All Products
Search

This Product

    Cloud Config:UpdateConfigRule

    Document Center

    Cloud Config:UpdateConfigRule

    Last Updated:Nov 26, 2025

    Modifies the description, input parameters, and risk level of a rule.

    Operation description

    This topic provides an example of how to change the risk level of the rule cr-a260626622af0005**** to 3 (low risk).

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    config:UpdateConfigRule

    update

    *Rule

    acs:config:*:{#accountId}:rule/{#ConfigRuleId}

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    ConfigRuleId

    string

    Yes

    The rule ID.

    For more information, see ListConfigRules.

    cr-a260626622af0005****
    Description

    string

    No

    The description of the rule. The description can be up to 500 characters in length.

    最多可以定义6组标签。如果资源同时具有指定的所有标签，则视为“合规”。
    InputParameters

    object

    No

    The input parameters of the rule.

    {"tag1Key":"ECS","tag1Value":"test"}
    MaximumExecutionFrequency

    string

    No

    The frequency at which the rule is run. Valid values:

    • One_Hour: 1 hour.

    • Three_Hours: 3 hours.

    • Six_Hours: 6 hours.

    • Twelve_Hours: 12 hours.

    • TwentyFour_Hours (default): 24 hours.

    Note

    This parameter is required when ConfigRuleTriggerTypes is set to ScheduledNotification.

    One_Hour
    ResourceTypesScope

    array

    No

    The resource types that the rule evaluates. To specify multiple resource types, separate them with a comma (,).

    ACS::ECS::Instance

    string

    No

    The resource types that the rule evaluates. To specify multiple resource types, separate them with a comma (,).

    ACS::ECS::Instance
    RiskLevel

    integer

    No

    The risk level of the rule. Valid values:

    • 1: high risk.

    • 2: medium risk.

    • 3: low risk.

    3
    ClientToken

    string

    No

    A client token used to ensure the idempotence of the request. You can use a client to generate the token, but you must make sure that the token is unique for different requests. The ClientToken parameter can contain only ASCII characters and cannot be more than 64 characters in length.

    1594295238-f9361358-5843-4294-8d30-b5183fac****
    RegionIdsScope

    string

    No

    The regions where the rule is effective. The rule evaluates only resources in these regions. To specify multiple region IDs, separate them with a comma (,).

    Note

    This parameter applies only to managed rules.

    cn-hangzhou
    ExcludeRegionIdsScope

    string

    No

    The regions where the rule is not effective. The system does not evaluate resources in these regions. To specify multiple region IDs, separate them with a comma (,).

    cn-shanghai
    ExcludeResourceIdsScope

    string

    No

    The resources that are not evaluated by the rule. The system does not evaluate these resources. To specify multiple resource IDs, separate them with a comma (,).

    Note

    This parameter applies only to managed rules.

    lb-t4nbowvtbkss7t326****
    ResourceIdsScope

    string

    No

    The resources that the rule evaluates. To specify multiple resource IDs, separate them with a comma (,).

    lb-5cmbowstbkss9ta03****
    ConfigRuleTriggerTypes

    string

    No

    The trigger type of the rule. Valid values:

    • ConfigurationItemChangeNotification: The rule is triggered by configuration changes.

    • ScheduledNotification: The rule is triggered on a regular basis.

    Note

    This parameter can be modified only for custom rules.

    ConfigurationItemChangeNotification
    ResourceGroupIdsScope

    string

    No

    The resource groups where the rule is effective. The rule evaluates only resources in these resource groups. To specify multiple resource group IDs, separate them with a comma (,).

    Note

    This parameter applies only to managed rules.

    rg-aekzc7r7rhx****
    ExcludeResourceGroupIdsScope

    string

    No

    The resource groups where the rule is not effective. The system does not evaluate resources in these resource groups. To specify multiple resource group IDs, separate them with a comma (,).

    rg-bnczc6r7rml****
    TagKeyScope deprecated

    string

    No

    This parameter is deprecated. Use the TagsScope parameter instead.

    The rule is effective only for resources that have the specified tag.

    Note

    This parameter applies only to managed rules. The TagKeyScope and TagValueScope parameters must be specified at the same time.

    ECS
    TagValueScope deprecated

    string

    No

    This parameter is deprecated. Use the TagsScope parameter instead.

    The rule is effective only for resources that have the specified tag.

    Note

    This parameter applies only to managed rules. The TagKeyScope and TagValueScope parameters must be specified at the same time.

    test
    TagKeyLogicScope

    string

    No

    The logical relationship for the tags that you specify for the TagsScope parameter. For example, if you set the TagsScope parameter to "TagsScope.1.TagKey":"a","TagsScope.1.TagValue":"a","TagsScope.2.TagKey":"b","TagsScope.2.TagValue":"b" and set this parameter to AND, the rule applies only to resources that have both the a:a and b:b tags. If you do not specify this parameter, the OR logic is used by default.

    This parameter also applies to the deprecated TagKeyScope parameter, but this is not recommended. For example, if you set the TagKeyScope parameter to ECS,OSS and set this parameter to AND, the rule applies only to resources that have both the ECS and OSS tags.

    Valid values:

    • AND

    • OR

    Valid values:

    • OR :

      OR

    • AND :

      AND

    AND
    TagsScope

    array<object>

    No

    The tags that are used to filter resources.

    object

    No

    TagKey

    string

    No

    The tag key.

    key-1
    TagValue

    string

    No

    The tag value.

    value-1
    ExcludeTagsScope

    array<object>

    No

    The tags that are used to exclude resources.

    object

    No

    TagKey

    string

    No

    The tag key.

    key-2
    TagValue

    string

    No

    The tag value.

    value-2
    ConfigRuleName

    string

    No

    The name of the rule.

    For more information, see ListAggregateConfigRules.

    存在所有指定标签
    ExtendContent

    string

    No

    The extended content. This parameter is optional. You can use this parameter with a 24-hour trigger period to set the trigger time.

    {"fixedHour":"12"}
    Tag deprecated

    array<object>

    No

    The tags of the resource. This parameter is deprecated. The value that you specify for this parameter does not take effect.

    You can add up to 20 tags.

    object

    No

    The tags of the resource.

    You can add up to 20 tags.

    Key

    string

    No

    The tag key.

    key-1
    Value

    string

    No

    The tag value.

    value-1
    ResourceNameScope

    string

    No

    The names of the resources that the rule evaluates.

    i-xxx

    For more information about common request parameters, see Common parameters.

    Response elements

    Element

    Type

    Description

    Example

    object

    None

    ConfigRuleId

    string

    The rule ID.

    cr-a260626622af0005****
    RequestId

    string

    The request ID.

    6EC7AED1-172F-42AE-9C12-295BC2ADB751

    Examples

    Success response

    JSON format

    {
  "ConfigRuleId": "cr-a260626622af0005****",
  "RequestId": "6EC7AED1-172F-42AE-9C12-295BC2ADB751"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 ExceedMaxRuleCount The maximum number of rules is exceeded.
    400 ConfigRuleNotExists The ConfigRule does not exist. The rule does not exist.
    400 ConfigRuleExists The ConfigRule already exists.
    404 AccountNotExisted Your account does not exist.
    503 ServiceUnavailable The request has failed due to a temporary failure of the server. The request has failed due to a temporary failure of the server.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.