ACS-REDIS-BulkyModifyAuditLogConfig - CloudOps Orchestration Service

Template name

ACS-REDIS-BulkyModifyAuditLogConfig enables the Redis audit log for a retention period of 180 days.

Execute Now

Template description

Sets the retention period of audit logs on ApsaraDB for Tair (Redis OSS-compatible) instances to 180 days.

Template type

Automated

Owner

Alibaba Cloud

Input parameters

Parameter	Description	Data type	Required	Default value	Limit
regionId	Region ID	String	No	{{ ACS::RegionId }}
OOSAssumeRole	OOS RAM role	JSON	No	""
instanceIds	List of Redis instance IDs	List	No	[]
rateControl	Concurrent task execution rate	JSON	No	{'Mode': 'Concurrency', 'MaxErrors': 0, 'Concurrency': 10}
OOSAssumeRole	The RAM role assumed by OOS.	String	No	""

Output parameters

N/A.

Permission policy that is required to execute the template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "kvstore:DescribeInstances",
                "kvstore:ModifyAuditLogConfig"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "oos:GetApplicationGroup"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Details

ACS-REDIS-BulkyModifyAuditLogConfig

Template content

FormatVersion: OOS-2019-06-01
Description:
  en: Enables the audit log for Redis instances and sets the retention period to 180 days.
  name-en: ACS-REDIS-BulkyModifyAuditLogConfig
  categories:
    - security
    - tair
Parameters:
  regionId:
    Type: String
    Label:
      en: RegionId
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  targets:
    Type: Json
    Label:
      en: TargetInstance
    AssociationProperty: Targets
    AssociationPropertyMetadata:
      ResourceType: ALIYUN::Redis::Instance
      RegionId: regionId
    Default:
      Type: ResourceIds
      ResourceIds: []
      RegionId: '{{ regionId }}'
  instanceIds:
    Label:
      en: RedisInstanceIds
    Type: List
    Default: []
    AssociationPropertyMetadata:
      Visible:
        Condition:
          Fn::Equals:
            - ${targets}
            - {}
  rateControl:
    Label:
      en: RateControl
    Type: Json
    AssociationProperty: RateControl
    Default:
      Mode: Concurrency
      MaxErrors: 0
      Concurrency: 10
  OOSAssumeRole:
    Label:
      en: OOSAssumeRole
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Conditions:
  instanceId:
    Fn::Equals:
      - '{{ instanceIds }}'
      - []
Tasks:
  - Name: getInstance
    When: instanceId
    Description:
      en: Retrieves the Redis instances.
    Action: ACS::SelectTargets
    Properties:
      ResourceType: ALIYUN::Redis::Instance
      RegionId: '{{regionId}}'
      Filters:
        - '{{ targets }}'
    Outputs:
      instanceIds:
        Type: List
        ValueSelector: Instances.Instance[].InstanceId
  - Name: modifyAuditLogConfig
    Action: 'ACS::ExecuteAPI'
    Description:
      en: Enables the audit log for Redis instances and sets the retention period to 180 days.
    Properties:
      Service: R-KVSTORE
      API: ModifyAuditLogConfig
      Parameters:
        RegionId: '{{ regionId }}'
        InstanceId: '{{ ACS::TaskLoopItem }}'
        DbAudit: true
        Retention: 180
    Loop:
      RateControl: '{{ rateControl }}'
      Items:
        Fn::If:
          - Fn::Equals:
              - '{{instanceIds}}'
              - []
          - '{{ getInstance.instanceIds }}'
          - '{{ instanceIds}}'