This topic describes how to push alert notifications to specified Message Service (MNS) topics if Cloud Config detects non-compliant configuration changes of resources. If you receive a non-compliance alert, Cloud Config uses the relevant functions of Alibaba Cloud Function Compute to automatically remediate these resources.
Prerequisites
- Cloud Config is authorized to access your resources and a rule is created based on a managed rule. For more information, see Authorize Cloud Config to access your resources and Create a rule by using a managed rule.
- MNS is activated. For more information, see Activate Message Service.
- Object Storage Service (OSS) is activated and an OSS bucket is created. For more information, see Activate OSS and Create buckets.
- Function Compute is activated. For more information, see Activate the Function Compute service.
Scenarios
You create a rule function and link it to a resource type named ACS::OSS::Bucket based
on the managed rule named oss-bucket-public-read-prohibited. Cloud Config evaluates
all resources of this type. One of the resources is evaluated as Non-compliant, as shown in the following figure.

Parameters
In this example, the read and write permissions of an OSS bucket are remediated. The
following table describes the parameters that you can specify.
Cloud service | Parameter | Example |
---|---|---|
Cloud Config | Managed Rule | oss-bucket-public-read-prohibited |
Rule Name | test-oss-bucket-public-read-prohibited | |
MNS | Topic | MNSTestConfig |
MNS Topic Region | Singapore (Singapore) | |
OSS | OSS Bucket | config-snapshot |
Bucket ACL | Public-read | |
Function Compute | Service Name | resource_repair |
System Policies | AliyunOSSFullAccess | |
Function Name | oss_repair_acl_trigger | |
Trigger Name | ConfigRuleNonComplianceMNSTrigger |
Note
Cloud Config is deployed in the Singapore (Singapore) region. To reduce packet loss, we recommend that you select Singapore (Singapore) for the MNS Topic Region parameter.
Workflow
The following figure shows how non-compliant resources are to automatically remediated.
