Resource Management:Use resource groups and Cloud Config to audit compliance of resources based on multiple standards

Scenario

In enterprise cloud environments, different teams often have different compliance requirements — for example, a production environment may enforce stricter security standards than a development environment. Resource groups let you organize resources by dimensions such as environment or department. You can then create audit rules for each resource group in the Cloud Config console to audit compliance against different standards.

This tutorial walks through an end-to-end example: an enterprise with three departments shares one Alibaba Cloud account with more than 100 Elastic Compute Service (ECS) instances. Each department has different compliance standards. The goal is to audit compliance by department.

By the end of this tutorial, you will have:

• Created one resource group per department and moved the relevant ECS instances into each group

• Created department-specific audit rules in Cloud Config scoped to each resource group

• Viewed the compliance evaluation results for each department's resources

Audit compliance by resource group

1. Create resource groups and transfer resources into them.

   1. Log on to the Resource Management console.

   2. Create resource groups.

      In this example, create three resource groups: Department A, Department B, and Department C.

      For more information, see Create a resource group.

   3. Transfer resources to the resource groups.

      In this example, transfer each department's ECS instances into the corresponding resource group.

      For more information, see Transfer resources across resource groups.

2. Create audit rules for the resource groups and view the compliance evaluation results.

   1. Log on to the Cloud Config console.

   2. Create audit rules based on templates.

      Select Create from managed rule. When setting the resource scope, select the target resource groups from the Effective for the designated resource groups drop-down list. This limits the rule to resources within those groups only. Create different audit rules for each of the three resource groups to reflect each department's requirements. If the managed rule templates do not meet your requirements, create custom rules instead.

      For more information, see Create a rule based on a managed rule.

   3. View the compliance evaluation results.

      For more information, see View the compliance evaluation results.