When you enable Cloud Config, the QuickStartCompliancePack compliance package is automatically available. It checks your cloud resources against best practices for cloud resource management and administration. The following table lists the default rules in this package.
|
Rule Name |
Rule Description |
|
Compliant if the Alibaba Cloud account has no AccessKey in any state. AccessKeys on the root account carry unrestricted permissions and pose a severe risk if leaked. Use RAM user AccessKeys with appropriate access control instead. |
|
|
Compliant if an active trail in ActionTrail monitors all regions and all event types. For a member account in a resource directory, the account is also compliant if an administrator creates a trail that covers all member accounts. |
|
|
Compliant if MFA is enabled on the Alibaba Cloud account. Enable MFA to mitigate the risk of unauthorized access. |
|
|
Compliant if no public IPv4 address or elastic IP address (EIP) is directly attached to the ECS instance. |
|
|
Compliant if the bucket ACL is not set to public-read. Public-read access increases the risk of data leaks. |
|
|
Do not grant super administrator (Admin) permissions to RAM users |
Compliant if no RAM user, RAM user group, or RAM role has administrative permissions for all actions on all resources. Grant only the minimum required permissions. |
|
Compliant if MFA is enabled for logon authentication. |
|
|
Rotate the AccessKeys of RAM users within a specified period |
Compliant if the AccessKey was created or last used within a specified number of days. The default is 90 days. |
|
Compliant if the RAM user has at most one active AccessKey older than a specified number of days. During key rotation, a user may temporarily have two active AccessKeys. |
|
|
Ensure the whitelist of an RDS instance with a public IP address is not open to all sources |
Compliant if the RDS instance either has no public IP address or its whitelist does not allow access from all source IP addresses. |