Alibaba Cloud service | Rule template | OOS template ID for remediation | Is Dry Run supported? |
Cloud-native database PolarDB | PolarDB subscription cluster expiration check | None | No |
PolarDB-X1 instance expiration check | None | No |
PolarDB-X2 instance expiration check | None | No |
Enable delete protection for a PolarDB cluster | None | No |
Set a maintenance window for a PolarDB cluster | None | No |
The log backup retention period for PolarDB clusters meets specified requirements | None | No |
The level-2 backup retention period for the PolarDB cluster meets the specified requirements | None | No |
The level-1 backup retention period for the PolarDB cluster meets the specified requirements | None | No |
Use a PolarDB instance in a virtual private cloud (VPC) | None | No |
Use a dedicated PolarDB instance | None | No |
The PolarDB product series is the Cluster Edition. | None | No |
Use a multi-zone PolarDB-X2 instance | None | No |
PolarDB cluster with a stable kernel version | None | No |
The PolarDB database minor version is stable | None | No |
The IP whitelist for a PolarDB instance cannot be set to all network segments | None | Yes |
No PolarDB cluster endpoints are enabled for public access | None | No |
The PolarDB instance has no Internet endpoint, or its IP whitelist is not set to all network segments | None | No |
Set the connection type of PolarDB cluster endpoints to a specified value | None | No |
Set the read/write pattern of the PolarDB cluster endpoint to Read/Write | None | No |
Set the session consistency level for the PolarDB cluster endpoint to a specified value | None | No |
The connection format of the PolarDB cluster endpoint is valid. | None | No |
The connection format for the primary endpoint of the PolarDB cluster is valid. | None | No |
The format of the read-only connection string for the PolarDB cluster is correct | None | No |
Enable a hot standby cluster for a PolarDB cluster | None | No |
Disable automatic addition of new nodes to a read-only endpoint of a PolarDB cluster | None | No |
Enable automatic addition of new nodes to PolarDB cluster endpoints | None | No |
Set the PolarDB cluster endpoints to accept reads on the primary database | None | No |
The transaction splitting status for the PolarDB cluster endpoints is set to Shutdown | None | No |
Enable TDE for a PolarDB cluster | None | No |
Configure SSL encryption for a PolarDB cluster | None | No |
Enable SQL Audit for a PolarDB cluster | None | No |
The default time zone parameter of the PolarDB cluster is not System | None | No |
The description for each account in a PolarDB cluster is not empty | None | No |
ApsaraDB RDS | RDS subscription instance expiration check | None | Yes |
Long-running pay-as-you-go RDS instance check | None | No |
Enable delete protection for an RDS instance | None | No |
The RDS instance is not accessible over the Internet, or the IP whitelist is not set to all network segments | None | No |
The RDS instance is not connected to the Internet, and the IP whitelist is not set to all network segments | None | No |
No outdated RDS instances are used | None | No |
The RDS instance type meets the specified requirements | None | No |
The RDS instance meets the minimum CPU core requirements | None | No |
The RDS instance meets the minimum memory requirements | None | Yes |
The RDS instance meets minimum storage requirements | None | No |
The RDS instance meets the minimum read/write frequency | None | No |
Average connection utilization check for an RDS instance | None | No |
Average CPU utilization check for an RDS instance | None | Yes |
RDS instance average IOPS utilization check | None | No |
Average memory usage check for an RDS instance | None | No |
Idle CPU utilization check for an RDS instance | None | No |
RDS instance idle disk usage check | None | Yes |
Idle memory usage check for an RDS instance | None | No |
Check the remaining storage space of an RDS instance | None | No |
Use a dedicated RDS instance | None | No |
Use an RDS instance that runs in Cluster Edition | None | No |
Use an RDS instance in a virtual private cloud (VPC) | None | No |
The network type of the RDS instance is a virtual private cloud (VPC). | None | No |
The RDS instance has no public IP address | ACS-RDS-ReleaseInstancePublicConnection | No |
Configure the whitelist for an RDS instance | ACS-RDS-BulkyModifySecurityIpsByInstanceIPArray | Yes |
The IP whitelist of an RDS instance does not include the Internet | None | No |
Enable enhanced whitelist mode for an RDS instance | ACS-RDS-BulkyMigrateSecurityIPMode | No |
Use an SSL certificate for an RDS instance | None | No |
Enable SSL and specify a TLS version for an RDS instance | None | No |
Access SQL Server using the database proxy pattern | None | No |
Use a high-availability RDS instance | None | No |
Use a multi-zone RDS instance | None | No |
Automatic switchover configuration check for a primary/standby RDS instance | ACS-RDS-BulkyModifyHASwitchConfig | No |
RDS instance data replication is not asynchronous | None | No |
Create a disaster recovery instance for RDS | None | No |
RDS read/write instance latency check | None | No |
The primary and secondary nodes of an RDS cluster have inconsistent CPU and memory configurations | None | No |
The primary and secondary nodes of the RDS cluster are not configured with the same instance class | None | No |
Enable TDE for an RDS instance | None | No |
Enable TDE for an RDS instance using a custom key | None | No |
Enable disk encryption for an RDS instance | None | No |
RDS PostgreSQL data durability check | ACS-RDS-BulkyModifyParameter | No |
Enable log backup for an RDS instance | None | No |
Enable cross-region backup for an RDS instance | None | No |
RDS instance storage auto-scaling check | ACS-RDS-BulkyModifyDasInstanceConfig | No |
Check if auto scaling is enabled for RDS instances | None | No |
Enable SQL Audit for an RDS instance | ACS-RDS-BulkyModifySQLCollectorPolicy | No |
The SQL audit log for an RDS instance has the required retention period. | ACS-RDS-BulkyModifySQLCollectorRetention | No |
Enable historical events for an RDS instance | ACS-RDS-BulkyModifyActionEventPolicy | No |
Slow SQL statement detection for RDS instances | None | No |
Enable automatic minor version updates for an RDS instance | ACS-RDS-BulkyModifyDBInstanceAutoUpgradeMinorVersion | No |
Set a reasonable maintenance window for an RDS instance | None | No |
The RDS monitoring granularity settings meet the requirements. | None | No |
Create a dynamic ApsaraDB RDS secret for an RDS instance | None | No |
Set the PostgreSQL database parameter log_connections to on | None | No |
Set the PostgreSQL database parameter log_disconnections to on | None | No |
Set the PostgreSQL database parameter log_duration to on | None | No |
Enable security audit for a database instance | None | No |
Enable SQL Audit for a database instance | None | No |
ApsaraDB Tair (Redis-compatible) | Expiration check for Redis subscription instances | None | No |
Enable release protection for a Redis instance | None | No |
Set a reasonable backup time window for a Redis instance | None | No |
Enable incremental backup for a Redis instance | None | No |
Upgrade a Redis instance to the latest minor version | None | No |
Meet the required queries per second (QPS) for a Redis instance | None | No |
The Redis instance meets the specified bandwidth requirements | None | No |
The Redis instance meets the memory capacity requirement | None | No |
Average connection usage check for a Redis instance | None | No |
Average CPU usage of a Redis instance | None | No |
Average memory usage check for Redis instances | None | No |
Use a Redis instance in a VPC | None | No |
The Redis instance does not have a public IP address | ACS-Redis-ReleaseInstancePublicConnection | No |
Do not set the IP whitelist for a Redis instance to all network segments | ACS-Redis-BulkyDeleteSecurityIpFromInstanceIPArray | Yes |
Internet access is not enabled for the Redis instance, or the whitelist is not set to allow access from any source | None | No |
Enable password authentication for a Redis instance | None | No |
Enable SSL encryption for a Redis instance | None | No |
Enable SSL and specify a TLS version for a Redis instance | None | No |
Use a cluster Redis instance | None | No |
The Redis instance is a multi-zone instance | None | No |
The Redis instance has a dual-replica node type | None | No |
Use an Enterprise Edition Redis instance | None | No |
Enable TDE encryption for a Redis instance | None | No |
Enable transparent data encryption (TDE) for a Redis instance with a custom key | None | No |
Disable AOF persistence for a Tair instance | None | No |
Enable the audit log for a Redis instance | ACS-REDIS-BulkyModifyAuditLogConfig | No |
The audit logs for a Redis instance are kept for the required number of days | ACS-REDIS-BulkyModifyAuditLogConfig | No |
Disable high-risk commands for a Redis instance | ACS-Redis-BulkyModifyInstanceConfig | No |
Specified high-risk commands are disabled for the Redis instance | None | No |
Using DTS data synchronization to build real-time cache consistency | None | No |
Idle CPU utilization check for a Redis instance | None | No |
Idle detection for Redis instance memory usage | None | No |
Lindorm | Use a multi-zone Lindorm instance | None | No |
Public network access is not enabled for the Lindorm instance | None | No |
ApsaraDB MongoDB | MongoDB subscription cluster expiration check | None | No |
Enable release protection for a MongoDB instance | None | No |
The MongoDB instance is not locked | None | No |
Enable the audit log on a MongoDB cluster | None | No |
Enable log backup for a MongoDB instance | None | No |
The MongoDB instance meets the specified read/write count requirement | None | No |
MongoDB meets the specified connection requirements | None | No |
MongoDB: Using dedicated or exclusive instances | None | No |
Use a MongoDB instance in a VPC | None | No |
Do not set the IP whitelist for a MongoDB instance to all network segments | None | No |
The MongoDB instance has no Internet access, or its security whitelist is not set to allow access from any source | None | No |
Enable Secure Sockets Layer (SSL) encryption for a MongoDB instance | None | No |
Use a multi-node MongoDB instance | None | No |
Using a multi-zone MongoDB instance | None | No |
Use a custom key to set TDE for MongoDB | None | No |
Idle CPU detection for a MongoDB instance | None | No |
MongoDB instance idle check by memory usage | None | No |
Free disk space check for MongoDB instances | None | No |
AnalyticDB for MySQL | The AnalyticDB for MySQL cluster has no Internet endpoint | None | No |
The ADB cluster is in multi-zone deployment mode | None | No |
Enable SQL audit logs for an ADB cluster | None | No |
Enable log backup for an ADB cluster | None | No |
Set a reasonable maintenance window for an ADB cluster | None | No |
Check instance expiration for AnalyticDB for Data Warehouse | None | No |
Cloud-native data warehouse AnalyticDB for PostgreSQL | Use a multi-zone cloud-native data warehouse AnalyticDB instance | None | No |
Enable disk encryption for a PostgreSQL instance | None | No |
Enable SSL encryption for a PostgreSQL instance | None | No |
AnalyticDB for PostgreSQL: Check active data backups | None | No |
ApsaraDB for ClickHouse | Using a multi-zone ApsaraDB for ClickHouse cluster instance | None | No |
Time Series Database (TSDB) | The TSDB instance has no Internet access | None | No |
TSDB instance security whitelist check | None | No |
ApsaraDB for HBase | The HBase cluster type is Cluster Edition | None | No |
HBase cluster in a VPC | None | No |
The HBase cluster does not have an Internet address | None | No |
Configure an HBase cluster for high availability | None | No |
Use a multi-zone HBase cluster | None | No |
Enable deletion protection for an HBase cluster | None | No |
HBase subscription cluster expiration check | None | No |
ApsaraDB OceanBase | Enable Secure Sockets Layer (SSL) encryption for an OceanBase cluster | None | No |
The IP whitelist group settings for an OceanBase tenant are effective. | None | No |
Internet access is not enabled for the OceanBase tenant, or the security whitelist is not set to allow access from any source | None | No |
Enable transparent data encryption (TDE) for an OceanBase tenant | None | No |
Enable database backup for an OceanBase cluster | None | No |
Enable SQL diagnostics in an OceanBase cluster | None | No |
Data Management (DMS) | Enable Stable Change checks in a DMS instance | None | No |
Enable sensitive data protection for a database instance | None | No |
Data Transmission Service (DTS) | Use a secure SSL connection for the source and destination databases of a DTS migration task | None | No |
Use SSL for the source database of a DTS tracking task | None | No |
Use SSL connections for the source and destination databases of a DTS sync task | None | No |
Enable geo-disaster recovery for a database instance using DTS | None | No |