- What's New
- Service Overview
- Getting Started
-
User Guide
- Resource List
- Resource Recorder
-
Resource Compliance
- Overview
- Rules
- Organization Rules
- Viewing Noncompliant Resources
- Compliance Rule Concepts
-
Built-In Policies
- Predefined Policy List
-
General Policies
- Resource Names Meet Regular Expression Requirements
- Resources Have All the Specified Tags Attached
- Resources Have One of the Specified Tags Attached
- Tag Prefixes and Suffixes Check
- Resources Have at Least One Tags Attached
- Resource Tag Check
- Resources Are in Specified Enterprise Projects
- Resources Are in Specified Regions
- Resource Type Check by Specifying Allowed Resource Types
- Resource Type Check by Specifying Unallowed Resource Types
- API Gateway
- CodeArts Deploy
- MapReduce Service
- NAT Gateway
- VPC Endpoint
- Web Application Firewall
- Elastic Load Balance
- Elastic IP
- Auto Scaling
- Scalable File Service Turbo (SFS Turbo)
-
Elastic Cloud Server
- Flavor Check
- Image Check
- Image Check by Tag
- Security Group Check by ID
- VPC Check by ID
- ECSs Have Key Pairs Attached
- ECSs Cannot Be Accessed Through Public Networks
- An ECS Does Not Have Multiple EIPs Attached
- Idle ECS Check
- ECSs Have IAM Agencies Attached
- Image Check by Name
- ECSs Have Backup Vaults Attached
- Backup Time Check
- ECSs Have HSS Agents Attached
-
Distributed Cache Service
- DCS Memcached Instances Support SSL
- DCS Memcached Instances Are in a Specified VPC
- DCS Memcached Instances Do Not Have EIPs Attached
- Access Mode Check
- DCS Redis Instances Support SSL
- Cross-AZ Deployment Check
- DCS Redis Instances Are in the Specified VPC
- DCS Redis Instances Do Not Have EIPs Attached
- Access Mode Check
- FunctionGraph
- Content Delivery Network (CDN)
- Config
- Data Warehouse Service
- Data Replication Service
- Data Encryption Workshop
-
Identity and Access Management
- Key Rotation Check
- IAM Policies Do Not Allow Blocked Actions on KMS Keys
- Each User Group Has at Least One User
- Password Strength Check
- Unintended Policy Check
- Admin Permissions Check
- Custom Policies Do Not Allow All Actions for a Service
- The Root User Does Not Have Available Access Keys
- Access Mode Check
- Access Key Check
- IAM Users Are in Specified User Groups
- Last Login Check
- Multi-Factor Authentication Check
- A User Does Not have Multiple Active Access Keys
- MFA Has Been Enabled for Console Login
- The Root User Has MFA Enabled
- All IAM Policies Are in Use
- All IAM Roles Are in Use
- Login Protection Check
- IAM Agencies Contain Specified Policies
- The Admin User Group Only Contains the Root User
- IAM Users Do Not Have Directly Assigned Policies or Permissions
- Document Database Service
- Simple Message Notification
- Virtual Private Cloud
- Virtual Private Network
- Cloud Eye
- Cloud Container Engine
-
Cloud Trace Service
- CTS Trackers Have Traces Encrypted
- CTS Trackers Have Trace Transfer to LTS Enabled
- CTS Trackers Have Been Created for the Specified OBS Bucket
- Trace File Verification Is Enabled
- At Least One Tracker Is Enabled
- There Are CTS Trackers In the Specified Regions
- CTS Trackers Comply with Security Best Practices
-
Relational Database Service
- Error Log Collection Is Enabled for RDS Instances
- Error Log Collection Is Enabled for RDS Instances
- RDS Instances Support Slow Query Logs
- Single-AZ Cluster Check
- RDS Instances Do Not Have EIPs Attached
- RDS Instances Use KMS Encryption
- RDS Instances Are in the Specified VPC
- Both Error Logs and Slow Query Logs Are Collected for RDS Instances
- Flavor Check
- RDS Instances Have SSL Enabled
- RDS Instance Port Check
- Version Check for RDS Instance Engines
- RDS Instances Have Audit Log Enabled
- GaussDB
- TaurusDB
- GeminiDB
-
Cloud Search Service
- CSS Clusters Have the Security Mode Enabled
- The Snapshot Function Is Enabled for CSS Clusters
- Disk Encryption Is Enabled for CSS Clusters
- HTTPS Access Is Enabled for CSS Clusters
- CSS Clusters Are in Specified VPCs
- Single-AZ CSS Cluster Check
- A CSS Cluster Has at Least Two Instances
- CSS Clusters Are Not Publicly Accessible
- CSS Clusters Support the Security Mode
- CSS Clusters Have Access Control Enabled
- CSS Clusters Have Kibana Public Access Control Enabled
- CSS Clusters Have Slow Query Log Enabled
- Elastic Volume Service
- Cloud Certificate Manager
- Distributed Message Service for Kafka
- Distributed Message Service for RabbitMQ
- Distributed Message Service for RocketMQ
- Organizations
- Cloud Firewall
- Cloud Backup and Recovery
- Object Storage Service
- Image Management Service
- Bare Metal Server
- Graph Engine Service
- Resource Compliance Event Monitoring
-
Conformance Packages
- Overview
- Conformance Packages
- Organization Conformance Packages
- Custom Conformance Packages
-
Conformance Package Templates
- Overview
- Conformance Package for Classified Protection of Cybersecurity Level 3 (2.0)
- Conformance Package for the Financial Industry
- Conformance Package for Network Security
- Conformance Package for Identity and Access Management
- Conformance Package for Cloud Eye
- Conformance Package for Compute Services
- Conformance Package for ECS
- Conformance Package for ELB
- Conformance Package for Management and Regulatory Services
- Conformance Package for RDS
- Conformance Package for AS
- Conformance Package for CTS
- Conformance Package for AI and Machine Learning
- Conformance Package for Autopilot
- Conformance Package for Enabling Public Access
- Conformance Package for Logging and Monitoring
- Conformance Package for Architecture Reliability
- Conformance Package for Hong Kong Monetary Authority of China Requirements
- Conformance Package for ENISA Requirements
- Conformance Package for SWIFT CSP
- Conformance Package for Germany Cloud Computing Compliance Criteria Catalogue
- Conformance Package for PCI DSS
- Conformance Package for Healthcare Industry
- Best Practices of Network and Data Security
- Conformance Package for Landing Zone
- Architecture Security Best Practices
- Best Practices for Network and Content Delivery Service Operations
- Best Practices for Idle Asset Management
- Multi-AZ Deployment Best Practices
- Resource Stability Best Practices
- Best Practices for API Gateway
- Best Practices for Cloud Container Engine
- Best Practices for Content Delivery Network
- Best Practices for FunctionGraph
- Best Practices for GaussDB
- Best Practices for GeminiDB
- Best Practices for MapReduce Service
- Best Practices for NIST Requirements
- Best Practices for Singapore Financial Industry
- Best Practices for Secure Identity and Compliance Operations
- Conformance Package for Huawei Cloud Security Configuration Guide (Level 1)
- Conformance Package for Huawei Cloud Security Configuration Guide (Level 2)
- Best Practices for Static Data Encryption
- Best Practices for Data Transmission Encryption
- Best Practices for Cloud Backup and Recovery
- Best Practices for Cloud Search Service
- Best Practices for Distributed Cache Service
- Best Practices for Distributed Message Service
- Best Practices for Data Warehouse Service
- Best Practices for TaurusDB
- Best Practices for Object Storage Service
- Best Practices for Virtual Private Cloud
- Best Practices for Web Application Firewall
- Advanced Queries
- Resource Aggregation
- Cloud Trace Service
- Appendix
-
API Reference
- Before You Start
- API Overview
- Calling APIs
-
APIs
-
Resource List
- Querying Resources of a Specific Type
- Querying Cloud Services
- Querying a Resource
- Querying All Resources Recorded by the Resource Recorder
- Querying How Many Resources Are Recorded by the Resource Recorder
- Querying Resource Tags Recorded by the Resource Recorder
- Querying Resource Overview Recorded by the Resource Recorder
- Querying a Specific Resource Recorded by the Resource Recorder
- Querying All Resources Under an Account
- Querying a Resource Under an Account
- Querying Resource Tags
- Querying the Number of Resources
- Querying Resource Overview
- Resource Recorder
- Resource Relationships
- Resource Change Records
-
Compliance
- Querying Built-in Policies
- Querying Specific Built-in Policy
- Adding a Rule
- Querying Rules
- Modifying a Rule
- Querying a Specific Rule
- Deleting a Rule
- Enabling a Rule
- Disabling a Rule
- Running a Resource Compliance Evaluation
- Querying the Evaluation Status of a Rule
- Querying the Compliance of a Resource
- Querying the Compliance of a Rule
- Querying Compliance of an Account
- Updating the Compliance Result
- Creating an Organization Rule
- Querying Organization Rules
- Querying a Specific Organization Rule
- Deleting an Organization Rule
- Updating an Organization Rule
- Querying the Deployment Status of an Organization Rule
- Querying Statuses of Organization Rule Deployment to Member Accounts
- Setting up or Updating Remediation Configurations
- Querying Remediation Configurations
- Deleting Remediation Configurations
- Batch Creating Remediation Exceptions
- Batch Deleting Remediation Exceptions
- Querying Remediation Exceptions
- Starting Remediation
- Querying Remediation Results
- Collect Remediation Results
- Region Management
- Advanced Queries
-
Resource Aggregators
- Creating a Resource Aggregator
- Querying Resource Aggregators
- Querying a Specific Resource Aggregator
- Querying Account Aggregation Statuses of a Specific Aggregator
- Updating a Resource Aggregator
- Deleting a Resource Aggregator
- Authorizing an Aggregator Account
- Querying Authorized Aggregator Accounts
- Deleting Authorization for an Aggregator Account
- Querying All Pending Aggregation Requests
- Deleting Pending Authorization Requests
- Querying the Number of Resources of an Aggregator Account
- Querying Resources of an Aggregator Account
- Querying Details About a Specific Resource in a Source Account
- Performing an Advanced Query on a Specific Aggregator
- Querying the Compliance Summary of One or More Source Accounts in an Aggregator
- Querying Aggregated Rules
- Querying Compliance Results of Aggregated Resources
- Querying Details About a Specified Aggregated Rule
-
Conformance Packages
- Querying Conformance Packages
- Creating a Conformance Package
- Querying a Specific Conformance Package
- Deleting a Conformance Package
- Updating Conformance Packages
- Querying Compliance of all Conformance Packages
- Querying Compliance of all Rules in a Conformance Package
- Querying Compliance of All Resources Evaluated with a Conformance Package
- Querying Scores of All Conformance Packages
- Querying Built-in Conformance Package Templates
- Querying the Template of a Built-in Conformance Package
- Creating organization conformance packages.
- Querying Organization Conformance Packages
- Querying an Organization Conformance Package
- Delete organization conformance packages.
- Updating Organization Conformance Packages
- Querying the Deployment Status of the Organization Conformance Package
- Querying the Statuses of Organization Conformance Package Deployment to Members.
- Resource Tags
-
Resource List
- Permissions Policies and Supported Actions
- Appendixes
- SDK Reference
-
Best Practices
- Creating Rules
- Querying Resource Details, Relationships, and Change Records
- Creating Alarm Rules for Noncompliant Resources with Cloud Eye
- Using Advanced Queries
- Querying Resources That Do Not Have Specific Tags
- Ensuring Resource Compliance by Tag, Region, and Organization
- Automating Resource Management
- FAQs
- General Reference
Copied.
Syntax
Symbol Conventions
In this section, the words that need to be typed in the original form are capitalized, and the characters that need to be typed in the original form are enclosed in single quotation marks (').
'[x]' indicates that statement 'x' can be used once or not even once.
'(x)' indicates that statement 'x' is a whole. '(x, ...)' indicates that statement 'x' can be used once or multiple times. If statement 'x' is used multiple times, use commas (,) to separate them.
'|' indicates all possible alternatives.
'expression' indicates any expression. Specially, 'bool_expression' indicates any Boolean expression.
'identifier' indicates a valid identifier. An identifier can contain letters, digits, and underscores (_), and cannot start with a digit.
'column_name' indicates a valid field name. It can be 'identifier' or multiple identifiers, for example,'A.id'.
'table_name' indicates a valid table name. In the ResourceQL syntax, 'table_name' must be 'resources'.
A unit enclosed in double quotation marks ("") is considered as a whole. For example, to indicate a column name containing special characters, add double quotation marks ("") before and after the column name.
Basic Query Syntax
[WITH (with_item, ...)] SELECT [DISTINCT | ALL] (select_item, ...) [FROM (from_item, ...)] [WHERE bool_expression] [GROUP BY [DISTINCT | ALL] (expression, ...)] [HAVING booleanExpression] [ORDER BY (expression [ASC | DESC] [NULLS (FIRST | LAST)], ...)] [LIMIT number]
The field in 'select_item' can be renamed. Operation can be performed on the field values. 'select_item' supports the query of all fields in a table.
select_item = (expression [[AS] column_name_aias]) | *
'from_item' supports the join function and multiple subqueries, and the table name can be renamed.
from_item = table_name [[AS] table_name_aias] | (from_item join_type from_item [(ON bool_expression) | USING(column_name, ...)]) | '(' query ')'
'with_item' is used to customize queries to facilitate subsequent invoking.
with_item = identifier AS '(' query ')'
For example, to list resources with a quantity greater than 100 in each region, run the following SQL statement:
WITH counts AS ( SELECT region_id, provider, type, count(*) AS number FROM resources GROUP BY region_id, provider, type ) SELECT * FROM counts WHERE number > 100
Numeric Operation and Boolean Operation
ResourceQL supports binary mathematical operations on integers and floating digits. The following operators are supported: '+,-,*,/,%'
Values of the same type can be compared. The following comparison operators are supported: <, >, <=, >=, =, <>, !=. Both <> and != indicate not equal. Values are compared in size, and strings are compared in lexicographic order. Values and sets can also be compared. In this case, one from 'ALL | SOME | ANY' on the right of the comparison operator is used to specify the comparison range. 'All' indicates that all elements in the set must be met. 'SOME/ANY' indicates that at least one element must be met.
expression ('=' | '<>' | '!=' | '<' | '>' | '<=' | '>=') expression expression ('=' | '<>' | '!=' | '<' | '>' | '<=' | '>=') [ALL | SOME | ANY] '(' query ')'
'bool_expression' indicates any Boolean expression. (True or False is returned after the operation.) 'bool_expression' includes the following syntax:
NOT bool_expression bool_expression (AND | OR) bool_expression expression [NOT] BETWEEN expression AND expression expression [NOT] IN '(' query ')' EXISTS '(' query ')' expression [NOT] LIKE pattern [ESCAPE escape_characters] expression IS [NOT] NULL expression IS [NOT] DISTINCT FROM expression
In particular, operator '||' concatenates the left and right values and returns a new value. The left and right values are of the same type: array or string.
Timestamp
ResourceQL allows you to query fields of the time type. The query result is converted to the zero time zone and returned in ISO Date format. The result is saved in milliseconds.
Time types can be connected by comparison operators. If you want to use a literal to indicate time, use timestamps to write 'time'. 'time' can be in any ISO date format or a common time format. The following formats are allowed:
2019-06-17T12:55:42.233Z
2019-06-17T12:55:42Z
2019-06-17 12:55:42
2019-06-17T12:55:42.00 + 08:00
2019-06-17 05:55:40 - 06:00
2019-06-17
2019
If the time zone is not added, the zero time zone is used by default. If the 24-hour time is not added, 0:00 is used by default. If the month is not added, January 1 is used by default.
For example, to sort resources created since 12:55:00 on September 12, 2020 by update time in descending order, run the following statement:
select name, created, updated from resources where created >= timestamp '2020-09-12T12:55:00Z' order by updated DESC
Fuzzy Search
string LIKE pattern [ESCAPE escape_characters]
'LIKE' is used to determine whether a character string complies with a pattern. If you want to express the literal of '%' and '_' in the pattern, you can specify an escape character (for example, '#') after ESCAPE and write '# %' and '#_' in the pattern.
Wildcard '%' indicates that zero or multiple characters are matched.
Wildcard '_' indicates that one character is matched.
The fuzzy query of OBS buckets can be written in the following format:
SELECT name, id FROM resources WHERE provider = 'obs' AND type = 'buckets' AND name LIKE '%figure%'
or
SELECT name, id FROM resources WHERE provider = 'obs' AND type = 'buckets' AND name LIKE '%figure#_%' ESCAPE '#'
Condition Functions
The return value of CASE varies according to the actual situation. CASE can be used in either of the following ways:
- Calculate the value of a given expression and return the corresponding result based on the value.
- Calculate the value of each bool_expression in sequence, finds the first expression that meets the requirements, and returns the result.
CASE expression WHEN value1 THEN result1 [WHEN value2 THEN result2] [...] [ELSE result] END CASE WHEN condition1 THEN result1 WHEN condition2 THEN result2 [...] [ELSE result] END
IF can be used in either of the following ways:
- 'IF(bool_expression, value)': If the bool_expression value is true, 'value' is returned. Otherwise, NULL is returned.
- 'IF(bool_expression, value1, value2)': If the Boolean expression value is true, 'value1' is returned. Otherwise, 'value2' is returned.
Using Functions to Simplify Queries
ResourceQL provides a variety of functions to simplify queries. For details about the functions, see Functions.
ResourceQL supports lambda expressions. The arguments of some functions may be another function. In this case, it is convenient to use the lambda expression.
For example, to list the ECSs and the EVS disks attached to each ECS, run the following SQL statement:
SELECT ECS.id AS ecs_id, EVS.id AS evs_id FROM (SELECT id, transform(properties.ExtVolumesAttached, x -> x.id) AS evs_list FROM resources WHERE provider = 'ecs' AND type = 'cloudservers') ECS (SELECT id FROM resources WHERE provider = 'evs' AND type = 'volumes') EVS WHERE contains(ecs.evs_list, evs.id)
'contains(a, element)→boolean' determines whether an element appears in array a.
'transform(array(T), function(T, S))→array(S) can convert an array of a certain type into an array of another type.
Join and Unnest
ResourceQL supports 'JOIN' and 'UNNEST'. 'JOIN' can be classified into the following types:
- [INNER] JOIN
- LEFT [OUTER] JOIN
- RIGHT [OUTER] JOIN
- FULL [OUTER] JOIN
'JOIN' must be followed by 'USING(...)' or 'ON <bool_expression>'.
'USING' is used to specify the names of columns to join.
'ON' accepts a Boolean expression and merges values of 'JOIN' if the Boolean expression value is true. To ensure performance, there must be at least one equation in a Boolean expression in the conjunctive normal form (CNF), and the operation content at the left and right ends of the equation is provided by the left and right tables separately.
You can add 'NATURAL' before 'JOIN' to indicate a connection. In this case, you do not need to add 'USING' or 'ON' after 'JOIN'.
'UNNEST' can unpack an array into a table. With 'WITH ORDINALITY', there is an auto-increment column. The format is as follows:
table_name CROSS JOIN UNNEST '(' (expression, ...) ')' [WITH ORDINALITY]
Note that 'CROSS JOIN' can only be used to connect to 'UNNEST'. ResourceQL does not support 'CROSS JOIN' in other formats.
The preceding example of querying the association between an ECS and an EVS disk can also be written in the following format:
SELECT ECS_EVS.id AS ecs_id, EVS.id AS evs_id FROM (SELECT id, evs_id FROM (SELECT id, transform(properties.ExtVolumesAttached, x ->x.id) AS evs_list FROM resources WHERE provider = 'ecs' AND type = 'cloudservers') ECS CROSS JOIN UNNEST(evs_list) AS t (evs_id)) ECS_EVS, (SELECT id FROM resources WHERE provider = 'evs' AND type = 'volumes') EVS WHERE ECS_EVS.evs_id = EVS.id
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot