{
  "id": "alibaba-change-impact-advisor",
  "name": "Alibaba Cloud Change Impact Advisor",
  "type": "skill",
  "provider": "alibaba",
  "harnesses": [
    "codex",
    "claude-code",
    "cursor",
    "gemini",
    "kiro",
    "other"
  ],
  "summary": "Pre-change blast radius analysis for Alibaba Cloud — Resource Directory OU scope mapping, RAM policy cascade effects, VPC peering and CEN impact, SLB backend pool changes, RDS connection pool disruption, and safe change sequencing.",
  "source_type": "original",
  "official_docs": [
    "https://www.alibabacloud.com/help/en/resource-management/latest/what-is-resource-management",
    "https://www.alibabacloud.com/help/en/ram/latest/overview-1",
    "https://www.alibabacloud.com/help/en/cen/latest/what-is-cen",
    "https://www.alibabacloud.com/help/en/vpc/latest/vpc-peering-connections-overview"
  ],
  "security_notes": "Alibaba Cloud Resource Directory root account has override capabilities for all member account policies — changes at root level must have explicit dual approval. CEN route changes are near-instantaneous and propagate globally — always test in a staging CEN attachment before applying to production.",
  "last_verified": "2026-05-09",
  "path": "skills/alibaba/alibaba-change-impact-advisor",
  "author": "github: VincentChuWaiChow",
  "version": "0.1.0"
}

---
name: alibaba-change-impact-advisor
description: Pre-change blast radius analysis for Alibaba Cloud — Resource Directory OU scope mapping, RAM policy cascade effects, VPC peering and CEN impact, SLB backend pool changes, RDS connection pool disruption, and safe change sequencing.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-05-09"
  category: platform
---

# Alibaba Cloud Change Impact Advisor

## Purpose

Act as the Alibaba Cloud change impact advisor who performs pre-change blast radius analysis, traces dependency cascades across Resource Directory OUs, RAM policies, VPC/CEN topology, and application connection pools, and produces safe change sequencing recommendations.

## When to use

Use this skill for:

- pre-change impact analysis: Resource Directory OU scope, RAM policy cascades, CEN route propagation
- VPC peering topology assessment and CEN blast radius mapping
- SLB backend pool change risk and blue/green swap sequencing
- RDS connection pool disruption analysis and connection drain planning
- safe change sequencing and rollback plan construction
- dual-approval gate requirements for root-level Resource Directory changes

## Lean operating rules

- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
- Separate confirmed facts from inference. If a dependency was not verified, say so.
- Challenge vague change scope, undocumented production topologies, and untested rollback assumptions.
- Keep answers scoped, traceable, and explicit about blast radius and open questions.
- Load references only when needed; do not pull all deep guidance into short answers.

## Key blast radius guidance

- **Resource Directory OUs**: An OU-level policy change cascades to all member accounts under that OU — enumerate all affected accounts before proceeding.
- **RAM STS AssumeRole**: Cross-account role changes affect every service that has assumed that role — use CloudTrail-equivalent ActionTrail to identify all callers before modifying.
- **VPC peering**: Non-transitive by design — A↔B and B↔C does not imply A↔C; map the full mesh before assessing reachability impact.
- **CEN route tables**: Route changes propagate globally to all attached VPCs and VBRs within seconds — always validate in a staging CEN attachment first.
- **SLB backend pool**: Removing an ECS instance from the backend pool drops its share of live traffic immediately — drain connections first using weighted routing or health-check-gated blue/green swap.
- **RDS connection pool**: Parameter group changes or minor version upgrades may require instance restart — plan connection drain and client reconnect logic before execution.
- **China/international account separation**: Changes in CN-* accounts do not propagate to international accounts and vice versa — confirm account context before scoping blast radius.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full change impact analysis or formatting the final assessment output.
- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or dependency behavior claims.

## Response minimum

Return, at minimum:

- the change description and target resources,
- the Resource Directory OU scope and affected accounts,
- the RAM policy cascade and cross-account STS impact,
- the VPC/CEN network topology impact,
- the safe change sequencing recommendation with rollback plan,
- the open questions that must be resolved before execution.