All Products
Search

This Product

    Cloud Config:CreateAggregateCompliancePack

    Document Center

    Cloud Config:CreateAggregateCompliancePack

    Last Updated:Sep 02, 2026

    Creates a compliance package for a specified account group.

    Operation description

    A compliance package is a collection of rules. When you create a compliance package, you can select default rules from a compliance package template, or select rules from rule templates and existing rule lists.

    After a compliance package is created, the rules in the package are evaluated once by default. Subsequent evaluations are automatically triggered based on the trigger mechanism of each rule. You can also manually trigger evaluations.

    A compliance package template is a collection of rules that Cloud Config customizes for compliance scenarios.

    This topic provides an example of how to create a compliance package for the account group ca-f632626622af0079**** by using the compliance package template ClassifiedProtectionPreCheck (classified protection level 3 precheck compliance package).

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    config:CreateAggregateCompliancePack

    create

    *AggregateCompliancePack

    acs:config:*:{#accountId}:aggregatecompliancepack/*

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    CompliancePackTemplateId

    string

    No

    The compliance package template ID.

    For information about how to obtain the compliance package template ID, see ListCompliancePackTemplates.

    ct-5f26ff4e06a300c4****
    CompliancePackName

    string

    Yes

    The compliance package name.

    Classified protection level 3 precheck compliance package
    Description

    string

    No

    The description of the compliance package.

    Checks the compliance of resources on Alibaba Cloud based on some requirements of classified protection level 3
    RiskLevel

    integer

    No

    The risk level of the compliance package. Valid values:

    • 1: high risk.

    • 2 (default): medium risk.

    • 3: low risk.

    Valid values:

    • 1 :

      High risk.

    • 2 :

      Medium risk.

    • 3 :

      Low risk.

    2
    AggregatorId

    string

    Yes

    The account group ID.

    For information about how to obtain the account group ID, see ListAggregators.

    ca-f632626622af0079****
    ConfigRules

    array<object>

    No

    The list of rules in the compliance package.

    Note

    You must specify either this parameter or TemplateContent.

    array<object>

    No

    The rule information.

    ManagedRuleIdentifier

    string

    No

    The rule template identifier. Cloud Config automatically creates a rule based on the rule template identifier and adds the rule to the current compliance package.

    You must set either ManagedRuleIdentifier or ConfigRuleId. If both parameters are set, ConfigRuleId takes precedence.

    eip-bandwidth-limit
    ConfigRuleName

    string

    No

    The rule name.

    The bandwidth of an EIP meets the minimum requirement
    ConfigRuleParameters

    array<object>

    No

    The rule parameter information.

    object

    No

    The rule parameter information.

    ParameterName

    string

    No

    The rule parameter name.

    The ParameterName and ParameterValue parameters must be specified together or left empty at the same time. If the rule template has parameters without default values, you must specify this parameter.

    bandwidth
    ParameterValue

    string

    No

    The rule parameter value.

    The ParameterName and ParameterValue parameters must be specified together or left empty at the same time. If the rule template has parameters without default values, you must specify this parameter.

    10
    ConfigRuleId

    string

    No

    The rule ID. Cloud Config adds the existing rule to the current compliance package.

    You must specify either ManagedRuleIdentifier or ConfigRuleId. If both parameters are specified, ConfigRuleId takes precedence.

    cr-e918626622af000f****
    Description

    string

    No

    The rule description.

    An elastic IP address (EIP) that is associated with an ECS instance or NAT gateway and is not idle is considered compliant
    RiskLevel

    integer

    No

    The risk level of the rule. Valid values:

    • 1: high risk.

    • 2: medium risk.

    • 3: low risk.

    1
    TemplateContent

    string

    No

    The template information used to generate the compliance package. You can view the template content from the details API of an existing compliance package, or refer to Write a configuration-based compliance package template to compose the template.

    Note

    You must specify either this parameter or TemplateContent.

    { "configRuleTemplates": [ { "configRuleName": "Custom condition rule example", "scope": { "complianceResourceTypes": [ "ACS::ECS::Instance" ] }, "description": "", "source": { "owner": "CUSTOM_CONFIGURATION", "identifier": "acs-config-configuration", "sourceDetails": [ { "messageType": "ScheduledNotification", "maximumExecutionFrequency": "Twelve_Hours" }, { "messageType": "ConfigurationItemChangeNotification" } ], "conditions": "{\"ComplianceConditions\":\"{\\\"operator\\\":\\\"and\\\",\\\"children\\\":[{\\\"operator\\\":\\\"GreaterOrEquals\\\",\\\"featurePath\\\":\\\"$.Cpu\\\",\\\"featureSource\\\":\\\"CONFIGURATION\\\",\\\"desired\\\":\\\"2\\\"}]}\"}" }, "inputParameters": {} }, { "configRuleName": "The Referer of an OSS bucket is in the specified hotlink protection whitelist", "scope": { "complianceResourceTypes": [ "ACS::OSS::Bucket" ] }, "description": "An OSS bucket with hotlink protection enabled and the Referer in the specified whitelist is considered compliant.", "source": { "owner": "ALIYUN", "identifier": "oss-bucket-referer-limit", "sourceDetails": [ { "messageType": "ConfigurationItemChangeNotification" } ] }, "inputParameters": { "allowEmptyReferer": "true", "allowReferers": "http://www.aliyun.com" } } ] }
    ClientToken

    string

    No

    The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The ClientToken parameter supports only ASCII characters and cannot exceed 64 characters in length.

    1594295238-f9361358-5843-4294-8d30-b5183fac****
    DefaultEnable

    boolean

    No

    Specifies whether the rule supports quick enablement. Valid values:

    • true: The rule is enabled when the compliance package is quickly enabled.

    • false (default): The rule is not enabled.

    false
    RegionIdsScope

    string

    No

    The compliance package takes effect only on resources in the specified region IDs. Separate multiple region IDs with commas (,).

    cn-hangzhou
    ExcludeRegionIdsScope

    string

    No

    The compliance package does not take effect on resources in the specified regions. Resources in these regions are not evaluated. Separate multiple region IDs with commas (,).

    cn-shanghai
    ExcludeResourceIdsScope

    string

    No

    The compliance package does not take effect on the specified resource IDs. Resources with these IDs are not evaluated. Separate multiple resource IDs with commas (,).

    eip-8vbf3x310fn56ijfd****
    ResourceIdsScope

    string

    No

    The rule takes effect only on the specified resource IDs. Separate multiple resource IDs with commas (,).

    lb-5cmbowstbkss9ta03****
    ResourceGroupIdsScope

    string

    No

    The compliance package takes effect only on resources in the specified resource group IDs. Separate multiple resource group IDs with commas (,).

    rg-aekzc7r7rhx****
    ExcludeResourceGroupIdsScope

    string

    No

    The rule does not take effect on resources in the specified resource group IDs. Resources in these resource groups are not evaluated. Separate multiple resource group IDs with commas (,).

    rg-bnczc6r7rml****
    TagKeyScope

    string

    No

    The compliance package takes effect only on resources that are bound with the specified tag key.

    ECS
    TagValueScope

    string

    No

    The compliance package takes effect only on resources that are bound with the specified tag key-value pair.

    Note

    TagValueScope must be used together with TagKeyScope.

    test
    TagsScope

    array<object>

    No

    The effective tags.

    object

    No

    TagKey

    string

    No

    The tag key of the resource.

    tagKey1
    TagValue

    string

    No

    The tag value of the resource.

    tagValue1
    ExcludeTagsScope

    array<object>

    No

    The excluded tags.

    object

    No

    The excluded tag scope.

    TagKey

    string

    No

    The tag key of the resource.

    4
    TagValue

    string

    No

    The tag value of the resource.

    user
    Tag

    array<object>

    No

    The tags of the resource.

    You can add up to 20 tags.

    object

    No

    The tags of the resource.

    You can add up to 20 tags.

    Key

    string

    No

    The tag key of the resource.

    You can specify up to 20 tag keys.

    key-1
    Value

    string

    No

    The tag value of the resource.

    You can specify up to 20 tag values.

    value-1

    For more information about common request parameters, see Common parameters.

    Response elements

    Element

    Type

    Description

    Example

    object

    The response parameters.

    CompliancePackId

    string

    The compliance package ID.

    cp-fc56626622af00f9****
    RequestId

    string

    The request ID.

    CC0CE5EB-E51E-48EB-B4AB-9A9E131ECC0F

    Examples

    Success response

    JSON format

    {
  "CompliancePackId": "cp-fc56626622af00f9****",
  "RequestId": "CC0CE5EB-E51E-48EB-B4AB-9A9E131ECC0F"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 CompliancePackExists The compliance pack already exists. The compliance pack name already exists.
    400 Invalid.AggregatorId.Value The specified AggregatorId is invalid. The specified aggregator ID does not exist or you are not authorized to use the aggregator.
    400 CompliancePackExceedMaxCount The maximum number of compliance pack is exceeded.
    400 Invalid.CompliancePackName.Value The specified CompliancePackName is invalid. The specified compliance pack name is invalid.
    400 Invalid.CompliancePackTemplateId.Value The specified CompliancePackTemplateId does not exist. The specified compliance pack template ID does not exist.
    400 Invalid.ConfigRules.Empty You must specify ConfigRules.
    400 Invalid.ConfigRules.Value The specified ConfigRules is invalid. The specified ConfigRules is invalid.
    400 ConfigRuleExceedMaxRuleCount The maximum number of config rules is exceeded.
    403 AggregatorMemberNoPermission The aggregator member is not authorized to perform the operation. The aggregator member is not authorized to perform the operation.
    404 AccountNotExisted Your account does not exist.
    503 ServiceUnavailable The request has failed due to a temporary failure of the server. The request has failed due to a temporary failure of the server.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.