Evaluating Resource Compliance

Scenario

The resource compliance feature enables you to quickly create a set of rules for evaluating your resources against compliance requirements. When creating a rule, you need to select a built-in policy or a custom policy, specify a monitoring scope, and specify the trigger. After the evaluation, you can check the evaluation results.

This section uses the built-in policy for IAM user Last Login Check as an example to describe how to detect inactive IAM users. This policy can help reduce idle users and password leakage risks for enhanced account security.

Preparations

1. If you already have a Huawei account, skip this step. If you do not have one, follow the following steps to create one:
   1. Go to Huawei Cloud and click Sign Up.
   2. Sign up for a Huawei account and enable Huawei Cloud services.

      After your account is created, you will be directed to your personal information page.

   3. Complete real-name authentication by following the instructions in Individual Real-Name Authentication or Enterprise Real-Name Authentication.
2. Top up your account.

   Config itself is free of charge, but the SMN topic and the OBS bucket that you configured for the resource recorder will be charged. For details, see SMN billing and OBS billing.

   Ensure that your account has sufficient balance to avoid unavailability of the resource recorder and other functions. For more details, see Topping up an Account.

3. Enabling the Resource Recorder

   The resource recorder must be enabled for adding, modifying, enabling, or triggering a rule. If the resource recorder is disabled, you can only view, disable, and delete rules. In addition, only resources within the monitoring scope of the resource recorder can be evaluated by Config rules, so you are advised to select all your resources when you configure the resource recorder.

Step 1: Add a Rule

The following steps are only for reference. For details about all the parameters, see section Adding a Rule Based on a Built-in Policy.

1. Log in to the Config console.
2. In the navigation pane on the left, choose Resource Conformance.
3. On the Rules tab, click Add Rule.

   

4. On the Basic Configurations page, select the built-in policy Last Login Check and click Next.

   

5. On the Configure Rule Parameters page, configure required parameters as shown below and click Next.

   

   Parameter	Example	Description
   Execute Every	24 hours	Execution frequency of the evaluations for a rule. The system triggers evaluation periodically based on this setting. Available options: 1 hour, 3 hours, 6 hours, 12 hours, 24 hours.
   Resource Scope	All	The region where your resources are deployed. Only resources in the specified region will be evaluated.
   Configure Rule Parameters	90	Number of days during which an IAM user has not logged in the system. The default value is 90. If an IAM user does not log in to the system within the specified period of time, this user is non-compliant.

6. On the Confirm page, verify the rule details and click Submit.

   Once the rule is created, the system automatically triggers the first evaluation for the rule.

Step 2: View evaluation results.

1. On the Rules tab of the Resource Conformance page, click the name of the rule that was added in Step 1.

   

2. View evaluation results and rule details on the Basic Information tab.

   

   By default, non-compliant resources are displayed. Use the filter box above the list to search for resources by evaluation result, resource name, or ID. You can also export all evaluation results.

   IAM users who do not log in to the management console within 90 days are considered non-compliant. Take appropriate action on these inactive users based on the evaluation results.