API standards and multilingual preset SDKs
The OpenAPI of this product (Config/2020-09-07) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
Account group
|
API |
Title |
Description |
| CreateAggregator | CreateAggregator | A management account or a delegated administrator account in a resource directory can create an account group to centrally manage resources, compliance packages, and rules across multiple member accounts. |
| UpdateAggregator | UpdateAggregator | The management account or a delegated administrator account of a resource directory can modify the name and description of an account group, and add or remove members. |
| GetAggregator | GetAggregator | Queries the name, creation time, members, and type of an account group. |
Resources
|
API |
Title |
Description |
| Single account | Single account | |
| ListDiscoveredResources | ListDiscoveredResources | Queries a list of resources that are aggregated across regions in the current Alibaba Cloud account. |
| GetDiscoveredResource | GetDiscoveredResource | Queries the details of a specific resource. |
| GetResourceConfigurationTimeline | GetResourceConfigurationTimeline | Queries the configuration history of a specified resource. Cloud Config records every configuration and relationship change for a resource in a configuration history. Recording starts after you enable the Cloud Config service. By default, the history is retained for 10 years. |
| GetResourceComplianceTimeline | GetResourceComplianceTimeline | Queries the compliance evaluation history of a specified resource. The history is a set of compliance evaluation records that contain the timestamp and details of each evaluation. |
| GenerateResourceInventory | GenerateResourceInventory | Generates a downloadable inventory of global resources. |
| GetResourceInventory | GetResourceInventory | Queries information about the most recently generated global resource inventory for the current account. |
| Multiple accounts | Multiple accounts | |
| ListAggregateDiscoveredResources | ListAggregateDiscoveredResources | Queries the resources in a specified account group. |
| GetAggregateDiscoveredResource | GetAggregateDiscoveredResource | Queries the details of a specific resource in an account group. |
| GetAggregateResourceConfigurationTimeline | GetAggregateResourceConfigurationTimeline | Queries the configuration history of a specific resource in a specified account group. After you enable Cloud Config, the service records all configuration and relationship changes for your resources and organizes them into a configuration history. This history is saved for 10 years by default. |
| GetAggregateResourceComplianceTimeline | GetAggregateResourceComplianceTimeline | Queries the compliance timeline of a specific resource in an account group. A compliance timeline is a set of compliance evaluation records for a resource. Each record includes the time and content of an evaluation. |
| ListAggregateResourcesByAdvancedSearch | ListAggregateResourcesByAdvancedSearch | You can use SQL Select statements to search for resources in a specific account group based on fields in the resource properties. |
| CreateAggregateAdvancedSearchFile | CreateAggregateAdvancedSearchFile | Creates a downloadable file of advanced search results for resources in an account group. |
| GetSupportedResourceRelationConfig | GetSupportedResourceRelationConfig | Queries the supported resource relations for a specified resource type. |
| ListSupportedProducts | ListSupportedProducts | Queries the cloud services and resource types that are supported by Cloud Config. |
Rules
|
API |
Title |
Description |
| Single account | Single account | |
| CreateConfigRule | CreateConfigRule | Creates a rule from a template or a custom rule using Function Compute to check resource compliance. After you create a rule, Cloud Config runs an initial evaluation and then automatically triggers subsequent evaluations based on the rule's trigger. You can also run evaluations manually. |
| UpdateConfigRule | UpdateConfigRule | Modifies the description, input parameters, and risk level of a rule. |
| ListConfigRules | ListConfigRules | Queries a list of rules. |
| GetConfigRule | GetConfigRule | Queries the details of a specified rule. |
| ListConfigRuleEvaluationResults | ListConfigRuleEvaluationResults | Queries the compliance evaluation results of a rule. |
| ListResourceEvaluationResults | ListResourceEvaluationResults | Queries the evaluation results for a resource based on a rule. |
| StartConfigRuleEvaluation | StartConfigRuleEvaluation | Re-evaluates a specific rule or all rules in a compliance package. |
| IgnoreEvaluationResults | IgnoreEvaluationResults | Ignores the evaluation results of a rule for specific resources. You can also set a time period to ignore the rule. When the ignore period expires, the system automatically resumes displaying the evaluation results of the rule for the resources. |
| GetConfigRuleSummaryByRiskLevel | GetConfigRuleSummaryByRiskLevel | Queries the compliance summary based on the risk level of a rule. |
| GetComplianceSummary | GetComplianceSummary | Queries the compliance summary for the current account. |
| Multiple accounts | Multiple accounts | |
| CreateAggregateConfigRule | CreateAggregateConfigRule | Creates a rule for a specified account group. You can create a rule from a template or create a custom rule using Function Compute. The rule checks your resources for compliance. After a rule is created, it automatically runs once. Cloud Config then runs evaluations based on the rule's trigger. You can also run evaluations manually. |
| UpdateAggregateConfigRule | UpdateAggregateConfigRule | Modifies the description, input parameters, and risk level of a rule in a specified account group. |
| ListAggregateConfigRules | ListAggregateConfigRules | Queries the rules in a specified account group. |
| GetAggregateConfigRule | GetAggregateConfigRule | Queries the details of a specific rule in a specified account group. |
| ListAggregateConfigRuleEvaluationResults | ListAggregateConfigRuleEvaluationResults | Queries the evaluation results of a rule for resources in a specified account group. |
| ListAggregateResourceEvaluationResults | ListAggregateResourceEvaluationResults | Queries the rule evaluation results for resources in a specified account group. |
| GetAggregateComplianceSummary | GetAggregateComplianceSummary | Queries the compliance summary for a specified account group. |
| ListManagedRules | ListManagedRules | Queries the rule templates that are supported by Cloud Config. |
| GetManagedRule | GetManagedRule | Queries the details of a specified rule template. |
| ListPreManagedRules | ListPreManagedRules | Queries the proactive rules supported by Cloud Config. |
| EvaluatePreConfigRules | EvaluatePreConfigRules | Executes evaluation rules to perform compliance pre-checks on resources. |
Compliance packages
|
API |
Title |
Description |
| Single account | Single account | |
| CreateCompliancePack | CreateCompliancePack | Creates a compliance package for the current account. |
| UpdateCompliancePack | UpdateCompliancePack | Updates the configuration of a specified compliance pack in the current account. |
| ListCompliancePacks | ListCompliancePacks | Lists the compliance packs for the current account. |
| GetCompliancePack | GetCompliancePack | Queries the details of a specific compliance package. |
| DeleteCompliancePacks | DeleteCompliancePacks | Deletes one or more compliance packages. |
| GetConfigRuleComplianceByPack | GetConfigRuleComplianceByPack | Queries the compliance statistics for rules in a specified compliance package. |
| GetResourceComplianceByPack | GetResourceComplianceByPack | Queries the compliance results for resources in a compliance package. |
| DetachConfigRuleToCompliancePack | DetachConfigRuleToCompliancePack | This operation detaches one or more rules from a compliance package. |
| Multiple accounts | Multiple accounts | |
| CreateAggregateCompliancePack | CreateAggregateCompliancePack | Creates a compliance pack for a specified account group. |
| UpdateAggregateCompliancePack | UpdateAggregateCompliancePack | Updates a compliance pack in a specified account group. |
| ListAggregateCompliancePacks | ListAggregateCompliancePacks | Queries the compliance packs in a specified account group. |
| GetAggregateCompliancePack | GetAggregateCompliancePack | Queries the details of a compliance pack in a specified account group. |
| DeleteAggregateCompliancePacks | DeleteAggregateCompliancePacks | Deletes the compliance packages of an account group. |
| GenerateAggregateCompliancePackReport | GenerateAggregateCompliancePackReport | Generates an assessment report for a specified compliance package in a specified account group. |
| GetAggregateResourceComplianceByPack | GetAggregateResourceComplianceByPack | Queries the compliance statistics for resources in a specified compliance package within a specified account group. |
| GetAggregateConfigRuleComplianceByPack | GetAggregateConfigRuleComplianceByPack | Queries the compliance results of rules in a specified compliance pack within a specified account group. |
| ListCompliancePackTemplates | ListCompliancePackTemplates | Queries the details of all compliance pack templates provided by CloudConfig. |
Remediation settings
|
API |
Title |
Description |
| Single account | Single account | |
| CreateRemediation | CreateRemediation | Creates a remediation for an existing rule. |
| UpdateRemediation | UpdateRemediation | Updates the specified remediation setting. |
| DeleteRemediations | DeleteRemediations | Deletes specified remediation settings. |
| StartRemediation | StartRemediation | Manually execute the specified rule remediation. |
| Multiple accounts | Multiple accounts | |
| CreateAggregateRemediation | CreateAggregateRemediation | Creates a remediation for a rule in a specified account group. |
| UpdateAggregateRemediation | UpdateAggregateRemediation | Updates a specified rule remediation. |
| ListAggregateRemediations | ListAggregateRemediations | Queries the remediations in a specified account group. |
| DeleteAggregateRemediations | DeleteAggregateRemediations | Deletes the remediation settings for a rule in a specified account group. |
| StartAggregateRemediation | StartAggregateRemediation | Manually run remediation for a specified account group rule. |
| GetRemediationTemplate | GetRemediationTemplate | Queries the details of an automatic remediation template. |
Delivery channels
|
API |
Title |
Description |
| Single account | Single account | |
| CreateConfigDeliveryChannel | CreateConfigDeliveryChannel | Creates a delivery channel to deliver resource data to Simple Log Service (SLS), Object Storage Service (OSS), or Simple Message Queue (formerly MNS). |
| UpdateConfigDeliveryChannel | UpdateConfigDeliveryChannel | This operation modifies a delivery channel for the current account. |
| ListConfigDeliveryChannels | ListConfigDeliveryChannels | Returns a list of delivery channels. |
| GetConfigDeliveryChannel | GetConfigDeliveryChannel | Queries the details of a specified delivery channel. |
| Multiple accounts | Multiple accounts | |
| CreateAggregateConfigDeliveryChannel | CreateAggregateConfigDeliveryChannel | Creates a delivery channel for a specified account group to deliver resource data to Simple Log Service (SLS), Object Storage Service (OSS), or Simple Message Queue (formerly MNS). |
Tags
|
API |
Title |
Description |
| ListIntegratedService | ListIntegratedService | Queries the services integrated with CloudConfig and their statuses. |
Integrated services
|
API |
Title |
Description |
| GetConfigurationRecorder | GetConfigurationRecorder | Queries the status of the Cloud Config service and the resource monitoring scope for the current account. |
| StartConfigurationRecorder | StartConfigurationRecorder | Enables Cloud Config to monitor the resources of your Alibaba Cloud account. |
Service settings
|
API |
Title |
Description |
| CreateReportTemplate | Create Report Template | Create a compliance report template for the current UID. |
| GetReportTemplate | Retrieve Compliance Report Template Details | Retrieve details of a compliance report template. |
| UpdateReportTemplate | Update Compliance Report template | Updates a compliance report template. |
| ListReportTemplates | Batch retrieve compliance report template details | Queries the details of compliance report templates in batches. |
| DeleteReportTemplate | Delete a Compliance Report template | Deletes a compliance report template. |
| GenerateReportFromTemplate | Generate a report based on a report template | Generate a report ID from a report template. |
| GetReportFromTemplate | Obtain the latest report generated based on a report template. | Retrieves a report generated from a report template. |
| TriggerReportSend | Latest report on completed real-time Testing Notifications by template ID | Sends a real-time test notification. |
Report templates
|
API |
Title |
Description |
| DryRunConfigRule | Dry run a proactive compliance precheck rule | Performs a dry run of a proactive compliance precheck rule. |
| DescribeDiscoveredResourceBatch | DescribeDiscoveredResourceBatch | This operation retrieves the details of multiple resources in a batch. |
| DescribeIntegratedServiceStatus | DescribeIntegratedServiceStatus | Queries the authorization status of an integrated cloud service. |
| GetResourceConfigurationSample | GetResourceConfigurationSample | This operation obtains configuration samples for a specified resource type. |
| GetResourceTypeProperties | GetResourceTypeProperties | This operation retrieves the property descriptions for a specified resource type. |
| ListAggregateRecommendManagedRules | ListAggregateRecommendManagedRules | This operation retrieves the list of recommended managed rules for an account group. |
| ListConfigRuleOperators | ListConfigRuleOperators | Lists the operators available for Cloud Config rules. |
| ListRecommendManagedRules | ListRecommendManagedRules | This operation obtains a list of recommended managed rules. |
| StartConfigRuleEvaluationByResource | StartConfigRuleEvaluationByResource | Starts a re-evaluation of a single resource. |
| ActiveAggregateConfigRules | ActiveAggregateConfigRules | Enables one or more rules in an account group. After a rule is enabled, the rule continues to automatically evaluate resources based on the trigger mechanism. |
| ActiveConfigRules | ActiveConfigRules | Enables a rule in Cloud Config. After a rule is enabled, Cloud Config automatically evaluates the compliance of a resource based on the trigger mechanism of the rule. |
| AttachAggregateConfigRuleToCompliancePack | AttachAggregateConfigRuleToCompliancePack | Adds one or more rules in an account group to a compliance package. |
| AttachConfigRuleToCompliancePack | AttachConfigRuleToCompliancePack | Adds one or more rules to a compliance package. |
| CopyCompliancePacks | CopyCompliancePacks | Replicates compliance packages. |
| CopyConfigRules | CopyConfigRules | Replicates rules. |
| CreateAdvancedSearchFile | CreateAdvancedSearchFile | Creates a downloadable resource file for the current Alibaba Cloud account. |
| DeactiveAggregateConfigRules | DeactiveAggregateConfigRules | Disables one or more rules in an account group. After a rule is disabled, the resource in the rule is no longer evaluated. The compliance evaluation results before the rule is disabled are still displayed. |
| DeactiveConfigRules | DeactiveConfigRules | Disables a rule. After a rule is disabled, the resource in the rule is no longer evaluated. The compliance evaluation results before the rule is disabled are still displayed. |
| DeleteAggregateConfigDeliveryChannel | DeleteAggregateConfigDeliveryChannel | Deletes a delivery channel from an account group. |
| DeleteAggregateConfigRules | DeleteAggregateConfigRules | Deletes one or more rules from an account group. You can delete a rule in the Cloud Config console. After you delete the rule, the configurations of the rule are deleted. |
| DeleteAggregators | DeleteAggregators | The management account or delegated administrator account of a resource directory can delete an account group. |
| DeleteConfigDeliveryChannel | DeleteConfigDeliveryChannel | Deletes a delivery channel. |
| DeleteConfigRules | DeleteConfigRules | Deletes rules. |
| DescribeRemediation | DescribeRemediation | This topic provides an example on how to query the details of a remediation configuration whose ID is crr-f381cf0c1c2f004e\\*\\*\\*\\*. |
| DetachAggregateConfigRuleToCompliancePack | DetachAggregateConfigRuleToCompliancePack | Removes one or more rules in an account group from a compliance package. |
| GenerateAggregateConfigRulesReport | GenerateAggregateConfigRulesReport | Generates a compliance evaluation report for the rules in a specified account group. |
| GenerateAggregateResourceInventory | GenerateAggregateResourceInventory | Generates a downloadable inventory for global resources in an account group. |
| GenerateCompliancePackReport | GenerateCompliancePackReport | Generates a compliance evaluation report based on a compliance package. |
| GenerateConfigRulesReport | GenerateConfigRulesReport | Generates a compliance evaluation report for a rule. |
| GetAdvancedSearchFile | GetAdvancedSearchFile | Obtains the last resource advanced search file that is generated within the current account. You can call this operation to obtain the URL of the resource advanced search file. |
| GetAggregateAccountComplianceByPack | GetAggregateAccountComplianceByPack | Queries the compliance evaluation results of member accounts for which a compliance package takes effect in an account group. |
| GetAggregateAdvancedSearchFile | GetAggregateAdvancedSearchFile | Obtains the most recently generated resource advanced search file within a specific account group. |
| GetAggregateCompliancePackReport | GetAggregateCompliancePackReport | Queries the compliance evaluation report that is generated based on a compliance package of an account group. |
| GetAggregateConfigDeliveryChannel | GetAggregateConfigDeliveryChannel | Queries the information about a delivery channel in an account group. |
| GetAggregateConfigRuleSummaryByRiskLevel | GetAggregateConfigRuleSummaryByRiskLevel | Queries the summary of compliance evaluation results by rule risk level in an account group. |
| GetAggregateConfigRulesReport | GetAggregateConfigRulesReport | Downloads the compliance evaluation report in the Excel format to your on-premises machine. This allows you to assign tasks and modify incompliant resource configurations. |
| GetAggregateResourceComplianceByConfigRule | GetAggregateResourceComplianceByConfigRule | Queries compliance evaluation results based on the rules in a compliance package in an account group. |
| GetAggregateResourceComplianceGroupByRegion | GetAggregateResourceComplianceGroupByRegion | Queries the evaluation results grouped by resource type for an account group rule. |
| GetAggregateResourceComplianceGroupByResourceType | GetAggregateResourceComplianceGroupByResourceType | Queries the evaluation results grouped by resource type for an account group rule. |
| GetAggregateResourceCountsGroupByRegion | GetAggregateResourceCountsGroupByRegion | Queries the statistics on the resources in an account group by region. |
| GetAggregateResourceCountsGroupByResourceType | GetAggregateResourceCountsGroupByResourceType | Queries the statistics on the resources in an account group by resource type. |
| GetAggregateResourceInventory | GetAggregateResourceInventory | Obtains the last resource inventory that is generated on the Global Resources page within the current account group. |
| GetCompliancePackReport | GetCompliancePackReport | Queries the compliance evaluation report that is generated based on a compliance package. |
| GetConfigRulesReport | GetConfigRulesReport | Downloads the compliance evaluation report in the Excel format to your on-premises machine. This allows you to assign tasks and modify incompliant resource configurations. |
| GetDiscoveredResourceCountsGroupByRegion | GetDiscoveredResourceCountsGroupByRegion | Queries the statistics on resources by region. |
| GetDiscoveredResourceCountsGroupByResourceType | GetDiscoveredResourceCountsGroupByResourceType | Queries the statistics on resources by resource type. |
| GetIntegratedServiceStatus | GetIntegratedServiceStatus | Queries the integration status of a specific cloud service. |
| GetResourceComplianceByConfigRule | GetResourceComplianceByConfigRule | Queries the compliance summary based on the compliance evaluation result of a rule. |
| GetResourceComplianceGroupByRegion | GetResourceComplianceGroupByRegion | Queries compliance evaluation results of resources based on a rule and displays the evaluation results grouped by region. |
| GetResourceComplianceGroupByResourceType | GetResourceComplianceGroupByResourceType | Queries compliance evaluation results of resources based on a rule and displays the evaluation results grouped by resource type. |
| IgnoreAggregateEvaluationResults | IgnoreAggregateEvaluationResults | Ignores the evaluation results of some resources in an account group based on a specific rule. You can also specify a time period for ignoring the evaluation results. After the period elapses, the evaluation results of the resources based on the rule are automatically displayed. |
| ListAggregateConfigDeliveryChannels | ListAggregateConfigDeliveryChannels | Queries the information about all delivery channels in an account group. |
| ListAggregateConfigRuleEvaluationStatistics | ListAggregateConfigRuleEvaluationStatistics | Queries the statistics of compliance evaluation results of an account group. |
| ListAggregateRemediationExecutions | ListAggregateRemediationExecutions | Queries the remediation records of a rule in an account group. |
| ListAggregateResourceRelations | ListAggregateResourceRelations | Queries a list of the resources of a specific resource in an account group. |
| ListAggregators | ListAggregators | Queries all account groups within the current management account or delegated administrator account. |
| ListConfigRuleEvaluationStatistics | ListConfigRuleEvaluationStatistics | Queries the statistics of compliance evaluation results of the current Alibaba Cloud account. |
| ListRemediationExecutions | ListRemediationExecutions | Queries the remediation records of a rule. |
| ListRemediationTemplates | ListRemediationTemplates | Queries a list of remediation templates for a managed rule. |
| ListRemediations | ListRemediations | Queries the information about the execution of remediation templates. |
| ListResourceRelations | ListResourceRelations | Queries a list of resources that associate with a specific resource. |
| ListResourcesByAdvancedSearch | ListResourcesByAdvancedSearch | Obtains resources based on the fields in the resource properties by using a SELECT statement. |
| ListTagResources | ListTagResources | Queries the tags attached to resources in Cloud Config. |
| PutEvaluations | PutEvaluations | Submits the evaluation results of a rule from Function Compute. |
| RevertAggregateEvaluationResults | RevertAggregateEvaluationResults | Re-evaluates resources that are evaluated based on a rule after the evaluation results on some resources of an ignored rule in an account group are resumed. |
| RevertEvaluationResults | RevertEvaluationResults | Re-evaluates resources that are evaluated based on a rule after the evaluation results on some resources of an ignored rule are resumed. |
| StartAggregateConfigRuleEvaluation | StartAggregateConfigRuleEvaluation | Re-evaluates the compliance of resources based on a rule or based on all rules in a compliance package in a specific account group. |
| StopConfigurationRecorder | StopConfigurationRecorder | Deactivates Cloud Config. |
| TagResources | TagResources | Attaches tags to CloudConfig rules, account groups, and compliance packages. |
| UntagResources | UntagResources | Detaches tags from resources in Cloud Config. |
| UpdateAggregateConfigDeliveryChannel | UpdateAggregateConfigDeliveryChannel | Modifies a delivery channel in an account group. |
| UpdateConfigurationRecorder | UpdateConfigurationRecorder | Modifies the resource monitoring scope of the current account. |
| UpdateIntegratedServiceStatus | UpdateIntegratedServiceStatus | Enables or disables the integration of a cloud service. |