Predefined Policy List

You can use predefined policies to create rules on the Config console.

The following table lists predefined policies provided by Config.

**Table 1** Predefined policies
Service	Policy	Triggered By	Object
General policies	Resource Names Meet Regular Expression Requirements	Configuration change	All resources
	Resources Are Attached with All the Specified Tags	Configuration change	Supported Services and Resources
	Resources Are Attached with One of the Specified Tags	Configuration change	Supported Services and Resources
	Tag Prefixes and Suffixes Check	Configuration change	Supported Services and Resources
	A Resource Is Attached with at Least One Tag	Configuration change	Supported Services and Resources
	Resource Tag Check	Configuration change	Supported Services and Resources
	Resources Are in Specified Enterprise Projects	Configuration change	All resources
	Resources Are in Specified Regions	Configuration change	All resources
	Resource Type Check by Specifying Allowed Resource Types	Configuration change	All resources
	Resource Type Check by Specifying Unallowed Resource Types	Configuration change	All resources
API Gateway (APIG)	Dedicated API Gateways Have an Authorization Type Set	Configuration change	apig.instances
	Dedicated API Gateways Have Logging Enabled	Configuration change	apig.instances
	Dedicated API Gateways Use SSL certificates	Configuration change	apig.instances
CodeArts Deploy	CodeArts Clusters Are Available	Configuration change	codeartsdeploy.host-cluster
MapReduce Service (MRS)	MRS Clusters Are Attached with Specified Security Groups	Configuration change	mrs.mrs
	MRS Clusters Are in Specified VPSs	Configuration change	mrs.mrs
	MRS Clusters Have Kerberos Enabled	Configuration change	mrs.mrs
	MRS Clusters Support Multi-AZ Deployment	Configuration change	mrs.mrs
	MRS Clusters Have No Public IPs Attached	Configuration change	mrs.mrs
NAT Gateway	Private NAT Private Gateways Are in Specified VPCs	Configuration change	nat.privateNatGateways
VPC Endpoint (VPCEP)	VPC Endpoint Check for Specified Services	Periodic	vpcep.endpoints
Web Application Firewall (WAF)	WAF Instances Are Attached with Protection Policies	Configuration change	waf.instance
Web Application Firewall (WAF)	WAF Protection Policies Are Not Empty	Configuration change	waf.policy
ELB	Elastic load balancers do not have public IP addresses attached.	Configuration change	elb.loadbalancers
	ELB Listeners Have Specified Security Policies Added	Configuration change	elb.loadbalancers
	ELB Listeners Are Configured with HTTPS	Configuration change	elb.loadbalancers
	Weight Check for Backend Servers	Configuration change	elb.members
Elastic IP (EIP)	Bandwidth Check	Configuration change	vpc.publicips
	Idle Elastic IP Check	Configuration change	vpc.publicips
	Elastic IPs Attached Within a Given Time	Periodic	vpc.publicips
Auto Scaling (AS)	Priority Policy Check	Configuration change	as.scalingGroups
	AS Groups Are Associated with an Elastic Load Balancer that Uses Health Check	Configuration change	as.scalingGroups
	Multi-AZ Deployment Has Been Configured	Configuration change	as.scalingGroups
Scalable File Service (SFS)	Encryption Check	Configuration change	sfsturbo.shares
Elastic Cloud Server (ECS)	Flavor Check	Configuration change	ecs.cloudservers
	Image Check by ID	Configuration change	ecs.cloudservers
	Image Check by Tag	Configuration change	ecs.cloudservers
	Security Group Check by ID	Configuration change	ecs.cloudservers
	VPC Check by ID	Configuration change	ecs.cloudservers
	Login Mode Check	Configuration change	ecs.cloudservers
	ECSs Cannot Be Accessed Through Public Networks	Configuration change	ecs.cloudservers
	An ECS Does Not Have Multiple IPs Attached	Configuration change	ecs.cloudservers
	Idle ECS Check	Periodic	ecs.cloudservers
	All ECSs Are Attached with at Leat One IAM Agency	Configuration change	ecs.cloudservers
	Image Check	Configuration change	ecs.cloudservers
Distributed Cache Service (DCS)	DCS Memcached Instances Support SSL	Configuration change	dcs.memcached
	DCS Memcached Instances Are in a Specified VPC	Configuration change	dcs.memcached
	DCS Memcached Instances Do Not Have Public IPs Attached	Configuration change	dcs.memcached
	Access Mode Check	Configuration change	dcs.memcached
	DCS Redis Instances Support SSL	Configuration change	dcs.redis
	Cross-AZ Deployment Check	Configuration change	dcs.redis
	DCS Redis Instances Are in the Specified VPC	Configuration change	dcs.redis
	DCS Redis Instances Do Not Have Public IPs Attached	Configuration change	dcs.redis
	Access Mode Check	Configuration change	dcs.redis
FunctionGraph	Concurrency Check	Configuration change	fgs.functions
	Functions Are in the Specified VPC	Configuration change	fgs.functions
	Public Access Check	Configuration change	fgs.functions
	Basic Configuration Check	Configuration change	fgs.functions
Content Delivery Network (CDN)	CDN Uses HTTPS Certificates	Configuration change	cdn.domains
	Origin Protocol Policy Check	Configuration change	cdn.domains
	TLS Version Check	Configuration change	cdn.domains
	Certificate Source Check	Configuration change	cdn.domains
Config	The Resource Recorder Has Been Enabled	Periodic	config.trackers
Data Warehouse Service (DWS)	KMS Encryption Check	Configuration change	dws.clusters
	DWS Clusters Have Enabled Audit Log Dumps	Configuration change	dws.clusters
	DWS Clusters Have Enabled Automated Snapshots	Configuration change	dws.clusters
	DWS Clusters Use SSL	Configuration change	dws.clusters
	DWS Clusters Are Not Attached with Any Public IPs	Configuration change	dws.clusters
Data Replication Service (DRS)	Network Type Check for DR Tasks	Configuration change	drs.dataGuardJob
	Network Type Check for Migration Tasks	Configuration change	drs.migrationJob
	Network Type Check for Synchronization Tasks	Configuration change	drs.synchronizationJob
Data Encryption Workshop (DEW)	Key Status Check	Configuration change	kms.keys
	Key Rotation Has Been Enabled	Configuration change	kms.keys
	CSMS Secretes Are Rotated	Configuration change	csms.secrets
Identity and Access Management (IAM)	Key Rotation Check	Periodic	iam.users
	No Blocked Actions on KMS Keys	Configuration changes	iam.roles&iam.policies
	Each User Group Has at Least One User	Configuration change	iam.groups
	Password Policy Check	Configuration change	iam.users
	Unintended Policy Check	Configuration change	iam.users, iam.groups, iam.agencies
	Admin Permissions Check	Configuration change	iam.roles, iam.policies
	Custom Policies Do Not Allow All Actions for a Service	Configuration change	iam.roles, iam.policies
	The Root Access Key Is Unavailable	Periodic	iam.users
	Access Mode Check	Configuration change	iam.users
	Access Key Creation Check	Configuration change	iam.users
	IAM Users Are in at Least One User Group	Configuration change	iam.users
	Last Login Check	Periodic	iam.users
	Multi-Factor Authentication Check	Configuration change	iam.users
	A User Does Not have Multiple Active Access Keys	Configuration change	iam.users
	MFA Has Been Enabled for Console Login	Configuration change	iam.users
	MFA Has Been Enabled for the Root Account	Periodic	iam.users
	All IAM Policies Are in Use	Configuration change	iam.policies
	All IAM Roles Are in Use	Configuration change	iam.roles
	Login Protection Check	Periodic	iam.users
Document Database Service (DDS)	SSL Has Been Enabled	Configuration change	dds.instances
	Instance Type Check	Configuration change	dds.instances
	DDS Instances Do Not Have Public IPs	Configuration change	dds.instances
	DDS Instances Are in the Specified VPC	Configuration change	dds.instances
Simple Message Notification (SMN)	Log Reporting to LTS Has Been Enabled	Configuration change	smn.topic
Virtual Private Cloud (VPC)	Unused ACL Check	Configuration change	vpc.firewallGroups
	Default Security Group Check	Configuration change	vpc.securityGroups
	VPCs Have Enabled Flow Logs	Configuration change	vpc.vpcs
	Security Groups Only Allow Traffic Over Some Ports	Configuration change	vpc.securityGroups
	Ports Have Addresses Restricted	Configuration change	vpc.securityGroups
	SSH Check	Configuration change	vpc.securityGroups
	All Accessible Ports Are Whitelisted	Configuration change	vpc.securityGroups
Virtual Private Network (VPN)	Connection State Check	Configuration change	vpnaas.vpnConnections, vpnaas.ipsec-site-connections
Cloud Eye	Alarm Rules Are Enabled	Configuration change	ces.alarms
	Alarm Rules Have Been Created For KMS Events	Periodic	ces.alarms
	Alarm Rules Have Been Created for OBS Bucket Policy Changes	Periodic	ces.alarms
	An Alarm Rule Has Been Created for the Specified Metric	Periodic	ces.alarms
	Alarm Rule Configurations Check	Configuration change	ces.alarms
	Alarm Rules Have Been Created for VPC Changes	Periodic	ces.alarms
Cloud Container Engine (CCE)	End of Maintenance Check	Configuration change	cce.clusters
	Oldest Supported Version Check	Configuration change	cce.clusters
	CCE Clusters Are Not Publicly Accessible	Configuration change	cce.clusters
	Flavor Check	Configuration change	cce.clusters
Cloud Trace Service (CTS)	CTS Trackers Are Encrypted	Configuration change	cts.trackers
	Log Transfer to LTS Is Enabled	Configuration change	cts.trackers
	Trackers Have Been Created for the Specified OBS Bucket	Periodic	cts.trackers
	Trace File Verification Is Enabled	Configuration change	cts.trackers
	At Least One Tracker Has Been Created	Periodic	cts.trackers
	There Are Trackers In the Specified Regions	Periodic	cts.trackers
Relational Database Service (RDS)	GaussDB Instances Are in the Specified VPC	Configuration change	gaussdb.instance
	Single-AZ Cluster Check	Configuration change	nosql.instances
	GaussDB NoSQL Backup Check	Configuration change	nosql.instances
	GaussDB NoSQL Instances Use Disk Encryption	Configuration change	nosql.instances
	Error Log Collection Is Enabled for GaussDB NoSQL Instances	Configuration change	nosql.instances
	GaussDB NoSQL Instances Support Slow Query Log Collection	Configuration change	nosql.instances
	Audit Logs Are Collected for GaussDB Instances	Configuration change	gaussdb.instance
	Automated Backup Is Enabled	Configuration change	gaussdb.instance
	Error Log Collection Is Enabled for GaussDB Instances	Configuration change	gaussdb.instance
	GaussDB Instances Support Slow Query Log Collection	Configuration change	gaussdb.instance
	Audit Logs Are Collected for GaussDB for MySQL Instances	Configuration change	gaussdb.instance
	Backup Is Enabled for GaussDB for MySQL Instances	Configuration change	gaussdb.instance
	Error Log Collection Is Enabled for GaussDB for MySQL Instances	Configuration change	gaussdb.instance
	GaussDB for MySQL Support Slow Query Log Collection	Configuration change	gaussdb.instance
	Error Log Collection Is Enabled for RDS Instances	Configuration change	rds.instances
	Error Log Collection Is Enabled for RDS Instances	Configuration change	rds.instances
	RDS Instances Support Slow Query Logs	Configuration change	rds.instances
	Single-AZ Cluster Check	Configuration change	rds.instances
	RDS Instances Do Not Have Public IPs	Configuration change	rds.instances
	RDS Instances Use KMS Encryption	Configuration change	rds.instances
	RDS Instances Are in the Specified VPC	Configuration change	rds.instances
	Both Error Logs and Slow Query Logs Are Collected for RDS Instances	Configuration change	rds.instances
	Flavor Check	Configuration change	rds.instances
Cloud Search Service (CSS)	CSS Clusters Use Authority Verification	Configuration change	css.clusters
	The Snapshot Function Is Enabled for CSS Clusters	Configuration change	css.clusters
	Disk Encryption Is Enabled for CSS Clusters	Configuration change	css.clusters
	HTTPS Access Is Enabled for CSS Clusters	Configuration change	css.clusters
	CSS Clusters Are in Specified VPCs	Configuration change	css.clusters
	Single-AZ CSS Cluster Check	Configuration change	css.clusters
	A CSS Cluster Has at Least Two Instances	Configuration change	css.clusters
	CSS Clusters Are Not Publicly Accessible	Configuration change	css.clusters
	Security Mode Is Enabled for CSS Clusters	Configuration change	css.clusters
	CSS Clusters Cannot Be Accessed by All Public IPs	Configuration change	css.clusters
	Kibana Cannot Be Accessed by All Public IPs	Configuration change	css.clusters
Elastic Volume Service (EVS)	EVS Disk Type Check	Configuration changes	evs.volumes
	Disks Are Used Within the Specified Time	Periodic	evs.volumes
	Idle EVS Disk Check	Configuration changes	evs.volumes
	EVS Disks Are Encrypted	Configuration change	evs.volumes
	Disk Encryption Are Enabled	Configuration change	evs.volumes
Cloud Certificate Manager (CCM)	Expiration Check for Private CAs	Periodic	pca.ca
Cloud Certificate Manager (CCM)	Expiration Check for Private Certificates	Periodic	pca.cert
Distributed Message Service (for Kafka)	SSL Is Required for DMS Kafka Access over Private Networks	Configuration change	dms.kafkas
	SSL Is Required for DMS Kafka over Public Networks	Configuration change	dms.kafkas
	DMS Kafka Instances Are Not Publicly Accessible	Configuration change	dms.kafkas
Distributed Message Service for RabbitMQ (for RabbitMQ)	SSL Is Enabled for DMS RabbitMq Instances	Configuration change	dms.rabbitmqs
Distributed Message Service for RocketMQ (for RocketMQ)	SSL Is Enabled for DMS Reliability Instances	Configuration change	dms.reliabilitys
Organizations	The Current Account Has Been Added to an Organization	Periodic	organizations.account
Cloud Firewall (CFW)	CFW Instances Are Attached with Protection Policies	Configuration change	cfw.cfw_instance