All Products
Search

This Product

    Cloud Config:CreateConfigRule

    Document Center

    Cloud Config:CreateConfigRule

    Last Updated:Oct 29, 2026

    Creates a rule based on a managed rule template or a custom Function Compute rule to check resource compliance. After a rule is created, an initial evaluation is automatically performed. Subsequent evaluations are automatically triggered by Cloud Config based on the trigger mechanism of the rule. You can also manually trigger evaluations.

    Operation description

    Limits

    You can create up to 200 rules for each account.

    Background information

    Cloud Config allows you to create rules by using the following methods:

    • Create a rule based on a managed rule template

      A managed rule template is a rule function that Cloud Config has built in Function Compute. You can use managed rule templates to quickly create rules. For more information about rules, see How rules are defined and run.

    • Create a rule based on Function Compute

      A custom Function Compute rule is a custom rule whose code is hosted by a function in Function Compute. When the managed rule templates provided by Cloud Config cannot meet your requirements for checking resource compliance, you can write function code to perform compliance checks in complex scenarios. For more information about custom Function Compute rules, see How custom Function Compute rules are defined and run.

    Usage notes

    This topic provides an example of creating a rule by using the managed rule template "required-tags". The response indicates that the rule is created and the rule ID is cr-5772ba41209e007b****.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    config:CreateConfigRule

    create

    *Rule

    acs:config:*:{#accountId}:rule/*

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    TagKeyScope deprecated

    string

    No

    Specifies whether to only precheck the request. Valid values:

    • true: prechecks the request parameters and business logic without performing the actual operation. If the precheck succeeds, the error code DryRunOperation is returned. If the precheck fails, the corresponding error code is returned.

    • false: performs the actual operation. Default value.

    false
    TagValueScope deprecated

    string

    No

    [Deprecated] Use the TagsScope parameter instead.

    The rule takes effect only on resources that are bound with the specified tag key.

    Note

    This parameter applies only to managed rules. You must specify both TagKeyScope and TagValueScope.

    ECS
    TagKeyLogicScope

    string

    No

    [Deprecated] Use the TagsScope parameter instead.

    The rule takes effect only on resources that are bound with the specified tag value.

    Note

    This parameter applies only to managed rule templates. You must specify both TagKeyScope and TagValueScope.

    Valid values:

    • OR :

      The OR logical operator.

    • AND :

      The AND logical operator.

    test
    TagsScope

    array<object>

    No

    The logical relationship when the TagsScope parameter has multiple values. For example, if the TagsScope parameter is set to "TagsScope.1.TagKey":"a","TagsScope.1.TagValue":"a","TagsScope.2.TagKey":"b","TagsScope.2.TagValue":"b" and this parameter is set to AND, the rule takes effect only on resources that are bound with both the a:a and b:b tags. If this parameter is left empty, the default logical relationship OR is used.

    This parameter can also be used for the deprecated TagKeyScope parameter (not recommended). For example, if the TagKeyScope parameter is set to ECS,OSS and this parameter is set to AND, the rule takes effect only on resources that are bound with both the ECS and OSS tags.

    Valid values:

    • AND: the logical AND.

    • OR: the logical OR.

    AND

    object

    No

    TagKey

    string

    No

    The tag key.

    key-1
    TagValue

    string

    No

    The tag value.

    value-1
    ExcludeTagsScope

    array<object>

    No

    The tag scope.

    object

    No

    TagKey

    string

    No

    The tag key.

    key-1
    TagValue

    string

    No

    The tag value.

    value-1
    Description

    string

    No

    The excluded tag scope.

    You can define up to 6 tag groups. If a resource has all specified tags, the resource is considered "compliant"
    SourceOwner

    string

    Yes

    The description of the rule.

    Valid values:

    • CUSTOM_CONFIGURATION :

      custom condition rule.

    • ALIYUN :

      rule template.

    • CUSTOM_FC :

      custom Function Compute rule.

    You can define up to 6 tag groups. If a resource has all the specified tags, the resource is considered compliant
    MaximumExecutionFrequency

    string

    No

    The type of the rule to be created. Valid values:

    • ALIYUN: managed rule template.

    • CUSTOM_FC: custom Function Compute rule.

    • CUSTOM_CONFIGURATION: custom condition-based rule.

    Valid values:

    • Twelve_Hours :

      12 hours.

    • Three_Hours :

      3 hours.

    • Six_Hours :

      6 hours.

    • One_Hour :

      1 hour.

    • TwentyFour_Hours :

      24 hours.

    ALIYUN
    Conditions

    string

    No

    The execution frequency of the rule. Valid values:

    • One_Hour: 1 hour.

    • Three_Hours: 3 hours.

    • Six_Hours: 6 hours.

    • Twelve_Hours: 12 hours.

    • TwentyFour_Hours: 24 hours. Default value.

    Note

    You must specify this parameter when ConfigRuleTriggerTypes is set to ScheduledNotification.

    One_Hour
    RegionIdsScope

    string

    No

    The conditions for the custom condition-based rule in JSON format.

    {"ComplianceConditions":"{\"operator\":\"and\",\"children\":[{\"operator\":\"StringEquals\",\"featurePath\":\"$.Status\",\"desired\":\"1\",\"featureSource\":\"CONFIGURATION\"}]}"}
    ExcludeRegionIdsScope

    string

    No

    The rule takes effect only on resources in the specified region IDs. Separate multiple region IDs with commas (,).

    Note

    This parameter applies only to managed rule templates.

    cn-hangzhou
    ResourceGroupIdsScope

    string

    No

    The rule does not take effect on resources in the specified region IDs, which means evaluations are not performed on resources in these regions. Separate multiple region IDs with commas (,).

    cn-shanghai
    ExcludeResourceGroupIdsScope

    string

    No

    The rule takes effect only on resources in the specified resource group IDs. Separate multiple resource group IDs with commas (,).

    Note

    This parameter applies only to managed rule templates.

    rg-aekzc7r7rhx****
    InputParameters

    object

    No

    The rule does not take effect on resources in the specified resource group IDs, which means evaluations are not performed on resources in these resource groups. Separate multiple resource group IDs with commas (,).

    rg-bnczc6r7rml****
    ResourceIdsScope

    string

    No

    The input parameters for the rule.

    You can obtain the input parameters by calling the GetManagedRule operation. Check the CompulsoryInputParameterDetails and OptionalInputParameterDetails parameters to view the required and optional parameters.

    The format of the input parameters is {"Parameter 1 name":"Parameter 1 value","Parameter 2 name":"Parameter 2 value"}.

    {"key1":"value1","key2":"value2"}
    ExcludeResourceIdsScope

    string

    No

    The rule takes effect on the specified resource IDs. Separate multiple resource IDs with commas (,).

    lb-5cmbowstbkss9ta03****
    SourceIdentifier

    string

    Yes

    The rule does not take effect on the specified resource IDs, which means evaluations are not performed on these resources. Separate multiple resource IDs with commas (,).

    Note

    This parameter applies only to managed rule templates.

    lb-t4nbowvtbkss7t326****
    ConfigRuleTriggerTypes

    string

    Yes

    The identifier of the rule template.

    • If SourceOwner is set to ALIYUN, enter the identifier of the managed rule template, such as required-tags.

      Note

      For more information about how to query the identifier of a managed rule template, see Managed rule templates.

    • If SourceOwner is set to CUSTOM_CONFIGURATION, set this parameter to acs-config-configuration.

    • If SourceOwner is set to CUSTOM_FC, enter the ARN of the Function Compute function.

      The ARN format is acs:fc:region:account ID:services/service name.LATEST/functions/function name, such as acs:fc:cn-hangzhou:120886317861****:services/service-test.LATEST/functions/config-test.

      Note

      For more information about how to obtain the ARN of a function, see ListFunctions.

    required-tags
    ConfigRuleName

    string

    Yes

    The trigger mechanism of the rule. Valid values:

    • ConfigurationItemChangeNotification: configuration change.

    • ScheduledNotification: periodic execution.

    Note

    If the rule has both trigger mechanisms, separate them with a comma (,).

    ConfigurationItemChangeNotification
    ClientToken

    string

    No

    The name of the rule.

    All specified tags exist
    ResourceTypesScope

    array

    Yes

    The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The ClientToken parameter supports only ASCII characters and cannot exceed 64 characters in length.

    1594295238-f9361358-5843-4294-8d30-b5183fac****

    string

    No

    The resource types to be evaluated by the rule. Separate multiple resource types with commas (,).

    ACS::ECS::Instance
    RiskLevel

    integer

    Yes

    The types of the resources to be evaluated by the rule. The actual parameter format is a comma-separated plain string (such as ACS::ECS::Instance,ACS::RDS::DBInstance). JSON arrays or indexed parameters in the format of ResourceTypesScope.1 are not supported.

    Valid values:

    • 1 :

      high risk.

    • 2 :

      medium risk.

    • 3 :

      low risk.

    ACS::ECS::Instance
    ExtendContent

    string

    No

    The risk level of the rule. Valid values:

    • 1: high risk.

    • 2: medium risk.

    • 3: low risk.

    1
    Tag

    array<object>

    No

    The extended content. This parameter is currently used only to set the trigger time for the 24-hour periodic trigger.

    {"fixedHour":"13"}

    object

    No

    The tags of the resource.

    You can add up to 20 tags.

    Key

    string

    No

    The tag key of the resource.

    You can specify up to 20 tag keys.

    key-1
    Value

    string

    No

    The tag value of the resource.

    You can specify up to 20 tag values.

    value-1
    ResourceNameScope

    string

    No

    The tags of the created rule.

    i-xxx

    For more information about common request parameters, see Common parameters.

    Response elements

    Element

    Type

    Description

    Example

    object

    The response.

    ConfigRuleId

    string

    The ID of the rule.

    cr-5772ba41209e007b****
    RequestId

    string

    The ID of the request.

    6EC7AED1-172F-42AE-9C12-295BC2ADB751

    Examples

    Success response

    JSON format

    {
  "ConfigRuleId": "cr-5772ba41209e007b****",
  "RequestId": "6EC7AED1-172F-42AE-9C12-295BC2ADB751"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 ExceedMaxRuleCount The maximum number of rules is exceeded.
    400 ConfigRuleNotExists The ConfigRule does not exist. The rule does not exist.
    400 ConfigRuleExists The ConfigRule already exists.
    400 DryRunOperation Request validation has been passed with DryRun flag set.
    404 AccountNotExisted Your account does not exist.
    503 ServiceUnavailable The request has failed due to a temporary failure of the server. The request has failed due to a temporary failure of the server.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.