baiducloud-vpc-inventory-audit

Baidu AI Cloud VPC Asset and Topology Inspection

Recommended questions

• "Help me inventory all VPCs, subnets, and related network resources in the bj region."
• "Map out the subnet, route table, security group, ACL, and elastic network interface association topology of this VPC."
• "Check the subnet address ranges, available IP headroom, and whether CIDR block overlaps exist in each VPC."
• "Help me find dangling, missing, or abnormally associated network resources in the VPC."
• "Verify whether the current account has complete VPC read-only inventory permissions, and report query coverage."

Adhere to the read-only boundary

• Execute only HTTPS GET requests as well as local file reads and report generation.
• Prohibit execution of POST、PUT、PATCH、DELETE; prohibit calling cloud APIs or SDK methods whose names contain create, update, delete, bind, unbind, attach, detach, authorize, revoke, or operate.
• Do not relax restrictions because the user account has higher privileges.
• Output only findings, evidence, and manual remediation recommendations; do not implement remediation.
• Do not write AK, SK, or STS Token into command parameters, logs, reports, or the Skill package.

Execution workflow

1. Confirm the inspection region. If the region is missing, ask first; do not guess the region or scan all regions.

2. Read RAM permissions. Prefer requiring sub-users or STS temporary credentials to be bound to the official read-only system policy.

3. Read API and field descriptions, and confirm the regional Endpoint and collection scope.

4. Check the environment variable BCE_ACCESS_KEY_ID、BCE_SECRET_ACCESS_KEY; when using STS, also check BCE_SESSION_TOKEN. Do not echo variable values. If the execution environment cannot securely inherit variables, you may create a JSON file outside the Skill directory that is readable only by the current user, with fields accessKeyId、secretAccessKey and optional sessionToken, execute chmod 600 and then specify it via --credentials-file ; do not put credential values into command parameters.

5. Run the collection script. Set the output directory outside the Skill directory:

   python3 scripts/vpc_inventory_audit.py \
     --regions bj,gz \
     --output-dir /absolute/path/to/audit-output
   

   When using a restricted credential file:

   python3 scripts/vpc_inventory_audit.py \
     --credentials-file /absolute/path/to/credentials.json \
     --regions bj \
     --output-dir /absolute/path/to/audit-output
   

6. If the user only provides exported JSON, use offline mode:

   python3 scripts/vpc_inventory_audit.py \
     --input /absolute/path/to/inventory.json \
     --output-dir /absolute/path/to/audit-output
   

7. First check the "collection coverage" in the report. When any resource type query fails, mark the conclusion as incomplete, and do not interpret "not queried" as "resource does not exist".

8. According to audit rules, review script findings and distinguish confirmed anomalies, possible anomalies, and information gaps.

9. Return to the user: inspection scope, collection coverage, resource summary, topology relationships, findings, evidence, limitations, and follow-up manual recommendations.

Output requirements

• Treat inventory.json as the machine-readable raw snapshot, and report.md as the user-facing inspection report.
• For each finding, provide the region, VPC ID, related resource ID, rule number, and evidence field.
• Do not send resource names, private IPs, CIDRs, or account network topology to external services not authorized by the user.
• When the report is empty, state that "no issues were found within the successfully queried scope"; do not claim that the entire account has no issues.

Failure handling

• 401: Prompt to check the AK/SK, STS Token, and system time; do not ask the user to paste keys into the conversation.
• 403: List the failed resource types and the required read-only system policies; retain other successful results.
• 404: Verify the regional Endpoint and API version; do not switch to write APIs to probe.
• 429 or 5xx: Allow the script to retry with backoff using the same GET request; the request method must not be changed.
• When querying the core VPC list in a single region fails, mark that region as failed; do not generate a false empty topology.

Local verification

Use the examples included with the package to verify analysis and report generation without accessing the cloud environment:

python3 scripts/vpc_inventory_audit.py --self-test
python3 scripts/vpc_inventory_audit.py \
  --input examples/sample-inventory.json \
  --output-dir /tmp/baiducloud-vpc-inventory-audit