organization.

The skill is published in an AI agent skill marketplace or cloud vendor's agent ecosystem, where customers integrate it into their own AIOps assistants. It adds specialized OSS cross-account authorization reasoning that is otherwise missing from generic cloud agents.