Cloud Config:ComplianceCheckForISO-27001

Rule name

Rule description

Requirement No.

Requirement description

ram-user-login-check

Checks whether one of the console access and API access features is enabled for each RAM user. If so, the evaluation result is Compliant.

A.6.1.2

Segregation of duties

ram-user-no-policy-check

Checks whether a policy is attached to each RAM user. If so, the evaluation result is Compliant. We recommend that RAM users inherit permissions from RAM user groups or roles.

A.6.1.2

Segregation of duties

ram-group-in-use-check

Checks whether each RAM user group includes at least one RAM user and at least one policy is attached to the RAM user group. If so, the evaluation result is Compliant.

• A.6.1.2

• A.9.1.1

• A.9.2.1

• A.9.2.2

• A.9.2.3

• Segregation of duties

• Access control policy

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

ram-group-has-member-check

Checks whether each RAM user group contains at least one RAM user. If so, the evaluation result is Compliant.

• A.6.1.2

• A.9.1.1

• A.9.2.1

• A.9.2.2

• A.9.2.3

• Segregation of duties

• Access control policy

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

ram-policy-no-statements-with-admin-access-check

Checks whether the Action parameter of each RAM user, RAM user group, and RAM role is not set to *. If so, the evaluation result is Compliant. An asterisk (*) indicates the super administrator permissions.

• A.6.1.2

• A.9.1.1

• A.9.2.1

• A.9.2.2

• A.9.2.3

• A.9.4.1

• A.9.4.5

• A.18.1.3

• Segregation of duties

• Access control policy

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

• Information access restriction

• Access control to program source code

• Protection of records

ram-policy-in-use-check

Checks whether each policy is attached to at least one RAM user group, RAM role, or RAM user. If so, the evaluation result is Compliant.

• A.6.1.2

• A.9.2.1

• A.9.2.2

• A.9.2.3

• A.9.4.5

• Segregation of duties

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

• Access control to program source code

ecs-instance-enabled-security-protection

Allows you to install a CloudMonitor agent on an instance to provide security protection services. If a CloudMonitor agent is installed on an instance, the evaluation result is Compliant. This rule does not apply to ECS instances that are not running.

• A.8.1.1

• A.8.1.2

• A.12.1.2

• A.12.5.1

• A.12.6.1

• A.14.1.1

• A.14.2.1

• A.16.1.2

• Inventory of assets

• Ownership of assets

• Change management

• Installation of software on operational systems

• Management of technical vulnerabilities

• Information security requirements analysis and specification

• Secure development policy

• Reporting information security events

required-tags

Checks whether all resources have a specified tag. If so, the evaluation result is Compliant. You can specify a maximum of ten tags. Tag keys and values are case-sensitive. You can specify only one tag value for a tag key.

• A.8.1.1

• A.8.1.2

• Inventory of assets

• Ownership of assets

resources-inherit-resourcegroup-from-ecs-instance

Checks whether related resources are associated with Elastic Compute Service (ECS) instances and whether resource information is consistent with resource group information if the related resources inherit the resource group to which the ECS instances belong. If so, the evaluation result is Compliant. This rule does not apply to related resources that are not associated with ECS instances.

• A.8.1.1

• A.8.1.2

• Inventory of assets

• Ownership of assets

resource-group-default-used-check

Checks whether the resource group of each resource is not a default resource group. If so, the evaluation result is Compliant. If a resource has no resource group, the evaluation result is Not Applicable.

• A.8.1.1

• A.8.1.2

• Inventory of assets

• Ownership of assets

root-ak-check

Checks whether an AccessKey pair is created for each Alibaba Cloud account. If not, the evaluation result is Compliant.

• A.9.1.1

• A.9.2.1

• A.9.2.2

• A.9.2.3

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.18.1.3

• Access control policy

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Protection of records

ram-user-no-policy-check

Checks whether a policy is attached to each RAM user. If so, the evaluation result is Compliant. We recommend that RAM users inherit permissions from RAM user groups or roles.

• A.6.1.2

• A.9.1.1

• Segregation of duties

• Access control policy

elasticsearch-instance-enabled-public-check

Checks whether Internet access is enabled for each Elasticsearch cluster. If so, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.13.1.1

• A.13.1.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Network controls

• Segregation in networks

• Protection of records

• Privacy and protection of personally identifiable information

oss-bucket-public-write-prohibited

Checks whether the bucket policy of each OSS bucket denies read and write access from the Internet. If so, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

fc-service-internet-access-disable

Checks whether Internet access is disabled for Function Compute. If so, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

ecs-running-instances-in-vpc

Checks whether the ECS instance that is recommended resides in a virtual private cloud (VPC). If an ECS instance resides in a VPC, the evaluation result is Compliant. If you configure the required parameter and the VPC setting for the ECS instance matches the specified value, the evaluation result is Compliant. This rule does not apply to ECS instances that are not in the running state.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

adb-public-access-check

Checks whether Internet access is disabled for each AnalyticDB instance. If so, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

rds-public-access-check

Checks whether no public endpoint is configured for each RDS instance. If so, the evaluation result is Compliant. To prevent cyberattacks, we recommend that you do not configure direct access to RDS instances in production environments over the Internet.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

ack-cluster-public-endpoint-check

Checks whether a public endpoint is configured for the API server in each Container Service for Kubernetes (ACK) cluster. If not, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

ecs-instance-meta-data-mode-check

Checks whether the security-enhanced mode is forcibly used when the metadata of each ECS instance is accessed. If so, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.4

• Access to networks and network services

• Use of privileged utility programs

fc-service-vpc-binding

Checks whether the functions of a service can be invoked only in specific VPCs. If so. the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

oss-bucket-public-read-prohibited

Checks whether the ACL policy of each OSS bucket denies read access from the Internet. If so, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

ecs-running-instance-no-public-ip

Checks whether no public IPv4 addresses or elastic IP addresses are assigned to the ECS instances that are running. If so, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

polardb-cluster-address-no-public

Checks whether the Internet access is enabled for the endpoints of each PolarDB cluster. If not, the evaluation result is Compliant.

• A.9.1.2

• A.9.4.1

• A.9.4.4

• A.9.4.5

• A.13.1.1

• A.13.2.3

• A.18.1.3

• A.18.1.4

• Access to networks and network services

• Information access restriction

• Use of privileged utility programs

• Access control to program source code

• Network controls

• Electronic messaging

• Protection of records

• Privacy and protection of personally identifiable information

root-mfa-check

Checks whether multi-factor authentication (MFA) is enabled for each Alibaba Cloud account. If so, the evaluation result is Compliant.

• A.9.2.1

• A.9.2.2

• A.9.2.3

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

ram-user-mfa-check

Checks whether MFA is enabled in the logon settings of each RAM user for which the console access feature is enabled. If so, the evaluation result is Compliant.

• A.9.2.1

• A.9.2.2

• A.9.2.3

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

security-center-version-check

Checks whether Security Center of Enterprise Edition or a more advanced edition is used. If so, the evaluation result is Compliant.

• A.12.2.1

• A.12.4.1

• A.12.6.1

• A.16.1.1

• A.16.1.2

• Controls against malware

• Event logging

• Management of technical vulnerabilities

• Responsibilities and procedures

• Reporting information security events

kms-secret-rotation-enabled

Checks whether the automatic rotation feature is enabled for Key Management Service (KMS) secrets. If so, the evaluation result is Compliant. This rule does not apply to a common key.

• A.9.2.1

• A.9.2.2

• A.9.2.3

• A.18.1.5

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

• Regulation of cryptographic controls

kms-secret-last-rotation-date-check

Checks whether the automatic rotation feature is enabled for the KMS secrets and the automatic rotation is performed based on the specified rotation period. If so, the evaluation result is Compliant. This rule does not apply to generic secrets because periodic key rotation cannot be enabled for a generic secret in KMS.

• A.9.2.1

• A.9.2.2

• A.9.2.3

• A.18.1.5

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

• Regulation of cryptographic controls

ram-password-policy-check

Checks whether the settings of password policies that are configured for each RAM user meet specified values. If so, the evaluation result is Compliant.

• A.9.2.1

• A.9.2.2

• A.9.2.3

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

ram-user-ak-create-date-expired-check

Checks whether the interval between the time when the AccessKey pair of a RAM user was created and the time when the compliance check started is less than or equal to a specified number of days. If so, the evaluation result is Compliant. Default value: 90. Unit: days.

• A.9.2.1

• A.9.2.2

• A.9.2.3

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

actiontrail-trail-intact-enabled

Checks whether an active trail exists in ActionTrail and events of all types that are generated in all regions are tracked. If so, the evaluation result is Compliant. If the administrator of a resource directory has created a trail that applies to all members, the evaluation result is Compliant.

• A.9.2.1

• A.9.2.2

• A.9.2.3

• A.12.4.1

• A.12.4.2

• A.12.4.3

• A.14.1.1

• A.14.2.3

• A.16.1.2

• A.16.1.7

• User registration and de-registration

• User access provisioning

• Management of privileged access rights

• Event logging

• Protection of log information

• Administrator and operator logs

• Information security requirements analysis and specification

• Technical review of applications after operating platform changes

• Reporting information security events

• Collection of evidence

rds-instance-enabled-tde

Checks whether the Transparent Data Encryption (TDE) feature is enabled in the data security settings of each ApsaraDB RDS instance. If so, the evaluation result is Compliant. This rule does not apply to instance types or editions that do not support the TDE feature.

A.10.1.1

Policy on the use of cryptographic controls

oss-bucket-only-https-enabled

Checks whether the bucket policy of each OSS bucket allows read and write access over HTTPS and denies access over HTTP. If so, the evaluation result is Compliant. This rule does not apply to OSS buckets that do not have a bucket policy.

• A.10.1.1

• A.13.2.1

• A.14.1.2

• Policy on the use of cryptographic controls

• Information transfer policies and procedures

• Securing application services on public networks

oss-bucket-server-side-encryption-enabled

Checks whether server-side encryption is enabled for each OSS bucket. If so, the evaluation result is Compliant.

• A.10.1.1

• A.12.4.3

• A.16.1.7

• Policy on the use of cryptographic controls

• Administrator and operator logs

• Collection of evidence

slb-aliyun-certificate-required

Checks whether each Server Load Balancer (SLB) instance uses certificates that are issued by Alibaba Cloud. If so, the evaluation result is Compliant.

• A.10.1.1

• A.13.2.1

• A.14.1.2

• Policy on the use of cryptographic controls

• Information transfer policies and procedures

• Securing application services on public networks

nas-filesystem-encrypt-type-check

Checks whether the server-side encryption feature is enabled for the File Storage NAS (NAS) file systems that you create. If so, the evaluation result is Compliant.

A.10.1.1

Policy on the use of cryptographic controls

ecs-disk-encrypted

Checks whether disk encryption is enabled for each ECS instance. If so, the evaluation result is Compliant.

A.10.1.1

Policy on the use of cryptographic controls

elasticsearch-instance-enabled-data-node-encryption

Checks whether the disk encryption feature is enabled for the data nodes of each Elasticsearch instance. If so, the evaluation result is Compliant.

A.10.1.1

Policy on the use of cryptographic controls

polardb-cluster-enabled-tde

Checks whether the TDE feature is enabled in the data security settings of each PolarDB cluster. If so, the evaluation result is Compliant.

A.10.1.1

Policy on the use of cryptographic controls

ots-instance-all-table-encrypted

Checks whether the encryption feature is enabled for all tables on the Tablestore instance. If so, the evaluation result is Compliant.

A.10.1.1

Policy on the use of cryptographic controls

maxcompute-project-encryption-enabled

Checks whether encryption is enabled for each MaxCompute project. If so, the evaluation result is Compliant. This rule does not apply to a project that is frozen.

A.10.1.1

Policy on the use of cryptographic controls

kms-key-rotation-enabled

Checks whether the automatic rotation feature is enabled for the customer master keys (CMKs) in KMS. If so, the evaluation result is Compliant. This rule does not apply to a service key. This rule does not apply to a Bring Your Own Key (BYOK).

• A.10.1.2

• A.18.1.5

• Key management

• Regulation of cryptographic controls

kms-key-state-not-pending-deletion

Checks whether the status of a KMS CMK is set to pending deletion. If so, the evaluation result is Compliant.

• A.10.1.2

• A.18.1.5

• Key management

• Regulation of cryptographic controls

ssl-certificate-expired-check

Checks whether the remaining validity periods of all SSL certificates are greater than the specified value. If so, the evaluation result is compliant. Default value: 30. Unit: day.

• A.10.1.2

• A.13.1.1

• A.13.1.3

• A.13.2.1

• A.13.2.3

• A.14.1.2

• A.18.1.4

• Key management

• Network controls

• Segregation in networks

• Information transfer policies and procedures

• Electronic messaging

• Securing application services on public networks

• Privacy and protection of personally identifiable information

polardb-cluster-maintain-time-check

Checks whether the maintenance period of each PolarDB cluster matches one of the specified time ranges. If so, the evaluation result is Compliant. If the peak hours of your business overlap with the maintenance period, your business may be affected.

A.12.1.2

Change management

rds-instance-maintain-time-check

Checks whether the maintenance period of each RDS instance matches one of the specified time ranges. If so, the evaluation result is Compliant. If the peak hours of your business overlap with the maintenance period, your business may be affected.

A.12.1.2

Change management

ecs-snapshot-policy-timepoints-check

Checks whether the snapshot creation time that you specified for each automatic snapshot policy falls in a specified time range. If so, the evaluation result is Compliant. When a snapshot is being created for an Elastic Block Storage (EBS) device, the I/O performance of the device degrades by up to 10%. This can result in a transient I/O speed decrease. We recommend that you create automatic snapshots during off-peak hours.

A.12.1.2

Change management

fc-function-settings-check

Checks whether the functions of Function Compute 2.0 meet the specified requirements. If so, the evaluation result is Compliant.

A.12.1.3

Capacity management

vswitch-available-ip-count

Checks whether the number of available IP addresses of each vSwitch is greater than a specified value. If so, the evaluation result is Compliant.

A.12.1.3

Capacity management

ecs-disk-auto-snapshot-policy

Checks whether an automatic snapshot policy is specified for each ECS disk. If so, the evaluation result is Compliant.

A.12.3.1

Information backup

nas-filesystem-enable-backup-plan

Checks whether a backup plan is created for each File Storage NAS file system. If so, the evaluation result is Compliant.

A.12.3.1

Information backup

adb-cluster-log-backup-enabled

Checks whether the log backup feature is enabled for each AnalyticDB cluster. If so, the evaluation result is Compliant.

A.12.3.1

Information backup

rds-instance-enabled-log-backup

Checks whether log backup is enabled for an ApsaraDB RDS instance. If so, the evaluation result is Compliant.

A.12.3.1

Information backup

redis-instance-backup-log-enabled

Checks whether incremental backup is enabled for each ApsaraDB for Redis instance. If so, the evaluation result is Compliant. This rule applies only to Tair instances or instances of ApsaraDB for Redis Enhanced Edition (Tair).

A.12.3.1

Information backup

oss-zrs-enabled

Checks whether the ZRS feature is enabled for each OSS bucket. If so, the evaluation result is Compliant. If the zone-redundant storage (ZRS) feature is disabled, Object Storage Service (OSS) cannot provide consistent services and ensure data recovery when a data center becomes unavailable.

• A.12.3.1

• A.17.1.2

• A.17.2.1

• Information backup

• Implementing information security continuity

• Availability of information processing facilities

polardb-cluster-level-one-backup-retention

Checks whether the retention period for the level-1 backups of each PolarDB cluster is greater than or equal to a specified number of days. If so, the evaluation result is Compliant. Default value: 7.

A.12.3.1

Information backup

oss-bucket-versioning-enabled

Checks whether the versioning feature is enabled for an OSS bucket. If the versioning feature is disabled, data may fail to be restored when the data is overwritten or deleted. If the versioning feature is enabled, the evaluation result is Compliant.

• A.12.4.1

• A.12.4.2

• A.17.1.2

• Event logging

• Protection of log information

• Implementing information security continuity

slb-instance-log-enabled

Checks whether the access log feature is enabled for each SLB instance. If so, the evaluation result is Compliant. This rule does not apply to SLB instances for which Layer 7 monitoring is disabled.

• A.12.4.1

• A.14.1.1

• A.14.2.3

• A.16.1.7

• Event logging

• Information security requirements analysis and specification

• Technical review of applications after operating platform changes

• Collection of evidence

vpc-flow-logs-enabled

Checks whether the flow log feature is enabled for each VPC. If so, the evaluation result is Compliant.

• A.12.4.1

• A.14.1.1

• A.14.2.3

• A.16.1.7

• Event logging

• Information security requirements analysis and specification

• Technical review of applications after operating platform changes

• Collection of evidence

api-gateway-group-log-enabled

Checks whether log storage is enabled for API groups of API Gateway. If so, the evaluation result is Compliant.

A.12.4.1

Event logging

oss-bucket-logging-enabled

Checks whether the logging feature is enabled for each OSS bucket on the Logs page. If so, the evaluation result is Compliant.

A.12.4.1

Event logging

polardb-cluster-enabled-auditing

Checks whether the SQL audit feature is enabled for each PolarDB cluster. If so, the evaluation result is Compliant.

• A.12.4.1

• A.14.2.3

• A.16.1.1

• A.16.1.7

• Event logging

• Technical review of applications after operating platform changes

• Responsibilities and procedures

• Collection of evidence

polardb-cluster-log-backup-retention

Checks whether the retention period for the level-1 backups of each PolarDB cluster is greater than or equal to a specified number of days. If so, the evaluation result is Compliant. Default value: 30. Unit: days. If log backup is not enabled or the backup retention period is less than the specified number of days, the evaluation result is Non-compliant.

A.12.4.2

Protection of log information

ecs-instance-updated-security-vul

Checks whether unfixed vulnerabilities of a specified type or a specified level are detected by Security Center on an ECS instance. This rule does not apply to ECS instances that are not running.

A.12.6.1

Management of technical vulnerabilities

ecs-security-group-risky-ports-check-with-protocol

Checks whether 0.0.0.0/0 is added to the IP address whitelist of each security group and risky ports are disabled. If so, the evaluation result is Compliant. Checks whether 0.0.0.0/0 is not added to the IP address whitelist of each security group. If so, the evaluation result is Compliant regardless of whether risky ports are disabled. Checks whether a risky port is denied by an authorization policy with a higher priority. If so, the evaluation result is Compliant. This rule does not apply to Alibaba Cloud services other than ECS or security groups that are used by virtual network operators (VNOs).

• A.13.1.1

• A.13.1.3

• A.13.2.3

• A.18.1.4

• Network controls

• Segregation in networks

• Electronic messaging

• Privacy and protection of personally identifiable information

polardb-public-access-check

Checks whether 0.0.0.0/0 is added to the IP whitelist of each PolarDB instance. If not, the evaluation result is Compliant.

• A.13.1.1

• A.13.1.3

• A.18.1.3

• A.18.1.4

• Network controls

• Segregation in networks

• Protection of records

• Privacy and protection of personally identifiable information

polardb-cluster-enabled-ssl

Checks whether the SSL encryption feature is enabled for each PolarDB cluster. If so, the evaluation result is Compliant.

• A.13.2.1

• A.14.1.2

• Information transfer policies and procedures

• Securing application services on public networks

cdn-domain-tls13-enabled

Checks whether the Transport Layer Security (TLS) 1.3 protocol is enabled for each domain name accelerated by Alibaba Cloud CDN. If so, the evaluation result is compliant.

• A.13.2.1

• A.14.1.2

• Information transfer policies and procedures

• Securing application services on public networks

dts-instance-sync-job-ssl-enabled

Checks whether SSL secure connections are used for the source and destination databases of each synchronization task on a DTS instance. If so, the evaluation result is Compliant. This rule applies only to synchronization tasks.

A.13.2.1

Information transfer policies and procedures

fc-function-custom-domain-and-tls-enable

Checks whether each Function Compute function is bound to a custom domain name and a specified version of TLS is enabled for the function. If so, the evaluation result is Compliant.

• A.13.2.1

• A.14.1.2

• Information transfer policies and procedures

• Securing application services on public networks

slb-listener-https-enabled

Checks whether an HTTPS listener is enabled on the specified ports of each SLB instance. If so, the evaluation result is Compliant. This rule does not apply to SLB instances for which only a TCP or UDP listener is enabled.

• A.13.2.1

• A.14.1.2

• Information transfer policies and procedures

• Securing application services on public networks

ack-cluster-node-monitorenabled

Checks whether a CloudMonitor agent is installed on all nodes in each ACK cluster and runs as expected. If so, the evaluation result is Compliant.

• A.14.2.1

• A.16.1.1

• A.16.1.2

• Secure development policy

• Responsibilities and procedures

• Reporting information security events

ecs-instance-monitor-enabled

Checks whether a CloudMonitor agent is installed on each running ECS instance, and the agent is running as expected. If so, the evaluation result is Compliant. This rule does not apply to ECS instances that are not running.

• A.12.5.1

• A.14.2.1

• A.16.1.1

• A.16.1.2

• Installation of software on operational systems

• Secure development policy

• Responsibilities and procedures

• Reporting information security events

security-center-notice-config-check

Checks whether a notification method is specified for each notification item of Security Center. If so, the evaluation result is compliant.

A.16.1.2

Reporting information security events

vpn-ipsec-connection-status-check

Checks whether the IPsec-VPN connection is established. If so, the evaluation result is Compliant.

A.17.1.2

Implementing information security continuity

slb-delete-protection-enabled

Checks whether the release protection feature is enabled for each SLB instance. If so, the evaluation result is Compliant.

A.17.1.2

Implementing information security continuity

ess-group-health-check

Checks whether the health check feature is enabled for the ECS instances of each scaling group. If so, the evaluation result is Compliant.

• A.17.1.2

• A.17.2.1

• Implementing information security continuity

• Availability of information processing facilities

rds-multi-az-support

Checks whether each ApsaraDB RDS instance uses the multi-zone architecture. If so, the evaluation result is Compliant.

• A.17.1.2

• A.17.2.1

• Implementing information security continuity

• Availability of information processing facilities

polardb-cluster-delete-protection-enabled

Checks whether the deletion protection feature is enabled for each PolarDB cluster. If so, the evaluation result is Compliant. This rule does not apply to clusters that use the subscription billing method.

A.17.1.2

Implementing information security continuity

ack-cluster-deletion-protection-enabled

Checks whether the release protection feature is enabled for each ACK cluster. If so, the evaluation result is Compliant.

A.17.1.2

Implementing information security continuity

polardb-cluster-multi-zone

Checks whether the hot standby cluster feature is enabled for each PolarDB cluster and data of the cluster is distributed across multiple zones. If so, the evaluation result is Compliant.

• A.17.1.2

• A.17.2.1

• Implementing information security continuity

• Availability of information processing facilities

ess-scaling-group-attach-multi-switch

Checks whether at least two vSwitches are associated with each scaling group. If so, the evaluation result is Compliant.

A.17.2.1

Availability of information processing facilities

alb-instance-multi-zone

Checks whether each ALB instance uses the multi-zone architecture. If so, the evaluation result is Compliant. If a failure occurs on an ALB instance when you deploy the instance in only one zone, business may be disrupted.

A.17.2.1

Availability of information processing facilities

ack-cluster-node-multi-zone

Checks whether region-level ACK clusters whose nodes are distributed across three or more zones are used.

A.17.2.1

Availability of information processing facilities

alb-all-listener-health-check-enabled

Checks whether the health check feature is enabled for all listeners and forwarding rules of each ALB instance. If so, the evaluation result is Compliant.

A.17.2.1

Availability of information processing facilities