Build Custom Security Checks with CreateCheckItem API - Security Center - Alibaba Cloud - Security Center

Creates a custom check item in the Cloud Security Posture Management (CSPM) custom check item feature.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-sas:CreateCheckItem

create

*CustomCheckItem

acs:yundun-sas:{#regionId}:{#accountId}:customcheckitem/*

None

Request syntax

POST  HTTP/1.1

Request parameters

Parameter	Type	Required	Description	Example
SectionIds	array	Yes	The IDs of the sections associated with the check item.
	integer	No	The ID of the section associated with the check item. Note You can call the ListCheckPolicies operation to obtain the check item ID.	1000000000001
Vendor	string	Yes	The cloud asset vendor. Note You can call the ListCloudAssetSchemas operation to obtain the available vendors.	ALIYUN
InstanceType	string	Yes	The asset type of the cloud service. Note You can call the ListCloudAssetSchemas operation to obtain this parameter.	ECS
InstanceSubType	string	Yes	The asset subtype of the cloud service. Note You can call the ListCloudAssetSchemas operation to obtain this parameter.	DISK
CheckShowName	string	Yes	The name of the custom check item.	testCheckItemName
RiskLevel	string	Yes	The risk level of the check item. Valid values: HIGH: High risk. MEDIUM: Medium risk. LOW: Low risk.	LOW
Status	string	Yes	The status of the check item. Valid values: EDIT: Being edited. RELEASE: Published. Note Changing the status from Published to Being edited will purge all historical records. Only check items in the Published status can be used for checks. Valid values: EDIT : Being edited. RELEASE : Published.	EDIT
Remark	string	No	The remarks.	remark
Description	object	No	The description of the check item.
Type	string	No	The type of the check item description. Valid values: text: text	text
Value	string	No	The content of the description.	custom description.
AssistInfo	object	No	The help information of the check item.
Type	string	No	The type of the help information for the check item risk. Valid values: text: text	text
Value	string	No	The content of the help information for the check item risk.	custom assistInfo.
Solution	object	No	The solution information of the check item.
Type	string	No	The type of the check item solution information. Valid values: text: text	text
Value	string	No	The content of the solution for the check item risk.	text
CheckRule	string	Yes	The rule definition of the custom check item.	{"AssociatedData":{"ToDataList":[{"DataName":"ACS_ECS_Instance","PropertyPath":"InstanceId","FromPropertyPath":"InstanceId"}]},"MatchProperty":{"Operator":"AND","MatchProperties":[{"DataName":"ACS_ECS_Disk","PropertyPath":"InstanceId","MatchOperator":"EQ","MatchPropertyValue":"testId"},{"DataName":"ACS_ECS_Instance","PropertyPath":"InstanceId","MatchOperator":"EQ","MatchPropertyValue":"testInstanceId"}]}}

Response elements

Element	Type	Description	Example
	object	The response struct.
RequestId	string	The request ID, which is a unique identifier generated by Alibaba Cloud for the request. You can use this ID to troubleshoot issues.	F8B6F758-BCD4-597A-8A2C-DA5A552C****
Data	object	The data returned if the call is successful.
CheckId	integer	The ID of the check item returned upon successful creation.	100000000001

Examples

Success response

JSON format

{
  "RequestId": "F8B6F758-BCD4-597A-8A2C-DA5A552C****",
  "Data": {
    "CheckId": 100000000001
  }
}

Error codes

HTTP status code	Error code	Error message	Description
400	ParamIllegal.%s	The parameter %s is invalid, please fill it in again.	Invalid parameter, please fill in again
400	CspmParamOverSize	The parameter is too long.	The parameter is too long, please fill in again.
400	NoPurchase	The user did not purchase this product.	User has not purchased this product
400	CspmCreateCheckCustomItemExceedLimit	The number of custom check items created exceeds the limit.	The number of custom check items created exceeds the limit.
400	CspmCheckCustomItemSectionsError	The chapter associated with the custom check item does not exist.	The chapter associated with the custom check item does not exist.
400	CspmVerifyItemRuleError.%s	Audit check item check rule error: %s.	The format of the check item rule does not pass. For details, see the return error code.
400	CspmCreateCheckCustomItemError	Failed to create custom check item.	Failed to create custom check item.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.