All Products
Search

This Product

    Cloud Config:CreateAggregateCompliancePack

    Document Center

    Cloud Config:CreateAggregateCompliancePack

    Last Updated:Dec 12, 2025

    Creates a compliance pack for a specified account group.

    Operation description

    A compliance pack is a collection of rules. When you create a compliance pack, you can select default rules from a compliance pack template. You can also select rules from rule templates and the list of existing rules.

    After a compliance pack is created, its rules are evaluated once by default. Subsequent evaluations are automatically triggered based on the trigger mechanism of the rules. You can also manually trigger an evaluation.

    A compliance pack template is a collection of rules created by CloudConfig for a specific compliance scenario.

    This topic provides an example of how to create a compliance pack for the account group ca-f632626622af0079**** using the compliance pack template ClassifiedProtectionPreCheck (Classified Protection Level 3 Pre-check).

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    config:CreateAggregateCompliancePack

    create

    *AggregateCompliancePack

    acs:config:*:{#accountId}:aggregatecompliancepack/*

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    CompliancePackTemplateId

    string

    No

    The ID of the compliance pack template.

    For more information about how to obtain the ID of a compliance pack template, see ListCompliancePackTemplates.

    ct-5f26ff4e06a300c4****
    CompliancePackName

    string

    Yes

    The name of the compliance pack.

    等保三级预检合规包
    Description

    string

    No

    The description of the compliance pack.

    基于等保三级的部分要求，对阿里云上资源的合规性做检测。
    RiskLevel

    integer

    No

    The risk level of the compliance pack. Valid values:

    • 1: High

    • 2 (default): Medium

    • 3: Low

    2
    AggregatorId

    string

    Yes

    The ID of the account group.

    For more information about how to obtain the ID of an account group, see ListAggregators.

    ca-f632626622af0079****
    ConfigRules

    array<object>

    No

    The rules in the compliance pack.

    Note

    Specify either this parameter or TemplateContent.

    array<object>

    No

    None

    ManagedRuleIdentifier

    string

    No

    The identifier of the rule template. CloudConfig automatically creates a rule based on the rule template identifier and adds the rule to the compliance pack.

    Specify either ManagedRuleIdentifier or ConfigRuleId. If both parameters are specified, ConfigRuleId is used.

    eip-bandwidth-limit
    ConfigRuleName

    string

    No

    The name of the rule.

    弹性IP实例带宽满足最低要求
    ConfigRuleParameters

    array<object>

    No

    The parameters of the rule.

    object

    No

    None

    ParameterName

    string

    No

    The name of the rule parameter.

    Specify both ParameterName and ParameterValue, or leave both empty. If a rule template has a parameter that does not have a default value, the parameter is required.

    bandwidth
    ParameterValue

    string

    No

    The value of the rule parameter.

    Specify both ParameterName and ParameterValue, or leave both empty. If a rule template has a parameter that does not have a default value, the parameter is required.

    10
    ConfigRuleId

    string

    No

    The rule ID. CloudConfig adds an existing rule to the compliance pack.

    Specify either ManagedRuleIdentifier or ConfigRuleId. If both parameters are specified, ConfigRuleId is used.

    cr-e918626622af000f****
    Description

    string

    No

    The description of the rule.

    弹性公网已绑定到ECS或者NAT实例，非闲置状态，视为“合规”。
    RiskLevel

    integer

    No

    The risk level of the rule. Valid values:

    • 1: High

    • 2: Medium

    • 3: Low

    1
    TemplateContent

    string

    No

    The template information that is used to generate the compliance pack. You can view the template content in the details of an existing compliance pack or create a template. For more information, see Create a configurable compliance pack template.

    Note

    Specify either this parameter or ConfigRules.

    { "configRuleTemplates": [ { "configRuleName": "自定义条件规则示例", "scope": { "complianceResourceTypes": [ "ACS::ECS::Instance" ] }, "description": "", "source": { "owner": "CUSTOM_CONFIGURATION", "identifier": "acs-config-configuration", "sourceDetails": [ { "messageType": "ScheduledNotification", "maximumExecutionFrequency": "Twelve_Hours" }, { "messageType": "ConfigurationItemChangeNotification" } ], "conditions": "{\"ComplianceConditions\":\"{\\\"operator\\\":\\\"and\\\",\\\"children\\\":[{\\\"operator\\\":\\\"GreaterOrEquals\\\",\\\"featurePath\\\":\\\"$.Cpu\\\",\\\"featureSource\\\":\\\"CONFIGURATION\\\",\\\"desired\\\":\\\"2\\\"}]}\"}" }, "inputParameters": {} }, { "configRuleName": "OSS存储空间Referer在指定的防盗链白名单中", "scope": { "complianceResourceTypes": [ "ACS::OSS::Bucket" ] }, "description": "OSS存储空间开启防盗链并且Referer在指定白名单中，视为“合规”。", "source": { "owner": "ALIYUN", "identifier": "oss-bucket-referer-limit", "sourceDetails": [ { "messageType": "ConfigurationItemChangeNotification" } ] }, "inputParameters": { "allowEmptyReferer": "true", "allowReferers": "http://www.aliyun.com" } } ] }
    ClientToken

    string

    No

    A client token. It is used to ensure the idempotence of the request. Generate a value from your client to make sure that the value is unique among different requests. ClientToken supports only ASCII characters and cannot exceed 64 characters in length.

    1594295238-f9361358-5843-4294-8d30-b5183fac****
    DefaultEnable

    boolean

    No

    Indicates whether the rule is enabled for quick activation. Valid values:

    • true: The rule is enabled when you quickly activate the compliance pack.

    • false (default): The rule is not enabled.

    false
    RegionIdsScope

    string

    No

    The compliance pack takes effect only for resources in the specified regions. Separate multiple region IDs with commas (,).

    cn-hangzhou
    ExcludeRegionIdsScope

    string

    No

    The compliance pack does not take effect for resources in the specified regions. The resources in these regions are not evaluated. Separate multiple region IDs with commas (,).

    cn-shanghai
    ExcludeResourceIdsScope

    string

    No

    The compliance pack does not take effect for the specified resources. The resources are not evaluated. Separate multiple resource IDs with commas (,).

    eip-8vbf3x310fn56ijfd****
    ResourceIdsScope

    string

    No

    The compliance pack takes effect only for the specified resources. Separate multiple resource IDs with commas (,).

    lb-5cmbowstbkss9ta03****
    ResourceGroupIdsScope

    string

    No

    The compliance pack takes effect only for resources in the specified resource groups. Separate multiple resource group IDs with commas (,).

    rg-aekzc7r7rhx****
    ExcludeResourceGroupIdsScope

    string

    No

    The compliance pack does not take effect for resources in the specified resource groups. The resources in these resource groups are not evaluated. Separate multiple resource group IDs with commas (,).

    rg-bnczc6r7rml****
    TagKeyScope

    string

    No

    The compliance pack takes effect only for resources that have the specified tag key.

    ECS
    TagValueScope

    string

    No

    The compliance pack takes effect only for resources that have the specified tag key-value pair.

    Note

    TagValueScope must be used with TagKeyScope.

    test
    TagsScope

    array<object>

    No

    The effective tags.

    object

    No

    TagKey

    string

    No

    The tag key of the resource.

    tagKey1
    TagValue

    string

    No

    The tag value of the resource.

    tagValue1
    ExcludeTagsScope

    array<object>

    No

    The excluded tags.

    object

    No

    The scope of excluded tags.

    TagKey

    string

    No

    The tag key of the resource.

    4
    TagValue

    string

    No

    The tag value of the resource.

    user
    Tag

    array<object>

    No

    The tags of the resource.

    You can add up to 20 tags.

    object

    No

    The tags of the resource.

    You can add up to 20 tags.

    Key

    string

    No

    The tag key of the resource.

    You can add up to 20 tag keys.

    key-1
    Value

    string

    No

    The tag value of the resource.

    You can add up to 20 tag values.

    value-1

    For more information about common request parameters, see Common parameters.

    Response elements

    Element

    Type

    Description

    Example

    object

    None

    CompliancePackId

    string

    The ID of the compliance pack.

    cp-fc56626622af00f9****
    RequestId

    string

    The request ID.

    CC0CE5EB-E51E-48EB-B4AB-9A9E131ECC0F

    Examples

    Success response

    JSON format

    {
  "CompliancePackId": "cp-fc56626622af00f9****",
  "RequestId": "CC0CE5EB-E51E-48EB-B4AB-9A9E131ECC0F"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 CompliancePackExists The compliance pack already exists. The compliance pack name already exists.
    400 Invalid.AggregatorId.Value The specified AggregatorId is invalid. The specified aggregator ID does not exist or you are not authorized to use the aggregator.
    400 CompliancePackExceedMaxCount The maximum number of compliance pack is exceeded.
    400 Invalid.CompliancePackName.Value The specified CompliancePackName is invalid. The specified compliance pack name is invalid.
    400 Invalid.CompliancePackTemplateId.Value The specified CompliancePackTemplateId does not exist. The specified compliance pack template ID does not exist.
    400 Invalid.ConfigRules.Empty You must specify ConfigRules.
    400 Invalid.ConfigRules.Value The specified ConfigRules is invalid. The specified ConfigRules is invalid.
    400 ConfigRuleExceedMaxRuleCount The maximum number of config rules is exceeded.
    403 AggregatorMemberNoPermission The aggregator member is not authorized to perform the operation. The aggregator member is not authorized to perform the operation.
    404 AccountNotExisted Your account does not exist.
    503 ServiceUnavailable The request has failed due to a temporary failure of the server. The request has failed due to a temporary failure of the server.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.