API standards and multilingual preset SDKs
The OpenAPI of this product (Config/2020-09-07) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
Account group
|
API |
Title |
Description |
| CreateAggregator | Create an account group | Creates an account group. The management account or a delegated administrator account in a resource directory can create account groups to centrally manage resources, compliance packages, and rules for multiple members. |
| UpdateAggregator | Update an account group | Modifies the name and description of an account group, and adds or removes members. This operation can be called by the management account or a delegated administrator account in a resource directory. |
| DeleteAggregators | Delete an account group | Deletes an account group from a resource directory. The management account or a delegated administrator account can call this operation. |
| ListAggregators | Query account group list | Queries the list of all account groups under the current management account or delegated administrator account. |
| GetAggregator | Query account group details | Queries the name, creation time, members, and type of an account group. |
Resources
|
API |
Title |
Description |
| Single account | Single account | |
| ListDiscoveredResources | ListDiscoveredResources | Queries a list of resources that are aggregated across regions in the current Alibaba Cloud account. |
| GetDiscoveredResource | GetDiscoveredResource | Queries the details of a specific resource. |
| ListResourceRelations | ListResourceRelations | Queries a list of resources that associate with a specific resource. |
| GetResourceConfigurationTimeline | GetResourceConfigurationTimeline | Queries the configuration history of a specified resource. Cloud Config records every configuration and relationship change for a resource in a configuration history. Recording starts after you enable the Cloud Config service. By default, the history is retained for 10 years. |
| GetResourceComplianceTimeline | GetResourceComplianceTimeline | Queries the compliance evaluation history of a specified resource. The history is a set of compliance evaluation records that contain the timestamp and details of each evaluation. |
| ListResourcesByAdvancedSearch | ListResourcesByAdvancedSearch | Obtains resources based on the fields in the resource properties by using a SELECT statement. |
| CreateAdvancedSearchFile | CreateAdvancedSearchFile | Creates a downloadable resource file for the current Alibaba Cloud account. |
| GetAdvancedSearchFile | GetAdvancedSearchFile | Obtains the last resource advanced search file that is generated within the current account. You can call this operation to obtain the URL of the resource advanced search file. |
| GenerateResourceInventory | GenerateResourceInventory | Generates a downloadable inventory of global resources. |
| GetResourceInventory | GetResourceInventory | Queries information about the most recently generated global resource inventory for the current account. |
| GetDiscoveredResourceCountsGroupByRegion | Query resource statistics by region | Queries resource statistics by region. |
| GetDiscoveredResourceCountsGroupByResourceType | GetDiscoveredResourceCountsGroupByResourceType | Queries the statistics on resources by resource type. |
| GetResourceComplianceGroupByResourceType | GetResourceComplianceGroupByResourceType | Queries compliance evaluation results of resources based on a rule and displays the evaluation results grouped by resource type. |
| GetResourceComplianceGroupByRegion | GetResourceComplianceGroupByRegion | Queries compliance evaluation results of resources based on a rule and displays the evaluation results grouped by region. |
| Multiple accounts | Multiple accounts | |
| ListAggregateDiscoveredResources | ListAggregateDiscoveredResources | Queries the resources in a specified account group. |
| GetAggregateDiscoveredResource | Get details of a specified resource in an account group | Retrieves the details of a specified resource in an account group. |
| ListAggregateResourceRelations | ListAggregateResourceRelations | Queries a list of the resources of a specific resource in an account group. |
| GetAggregateResourceConfigurationTimeline | GetAggregateResourceConfigurationTimeline | Queries the configuration history of a specific resource in a specified account group. After you enable Cloud Config, the service records all configuration and relationship changes for your resources and organizes them into a configuration history. This history is saved for 10 years by default. |
| GetAggregateResourceComplianceTimeline | GetAggregateResourceComplianceTimeline | Queries the compliance timeline of a specific resource in an account group. A compliance timeline is a set of compliance evaluation records for a resource. Each record includes the time and content of an evaluation. |
| ListAggregateResourcesByAdvancedSearch | ListAggregateResourcesByAdvancedSearch | You can use SQL Select statements to search for resources in a specific account group based on fields in the resource properties. |
| CreateAggregateAdvancedSearchFile | CreateAggregateAdvancedSearchFile | Creates a downloadable file of advanced search results for resources in an account group. |
| GetAggregateAdvancedSearchFile | GetAggregateAdvancedSearchFile | Obtains the most recently generated resource advanced search file within a specific account group. |
| GenerateAggregateResourceInventory | Generate a download checklist of global resources within an account group | Generates a download checklist of global resources within a specified account group. |
| GetAggregateResourceInventory | GetAggregateResourceInventory | Obtains the last resource inventory that is generated on the Global Resources page within the current account group. |
| GetAggregateResourceCountsGroupByRegion | GetAggregateResourceCountsGroupByRegion | Queries the statistics on the resources in an account group by region. |
| GetAggregateResourceCountsGroupByResourceType | GetAggregateResourceCountsGroupByResourceType | Queries the statistics on the resources in an account group by resource type. |
| GetAggregateResourceComplianceGroupByRegion | GetAggregateResourceComplianceGroupByRegion | Queries the evaluation results grouped by resource type for an account group rule. |
| GetAggregateResourceComplianceGroupByResourceType | GetAggregateResourceComplianceGroupByResourceType | Queries the evaluation results grouped by resource type for an account group rule. |
| GetSupportedResourceRelationConfig | GetSupportedResourceRelationConfig | Queries the supported resource relations for a specified resource type. |
| ListSupportedProducts | ListSupportedProducts | Queries the cloud services and resource types that are supported by Cloud Config. |
Rules
|
API |
Title |
Description |
| Single account | Single account | |
| CreateConfigRule | Create a rule | Creates a rule based on a template or creates a custom rule based on Function Compute to check the compliance of resources. After a rule is created, it automatically performs an evaluation. Cloud Config then automatically triggers evaluations based on the trigger mechanism of the rule. You can also manually trigger evaluations. |
| UpdateConfigRule | Modify a rule | Modifies the description, input parameters, risk level, and other settings of a rule. |
| ListConfigRules | Query rule list | Queries all rules in the rule list. |
| GetConfigRule | GetConfigRule | Queries the details of a specified rule. |
| ListConfigRuleEvaluationResults | Query rule evaluation results | Queries the evaluation results of a rule against resources from the rule dimension. |
| ListResourceEvaluationResults | Query resource evaluation results | Queries the evaluation results of rules for a resource from the resource dimension. |
| DeleteConfigRules | DeleteConfigRules | Deletes rules. |
| DeactiveConfigRules | DeactiveConfigRules | Disables a rule. After a rule is disabled, the resource in the rule is no longer evaluated. The compliance evaluation results before the rule is disabled are still displayed. |
| ActiveConfigRules | ActiveConfigRules | Enables a rule in Cloud Config. After a rule is enabled, Cloud Config automatically evaluates the compliance of a resource based on the trigger mechanism of the rule. |
| StartConfigRuleEvaluation | StartConfigRuleEvaluation | Re-evaluates a specific rule or all rules in a compliance package. |
| IgnoreEvaluationResults | Ignore rule evaluation results | Ignores the evaluation results of a specific rule for specified resources. You can also set an ignore expiration date for the rule. After the ignore period expires, the evaluation results of the rule for the resources are automatically restored. |
| RevertEvaluationResults | RevertEvaluationResults | Re-evaluates resources that are evaluated based on a rule after the evaluation results on some resources of an ignored rule are resumed. |
| GenerateConfigRulesReport | Generate rule evaluation report | Generates a compliance evaluation report for rules. |
| GetConfigRulesReport | Download rule evaluation report | Downloads a rule compliance evaluation report in Excel format to your local machine, allowing you to assign tasks and track the remediation of non-compliant resource configurations. |
| GetConfigRuleSummaryByRiskLevel | GetConfigRuleSummaryByRiskLevel | Queries the compliance summary based on the risk level of a rule. |
| GetResourceComplianceByConfigRule | Query compliance summary by rule compliance evaluation result | Queries the compliance summary from the perspective of rule compliance evaluation results. |
| GetComplianceSummary | GetComplianceSummary | Queries the compliance summary for the current account. |
| ListConfigRuleEvaluationStatistics | Query compliance statistics trend for the current account | Queries the compliance statistics trend for the current account. |
| Multiple accounts | Multiple accounts | |
| CreateAggregateConfigRule | Create account group rule | Creates a rule for a specified account group based on a template or creates a custom rule based on Function Compute to check the compliance of resources. After a rule is created, the rule automatically triggers an evaluation. Cloud Config then automatically triggers evaluations based on the trigger mechanism of the rule. You can also manually trigger evaluations. |
| UpdateAggregateConfigRule | Update an account group rule | Modifies the description, input parameters, risk level, and other settings of a rule in a specified account group. |
| ListAggregateConfigRules | Query rules in an account group | Queries the list of rules in a specified account group. |
| GetAggregateConfigRule | Query account group rule details | Queries the details of a specified rule in a specified account group. |
| ListAggregateConfigRuleEvaluationResults | Query evaluation results of rules in an account group | Queries the evaluation results of resources by rule in a specified account group. |
| ListAggregateResourceEvaluationResults | Query evaluation results of account group resources | Queries the evaluation results of rules for resources in a specified account group from the resource dimension. |
| DeleteAggregateConfigRules | Delete rules | Deletes rules from a specified account group. After a rule is deleted, its configuration information is no longer retained. |
| DeactiveAggregateConfigRules | DeactiveAggregateConfigRules | Disables one or more rules in an account group. After a rule is disabled, the resource in the rule is no longer evaluated. The compliance evaluation results before the rule is disabled are still displayed. |
| ActiveAggregateConfigRules | ActiveAggregateConfigRules | Enables one or more rules in an account group. After a rule is enabled, the rule continues to automatically evaluate resources based on the trigger mechanism. |
| StartAggregateConfigRuleEvaluation | StartAggregateConfigRuleEvaluation | Re-evaluates the compliance of resources based on a rule or based on all rules in a compliance package in a specific account group. |
| IgnoreAggregateEvaluationResults | Ignore evaluation results of an account group rule | Ignores the evaluation results of a rule for specific resources in an account group. You can also set an ignore expiration date for the rule. After the ignore period expires, the evaluation results of the rule for the resources are automatically restored. |
| RevertAggregateEvaluationResults | RevertAggregateEvaluationResults | Re-evaluates resources that are evaluated based on a rule after the evaluation results on some resources of an ignored rule in an account group are resumed. |
| GenerateAggregateConfigRulesReport | Generate account group rule evaluation report | Generates an evaluation report for rules in the rule list of a specified account group. |
| GetAggregateConfigRulesReport | Download account group rule evaluation report | Downloads a rule compliance evaluation report in Excel format to your local machine, allowing you to assign tasks and track the remediation of non-compliant resource configurations. |
| GetAggregateConfigRuleSummaryByRiskLevel | GetAggregateConfigRuleSummaryByRiskLevel | Queries the summary of compliance evaluation results by rule risk level in an account group. |
| GetAggregateResourceComplianceByConfigRule | Query compliance summary by rule evaluation result dimension in an account group | Queries the compliance summary from the compliance evaluation result dimension of a rule in a specified account group. |
| GetAggregateComplianceSummary | GetAggregateComplianceSummary | Queries the compliance summary for a specified account group. |
| ListAggregateConfigRuleEvaluationStatistics | Query compliance statistics trend of an account group | Queries the compliance statistics trend of a specified account group. |
| CopyConfigRules | CopyConfigRules | Replicates rules. |
| ListManagedRules | Query rule templates | Queries the list of rule templates supported by Cloud Config. |
| GetManagedRule | GetManagedRule | Queries the details of a specified rule template. |
| PutEvaluations | Submit custom function rule evaluation results | Submits resource evaluation results from Function Compute to Cloud Config by calling the PutEvaluations operation. |
| ListPreManagedRules | ListPreManagedRules | Queries the proactive rules supported by Cloud Config. |
| EvaluatePreConfigRules | EvaluatePreConfigRules | Executes evaluation rules to perform compliance pre-checks on resources. |
Compliance packages
|
API |
Title |
Description |
| Single account | Single account | |
| CreateCompliancePack | Create a compliance package | Creates a compliance package for the current account. |
| UpdateCompliancePack | Modify compliance pack information | Modifies the information of a specified compliance pack in the current account. |
| ListCompliancePacks | Query compliance packages | Queries the list of compliance packages for the current account. |
| GetCompliancePack | GetCompliancePack | Queries the details of a specific compliance package. |
| DeleteCompliancePacks | Delete a compliance package | Deletes a specified compliance package. After a compliance package is deleted, the check results and check reports of the compliance package are also automatically deleted. |
| GenerateCompliancePackReport | Generate a compliance package evaluation report | Generates an evaluation report for a compliance package. |
| GetCompliancePackReport | Get compliance package evaluation report | Retrieves the evaluation report of a compliance package. |
| GetConfigRuleComplianceByPack | Query rule-level compliance statistics in a compliance package | Queries the rule-level compliance statistics in a specified compliance package. |
| GetResourceComplianceByPack | Query compliance results of resources in a compliance package | Queries the compliance results of resources in a compliance package. |
| AttachConfigRuleToCompliancePack | AttachConfigRuleToCompliancePack | Adds one or more rules to a compliance package. |
| DetachConfigRuleToCompliancePack | DetachConfigRuleToCompliancePack | This operation detaches one or more rules from a compliance package. |
| Multiple accounts | Multiple accounts | |
| CreateAggregateCompliancePack | Create an account group compliance package | Creates a compliance package for a specified account group. |
| UpdateAggregateCompliancePack | Modify compliance package in an account group | Modifies the information of a compliance package in a specified account group. |
| ListAggregateCompliancePacks | Query compliance packages in an account group | Queries the list of compliance packages within a specified account group. |
| GetAggregateCompliancePack | Query account group compliance package details | Queries the details of a compliance package in a specified account group. |
| DeleteAggregateCompliancePacks | Delete an account group compliance package | Deletes compliance packages from a specified account group. After a compliance package is deleted, the check results and check reports of the compliance package are also automatically deleted. |
| GenerateAggregateCompliancePackReport | Generate account group compliance package evaluation report | Generates an evaluation report for a specified compliance package within a specified account group. |
| GetAggregateCompliancePackReport | Get account group compliance package evaluation report | Retrieves the evaluation report of a specified compliance package within a specified account group. |
| GetAggregateResourceComplianceByPack | Query resource compliance statistics of an account group compliance package | Queries the resource compliance statistics of a specified compliance package in a specified account group. |
| GetAggregateConfigRuleComplianceByPack | Query compliance results of rules in an account group compliance package | Queries the compliance results of rules in a specified compliance package within a specified account group. |
| GetAggregateAccountComplianceByPack | Query compliance results of member accounts in an account group compliance package | Queries the compliance results of member accounts in a specified compliance package within a specified account group. |
| AttachAggregateConfigRuleToCompliancePack | AttachAggregateConfigRuleToCompliancePack | Adds one or more rules in an account group to a compliance package. |
| DetachAggregateConfigRuleToCompliancePack | DetachAggregateConfigRuleToCompliancePack | Removes one or more rules in an account group from a compliance package. |
| CopyCompliancePacks | CopyCompliancePacks | Replicates compliance packages. |
| ListCompliancePackTemplates | Query compliance package templates | Queries all compliance package templates and their details provided by Cloud Config. |
Remediation settings
|
API |
Title |
Description |
| Single account | Single account | |
| CreateRemediation | CreateRemediation | Creates a remediation for an existing rule. |
| UpdateRemediation | Update a remediation setting | Updates the specified remediation setting. |
| ListRemediations | ListRemediations | Queries the information about the execution of remediation templates. |
| DeleteRemediations | Delete remediation settings | Deletes specified remediation settings. |
| StartRemediation | Manually execute rule remediation | Manually executes the remediation for a specified rule. |
| ListRemediationExecutions | Query remediation execution records | Queries the remediation execution records of a specified rule. |
| DescribeRemediation | Query remediation setting | Provides an example of querying the details of remediation setting crr-f381cf0c1c2f004e****. |
| Multiple accounts | Multiple accounts | |
| CreateAggregateRemediation | Create a remediation setting for an account group | Creates a remediation setting for a rule in a specified account group. |
| UpdateAggregateRemediation | Update remediation settings of an account group | Updates a specified remediation setting. |
| ListAggregateRemediations | ListAggregateRemediations | Queries the remediations in a specified account group. |
| DeleteAggregateRemediations | Delete remediation settings of an account group | Deletes the remediation settings of a specified account group rule. |
| StartAggregateRemediation | Manually execute remediation settings for an account group | Manually executes remediation for a specified rule in an account group. |
| ListAggregateRemediationExecutions | Query remediation execution records of an account group | Queries the remediation execution records of a rule in a specified account group. |
| ListRemediationTemplates | ListRemediationTemplates | Queries a list of remediation templates for a managed rule. |
| GetRemediationTemplate | GetRemediationTemplate | Queries the details of an automatic remediation template. |
Delivery channels
|
API |
Title |
Description |
| Single account | Single account | |
| CreateConfigDeliveryChannel | Create a delivery channel | Creates a delivery channel to deliver resource data to Simple Log Service (SLS), Object Storage Service (OSS), or Simple Message Queue (formerly MNS) for storage. |
| UpdateConfigDeliveryChannel | UpdateConfigDeliveryChannel | This operation modifies a delivery channel for the current account. |
| DeleteConfigDeliveryChannel | DeleteConfigDeliveryChannel | Deletes a delivery channel. |
| ListConfigDeliveryChannels | ListConfigDeliveryChannels | Returns a list of delivery channels. |
| GetConfigDeliveryChannel | Query specified delivery channel information | Queries the information about a specified delivery channel. |
| Multiple accounts | Multiple accounts | |
| CreateAggregateConfigDeliveryChannel | Create a delivery channel for a specified account group | Creates a delivery channel for a specified account group to deliver resource data to Simple Log Service (SLS), Object Storage Service (OSS), or Simple Message Queue (formerly MNS) for storage. |
| UpdateAggregateConfigDeliveryChannel | Modify a delivery channel in a specified account group | Modifies a delivery channel in a specified account group. |
| DeleteAggregateConfigDeliveryChannel | DeleteAggregateConfigDeliveryChannel | Deletes a delivery channel from an account group. |
| ListAggregateConfigDeliveryChannels | ListAggregateConfigDeliveryChannels | Queries the information about all delivery channels in an account group. |
| GetAggregateConfigDeliveryChannel | GetAggregateConfigDeliveryChannel | Queries the information about a delivery channel in an account group. |
Tags
|
API |
Title |
Description |
| ListTagResources | ListTagResources | Queries the tags attached to resources in Cloud Config. |
| TagResources | TagResources | Attaches tags to CloudConfig rules, account groups, and compliance packages. |
| UntagResources | UntagResources | Detaches tags from resources in Cloud Config. |
Integrated services
|
API |
Title |
Description |
| GetIntegratedServiceStatus | GetIntegratedServiceStatus | Queries the integration status of a specific cloud service. |
| UpdateIntegratedServiceStatus | UpdateIntegratedServiceStatus | Enables or disables the integration of a cloud service. |
| ListIntegratedService | ListIntegratedService | Queries the services integrated with CloudConfig and their statuses. |
Service settings
|
API |
Title |
Description |
| GetConfigurationRecorder | GetConfigurationRecorder | Queries the status of the Cloud Config service and the resource monitoring scope for the current account. |
| StartConfigurationRecorder | StartConfigurationRecorder | Enables Cloud Config to monitor the resources of your Alibaba Cloud account. |
| UpdateConfigurationRecorder | Modify resource monitoring scope | Modifies the resource monitoring scope of the current account. |
| StopConfigurationRecorder | StopConfigurationRecorder | Deactivates Cloud Config. |
Report templates
|
API |
Title |
Description |
| CreateReportTemplate | Create a report template | Creates a compliance report template for the current UID. |
| GetReportTemplate | Retrieve Compliance Report Template Details | Retrieve details of a compliance report template. |
| UpdateReportTemplate | Update Compliance Report template | Updates a compliance report template. |
| ListReportTemplates | Batch retrieve compliance report template details | Queries the details of compliance report templates in batches. |
| DeleteReportTemplate | Delete a Compliance Report template | Deletes a compliance report template. |
| GenerateReportFromTemplate | Generate a report based on a report template | Generate a report ID from a report template. |
| GetReportFromTemplate | Obtain the latest report generated based on a report template. | Retrieves a report generated from a report template. |
| TriggerReportSend | Test notification in real time based on the latest completed report of a template | Tests a notification in real time. |
Others
|
API |
Title |
Description |
| DryRunConfigRule | Dry run a proactive compliance precheck rule | Performs a dry run of a proactive compliance precheck rule. |
| DescribeDiscoveredResourceBatch | DescribeDiscoveredResourceBatch | This operation retrieves the details of multiple resources in a batch. |
| DescribeIntegratedServiceStatus | DescribeIntegratedServiceStatus | Queries the authorization status of an integrated cloud service. |
| GetResourceConfigurationSample | Get resource configuration sample | Retrieves a sample configuration for a specified resource type. |
| GetResourceTypeProperties | GetResourceTypeProperties | This operation retrieves the property descriptions for a specified resource type. |
| ListAggregateRecommendManagedRules | ListAggregateRecommendManagedRules | This operation retrieves the list of recommended managed rules for an account group. |
| ListConfigRuleOperators | ListConfigRuleOperators | Lists the operators available for Cloud Config rules. |
| ListRecommendManagedRules | ListRecommendManagedRules | This operation obtains a list of recommended managed rules. |
| StartConfigRuleEvaluationByResource | StartConfigRuleEvaluationByResource | Starts a re-evaluation of a single resource. |