Compliance

Querying all built-in policies

GET /v1/resource-manager/policy-definitions

rms:policyDefinitions:get

-

√

x

Querying a built-in policy

GET /v1/resource-manager/policy-definitions/{policy_definition_id}

rms:policyDefinitions:get

-

√

x

Modifying a rule

PUT /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}

rms:policyAssignments:update

-

√

x

Enabling a rule

POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/enable

rms:policyAssignments:update

-

√

x

Disabling a rule

POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/disable

rms:policyAssignments:update

-

√

x

Adding a rule

PUT /v1/resource-manager/domains/{domain_id}/policy-assignments

rms:policyAssignments:create

-

√

x

Querying all rules

GET /v1/resource-manager/domains/{domain_id}/policy-assignments

rms:policyAssignments:get

-

√

x

Querying a rule

GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}

rms:policyAssignments:get

-

√

x

Deleting a rule

DELETE /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}

rms:policyAssignments:delete

-

√

x

Querying the evaluation status of a rule

GET /v1/resource-manager/domains/{domain_id}/policy-states/evaluation-state

rms:policyStates:get

-

√

x

Querying the compliance results of a resource

GET /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/policy-states

rms:policyStates:get

-

√

x

Querying all compliance results of resources under a user

GET /v1/resource-manager/domains/{domain_id}/policy-states

rms:policyStates:get

-

√

x

Querying all compliance results of resources evaluated by a rule

GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states

rms:policyStates:get

-

√

x

Running a resource compliance evaluation

POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states/run-evaluation

rms:policyStates:runEvaluation

-

√

x

Updating evaluation results

PUT /v1/resource-manager/domains/{domain_id}/policy-states

rms:policyStates:update

-

√

x

Creating or updating an organization rule

PUT /v1/resource-manager/organizations/{organization_id}/policy-assignments

rms:organizationPolicyAssignments:put

• organizations:organizations:get
• organizations:accounts:list
• organizations:delegatedAdministrators:list
• organizations:trustedServices:enable
• organizations:trustedServices:list

√

x

Querying organization rules

GET /v1/resource-manager/organizations/{organization_id}/policy-assignments

rms:organizationPolicyAssignments:list

organizations:organizations:get

√

x

Querying a specific organization rule

GET /v1/resource-manager/organizations/{organization_id}/policy-assignments/{organization_policy_assignment_id}

rms:organizationPolicyAssignments:get

organizations:organizations:get

√

x

Querying statuses of organization rules

GET /v1/resource-manager/organizations/{organization_id}/policy-assignment-statuses

rms:organizationPolicyAssignments:list

organizations:organizations:get

√

x

Querying details about the rule statuses of each member account in an organization

GET /v1/resource-manager/organizations/{organization_id}/policy-assignment-detailed-status

rms:organizationPolicyAssignments:list

organizations:organizations:get

√

x

Deleting an organization rule

DELETE /v1/resource-manager/organizations/{organization_id}/policy-assignments/{organization_policy_assignment_id}

rms:organizationPolicyAssignments:delete

organizations:organizations:get

√

x

Adding or updating remediation configurations

PUT /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration

rms:policyAssignmentsRemediation:putRemediationConfiguration

• iam:agencies:pass
• iam:agencies:createServiceLinkedAgencyV5

√

x

Querying remediation configurations

GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration

rms:policyAssignmentsRemediation:getRemediationConfiguration

-

√

x

Deleting remediation configurations

DELETE /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration

rms:policyAssignmentsRemediation:deleteRemediationConfiguration

-

√

x

Batch adding remediation configurations

POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception/create

rms:policyAssignmentsRemediation:createRemediationExceptions

-

√

x

Batch deleting remediation configurations

POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception/delete

rms:policyAssignmentsRemediation:deleteRemediationExceptions

-

√

x

Querying remediation exceptions

GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception

rms:policyAssignmentsRemediation:listRemediationExceptions

-

√

x

Running remediation execution

POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution

rms:policyAssignmentsRemediation:runRemediation

• functiongraph:function:invokeAsync
• functiongraph:function:getFunctionConfig
• rf:stack:create
• rf:stack:delete
• rf:stack:getTemplate
• rf:stack:getMetadata
• rf:privateTemplate:showMetadata

√

x

Viewing remediation execution results

GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution-statuses

rms:policyAssignmentsRemediation:listRemediationExecutionStatuses

-

√

x

Listing remediation records

POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution-statuses/summary

rms:policyAssignmentsRemediation:listRemediationExecutionStatuses

-

√

x