Config
Config
All results for "
" in this service
All results for "
" in this service
What's New
Service Overview
Config Infographics
What Is Config?
Function Overview
Billing
Permissions
Basic Concepts
Relationships with Other Services
Constraints and Limitations
Getting Started
User Guide
Resource List
Viewing Resources
Querying All Resources
Querying Details About a Resource
Filtering Resources
Exporting the Resource List
Viewing Resource Compliance Data
Viewing Resource Relationships
Viewing Resource Changes
Resource Recorder
Overview
Configuring the Resource Recorder
Notifications
Storing Resource Snapshots
Storing Resource Change Notifications
Resource Compliance
Rules
Adding a Predefined Rule
Adding a Custom Rule
Viewing a Rule
Triggering a Rule
Editing a Rule
Example Custom Rules
Example Functions (Python)
Events
Organization Rules
Adding a Predefined Organization Rule
Viewing an Organization Rule
Modifying an Organization Rule
Deleting an Organization Rule
Viewing Noncompliant Resources
Compliance Rule Concepts
Policy
Rule
Evaluation Results
Built-In Policies
Predefined Policy List
General Policies
Resource Names Meet Regular Expression Requirements
Resources Are Attached with All the Specified Tags
Resources Are Attached with One of the Specified Tags
Tag Prefixes and Suffixes Check
A Resource Is Attached with at Least One Tag
Resource Tag Check
Resources Are in Specified Enterprise Projects
Resources Are in Specified Regions
Resource Type Check by Specifying Allowed Resource Types
Resource Type Check by Specifying Unallowed Resource Types
API Gateway (APIG)
Dedicated API Gateways Have an Authorization Type Set
Dedicated API Gateways Have Logging Enabled
Dedicated API Gateways Use SSL certificates
CodeArts
Clusters Are Available
Project Parameter Encryption Check
MapReduce Service (MRS)
MRS Clusters Are Attached with Specified Security Groups
MRS Clusters Are in Specified VPSs
MRS Clusters Have Kerberos Enabled
MRS Clusters Support Multi-AZ Deployment
MRS Clusters Have No Public IPs Attached
NAT Gateway
Private NAT Private Gateways Are in Specified VPCs
VPC Endpoint (VPCEP)
VPC Endpoint Check for Specified Services
Web Application Firewall (WAF)
WAF Instances Are Attached with Protection Policies
WAF Protection Policies Are Not Empty
Elastic Load Balance (ELB)
Elastic load balancers do not have public IP addresses attached.
ELB Listeners Have Specified Security Policies Added
ELB Listeners Are Configured with HTTPS
Weight Check for Backend Servers
HTTPS Redirection Check
Single-AZ Load Balancer Check
Elastic IP (EIP)
Bandwidth Check
Idle Elastic IP Check
Elastic IPs Attached Within a Given Time
Auto Scaling (AS)
Priority Policy Check
AS Groups Are Associated with an Elastic Load Balancer that Uses Health Check
Multi-AZ Deployment Has Been Configured
IPV6 Bandwidth Check
Scalable File Service (SFS)
Encryption Check
SFS Turbo Systems Are Associated with Backup Vaults
Elastic Cloud Server (ECS)
Flavor Check
Image Check by ID
Image Check by Tag
Security Group Check by ID
VPC Check by ID
Login Mode Check
ECSs Cannot Be Accessed Through Public Networks
An ECS Does Not Have Multiple IPs Attached
Idle ECS Check
All ECSs Are Attached with at Leat One IAM Agency
Image Check
ECSs Are Attached with Backup Vaults
Distributed Cache Service (DCS)
DCS Memcached Instances Support SSL
DCS Memcached Instances Are in a Specified VPC
DCS Memcached Instances Do Not Have Public IPs Attached
Access Mode Check
DCS Redis Instances Support SSL
Cross-AZ Deployment Check
DCS Redis Instances Are in the Specified VPC
DCS Redis Instances Do Not Have Public IPs Attached
Access Mode Check
FunctionGraph
Concurrency Check
Functions Are in the Specified VPC
Public Access Check
Basic Configuration Check
Content Delivery Network (CDN)
CDN Uses HTTPS Certificates
Origin Protocol Policy Check
TLS Version Check
Certificate Source Check
Data Warehouse Service (DWS)
KMS Encryption Check
DWS Clusters Have Enabled Audit Log Dumps
DWS Clusters Have Enabled Automated Snapshots
DWS Clusters Use SSL
DWS Clusters Are Not Attached with Any Public IPs
O&M Time Window Check
Data Replication Service (DRS)
Network Type Check for DR Tasks
Network Type Check for Migration Tasks
Network Type Check for Synchronization Tasks
Data Encryption Workshop (DEW)
Key Status Check
Key Rotation Has Been Enabled
CSMS Secretes Are Rotated
Identity and Access Management (IAM)
Key Rotation Check
No Blocked Actions on KMS Keys
Each User Group Has at Least One User
Password Policy Check
Unintended Policy Check
Admin Permissions Check
Custom Policies Do Not Allow All Actions for a Service
The Root Access Key Is Unavailable
Access Mode Check
Access Key Creation Check
IAM Users Are in at Least One User Group
Last Login Check
Multi-Factor Authentication Check
A User Does Not have Multiple Active Access Keys
MFA Has Been Enabled for Console Login
MFA Has Been Enabled for the Root Account
All IAM Policies Are in Use
All IAM Roles Are in Use
Login Protection Check
Document Database Service (DDS)
SSL Has Been Enabled
Instance Type Check
DDS Instances Do Not Have Public IPs
Simple Message Notification (SMN)
Log Reporting to LTS Has Been Enabled
Virtual Private Cloud (VPC)
Unused ACL Check
Default Security Group Check
VPCs Have Enabled Flow Logs
Security Groups Only Allow Traffic Over Some Ports
Ports Have Addresses Restricted
SSH Check
All Accessible Ports Are Whitelisted
A Security Group is Associated with Elastic Network Interfaces
Virtual Private Network (VPN)
Connection State Check
Cloud Eye
Alarm Rules Are Enabled
Alarm Rules Have Been Created For KMS Events
Alarm Rules Have Been Created for OBS Bucket Policy Changes
An Alarm Rule Has Been Created for the Specified Metric
Alarm Rule Configurations Check
Alarm Rules Have Been Created for VPC Changes
Cloud Container Engine (CCE)
End of Maintenance Check
Oldest Supported Version Check
CCE Clusters Are Not Publicly Accessible
Flavor Check
Cloud Trace Service (CTS)
CTS Trackers Are Encrypted
Log Transfer to LTS Is Enabled
Trackers Have Been Created for the Specified OBS Bucket
Trace File Verification Is Enabled
At Least One Tracker Has Been Created
There Are Trackers In the Specified Regions
CTS Trackers Comply with Security Best Practices
Relational Database Service (RDS)
GaussDB Instances Are in the Specified VPC
Single-AZ Cluster Check
GaussDB NoSQL Backup Check
GaussDB NoSQL Instances Use Disk Encryption
Error Log Collection Is Enabled for GaussDB NoSQL Instances
GaussDB NoSQL Instances Support Slow Query Log Collection
Audit Logs Are Collected for GaussDB Instances
Automated Backup Is Enabled
Error Log Collection Is Enabled for GaussDB Instances
GaussDB Instances Support Slow Query Log Collection
Audit Logs Are Collected for GaussDB for MySQL Instances
Backup Is Enabled for GaussDB for MySQL Instances
Error Log Collection Is Enabled for GaussDB for MySQL Instances
GaussDB for MySQL Support Slow Query Log Collection
Error Log Collection Is Enabled for RDS Instances
Error Log Collection Is Enabled for RDS Instances
RDS Instances Support Slow Query Logs
Single-AZ Cluster Check
RDS Instances Do Not Have Public IPs
RDS Instances Use KMS Encryption
RDS Instances Are in the Specified VPC
Both Error Logs and Slow Query Logs Are Collected for RDS Instances
Flavor Check
Cloud Search Service (CSS)
CSS Clusters Use Authority Verification
The Snapshot Function Is Enabled for CSS Clusters
Disk Encryption Is Enabled for CSS Clusters
HTTPS Access Is Enabled for CSS Clusters
CSS Clusters Are in Specified VPCs
Single-AZ CSS Cluster Check
A CSS Cluster Has at Least Two Instances
CSS Clusters Are Not Publicly Accessible
Security Mode Is Enabled for CSS Clusters
CSS Clusters Cannot Be Accessed by All Public IPs
Kibana Cannot Be Accessed by All Public IPs
Elastic Volume Service (EVS)
EVS Disk Type Check
Disks Are Used Within the Specified Time
Idle EVS Disk Check
EVS Disks Are Encrypted
Disk Encryption Are Enabled
EVS Disks Are Attached with Backup Vaults
Cloud Certificate Manager (CCM)
Expiration Check for Private CAs
Expiration Check for Private Certificates
Distributed Message Service (for Kafka)
SSL Is Required for DMS Kafka Access over Private Networks
SSL Is Required for DMS Kafka over Public Networks
DMS Kafka Instances Are Not Publicly Accessible
Distributed Message Service ( for RabbitMQ)
SSL Is Enabled for DMS RabbitMq Instances
Distributed Message Service (for RocketMQ)
SSL Is Enabled for DMS Reliability Instances
Organizations
The Current Account Has Been Added to an Organization
Cloud Firewall (CFW)
CFW Instances Are Attached with Protection Policies
Event Monitoring
Conformance Packages
Overview
Conformance Packages
Creating a Conformance Package
Viewing Conformance Packages and Compliance Data
Modifying a Conformance Package
Deleting a Conformance Package
Organization Conformance Packages
Creating an Organization Conformance Package
Viewing an Organization Conformance Package
Modifying an Organization Conformance Package
Deleting an Organization Conformance Package
Custom Conformance Packages
Conformance Package Templates
Overview
Compliance Package for Classified Protection of Cybersecurity Level 3 (2.0)
Conformance Package for the Financial Industry
Conformance Package for Network Security
Conformance Package for Identity and Access Management
Conformance Package for Cloud Eye
Conformance Package for Compute Services
Conformance Package for ECS
Conformance Package for ELB
Conformance Package for Management and Regulatory Services
Conformance Package for RDS
Conformance Package for AS
Conformance Package for CTS
Conformance Package for AI and Machine Learning
Conformance Package for Autopilot
Conformance Package for for Enabling Public Access
Conformance Package for Logging and Monitoring
Conformance Package for Idle Asset Management
Conformance Package for Architecture Reliability
Conformance Package for Hong Kong Monetary Authority of China Requirements
Conformance Package for ENISA Requirements
Compliance Package for SWIFT CSP
Compliance Package for Germany Cloud Computing Compliance Criteria Catalogue
Compliance Package for PCI DSS
Conformance Package for Healthcare Industry
Best Practices of Network and Data Security
Conformance Package for Landing Zone
Advanced Queries
Overview
Restrictions
Creating a Custom Query
Viewing a Query
Modifying a Custom Query
Deleting a Query
Resource Aggregation
Overview
Restrictions
Creating a Resource Aggregator
Viewing Resource Aggregators
Editing an Aggregator
Deleting a Resource Aggregator
Viewing Aggregated Rules
Viewing Aggregated Resources
Authorizing an Aggregator Account
Advanced Queries
Cloud Trace Service
Supported Config Operations
Querying Real-Time Traces
Appendix
Supported Services and Regions
Relationships with Supported Resources
Supported Services and Resources
Notification Models
Resource Change Notification Model
Resource Relationship Change Notification Model
Resource Snapshot Storage Notification Model
Notification Model of Resource Change Notification Storage
Storage Models
Resource Snapshot Storage Model
Storage Model of Resource Change Notifications
DSL Syntax
Logical Operators
Conditions
Expressions
ResourceQL Syntax
Overview
Syntax
Functions
API Reference
Before You Start
Introduction
API Calling
Endpoints
Concepts
Querying Data by Page
API Overview
Calling APIs
Making an API Request
Authentication
Response
APIs
Resource Query
Querying Resources of a Specific Type
Listing Cloud Services
Querying a Resource
Listing Resources Recorded by the Resource Recorder
Querying how many resources are recorded by the resource recorder
Querying resource tags recorded by the resource recorder
Querying resource overview recorded by the resource recorder
Querying a specific resource recorded by the resource recorder
Querying All Resources Under Your Account
Querying a Resource Under Your Account
Querying Resource Tags
Querying the Number of Resources
Querying a Resource Summary
Resource Recorder
Querying the Resource Recorder
Deleting the Resource Recorder
Creating or Modifying the Resource Recorder
Resource Relationships
Querying Resource Relationships
Querying Details About Resource Relationships
Resource Change Records
Querying Change Records of a Resource
Compliance
Querying All Built-in Policies
Querying a Built-in Policy
Adding a Rule
Querying All Rules
Modifying a Rule
Querying a Rule
Deleting a Rule
Enabling a Rule
Disabling a Rule
Running a Resource Compliance Evaluation
Querying the Evaluation Status of a Rule
Querying the Compliance Results of a Resource
Querying All Compliance Results of Resources Evaluated by a Rule
Querying All Compliance Results of Resources Under a User
Updating the Compliance Result
Creating an Organization Rule
Querying Organization Rules
Querying a Specific Organization Rule
Deleting an Organization Rule
Updating an Organization Rule
Querying Statuses of Organization Rules
Querying Details About the Rule Statuses of Each Member Account in an Organization
Setting up or Updating Remediation Configurations
Querying Remediation Configurations
Deleting Remediation Configurations
Batch Creating Remediation Exceptions
Batch Deleting Remediation Exceptions
Querying Remediation Exceptions
Starting Remediation
Querying Remediation Results
Collect Remediation Results
Region Management
Querying Regions Visible to You
Advanced Queries
Running Advanced Queries
Creating an Advanced Query
Listing Advanced Queries
Querying an Advanced Query
Updating an Advanced Query
Deleting an Advanced Query
Querying Schemas
Resource Aggregators
Creating a Resource Aggregator
Querying Resource Aggregators
Querying a Specific Resource Aggregator
Querying the Status of a Specific Resource Aggregator Account
Updating a Resource Aggregator
Deleting a Resource Aggregator
Authorizing a Resource Aggregator Account
Querying Authorized Resource Aggregators Accounts
Deleting Authorization for a Resource Aggregator Account
Querying All Pending Aggregation Requests
Deleting Pending Authorization Requests
Querying the Number of Resources of a Resource Aggregator Account
Querying Resources of a Resource Aggregator Account
Querying Details About a Specific Resource in a Source Account
Performing an Advanced Query on a Specific Aggregator
Querying the Compliance Summary of One or More Source Accounts in an Aggregator
Querying Aggregated Rules
Querying Compliance Results of Aggregated Resources
Querying Details About a Specified Aggregated Rule
Conformance Packages
Querying Conformance Packages
Creating a Conformance Package
Querying a Conformance Package
Deleting a Conformance Package
Updating Conformance Packages
Querying the Compliance Results of Conformance Packages
Querying the Compliance Results of Rules in a Conformance Package
Querying the Details about Compliance Results of Resources Evaluated by Rules in a Conformance Package
Querying Scores of Conformance Packages
Querying Built-in Conformance Package Templates
Querying a Built-in Conformance Package Template
Creating organization conformance packages.
List organization conformance packages.
View organization conformance packages.
Delete organization conformance packages.
Updating Organization Conformance Packages
View deployment status of organization conformance packages.
View deployment status of an organization conformance package.
Resource Tags
Querying Resources
Querying Resource Statistics
Batch Adding Resource Tags
Batch Deleting Resource Tags
Querying Resource Tags
Querying Resource Tags by Project
Permissions Policies and Supported Actions
Permissions Policies and Supported Actions
Resource List
Resource Recorder
Resource Compliance
Advanced Queries
Resource Aggregation
Conformance Packages
Resource Tag
Appendixes
Error Codes
Supported Services and Resource Types
Obtaining an Account ID
Status Codes
Obtaining a Project ID
Change History
SDK Reference
SDK Overview
FAQs
Resource List
Resource Compliance
Resource Recorder
General Reference
Glossary
Service Level Agreement
White Papers
Endpoints
Permissions