Cloud Config managed rule templates reference - Cloud Config - Centro de documentación de Alibaba Cloud

Cómputo

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para remediación	Admite ejecución de prueba
ECS	ECS instances use the subscription billing method	Ninguna	Sí
	Subscription ECS instances are checked for expiration	Ninguna	No
	Auto-renewal is enabled for subscription ECS instances	Ninguna	No
	ECS instances are not in the Stopped state	Ninguna	No
	Stopped pay-as-you-go ECS instances use economical mode	Ninguna	No
	Pay-as-you-go ECS instances are checked for long-running status	Ninguna	No
	ECS instances with static public IP addresses use the pay-by-bandwidth billing method	Ninguna	No
	No idle ECS data disks exist	Ninguna	No
	Idle disks are detected	Ninguna	No
	ECS instances are not locked	Ninguna	No
	Deletion protection is enabled for ECS instances	ACS-ECS-BulkyEnableDeletionProtection	Sí
	The number of CPU cores for ECS instances meets the minimum requirement	Ninguna	No
	The number of GPU cores for ECS instances meets the minimum requirement	Ninguna	No
	The system disk capacity for a specified operating system type is greater than or equal to a specified value	Ninguna	No
	Deprecated ECS instance families are not used	Ninguna	No
	ECS instances use a specified operating system version	Ninguna	Sí
	ECS instance types meet standard requirements	Ninguna	No
	ECS instances are deployed in a VPC	Ninguna	No
	Running ECS instances are in a VPC	ACS-ECS-BulkyStopClassicInstances	No
	ECS instances are not associated with public IP addresses	Ninguna	Sí
	Running ECS instances are not associated with public IP addresses	ACS-ECS-BulkyStopInstancesWithPublicIp	No
	The maximum outbound public bandwidth of an ECS instance with a public IP address is less than a specified value	Ninguna	No
	Security Center protection is enabled for running ECS instances	Ninguna	No
	ECS instances are in a specified security group	Ninguna	Sí
	Inbound rules of security groups are valid	Ninguna	Sí
	Security groups do not open high-risk ports to all CIDR blocks	Ninguna	Sí
	Security groups do not open high-risk ports to all CIDR blocks for a specified protocol	Ninguna	No
	Inbound rules of security groups do not allow access from all ports	Ninguna	Sí
	Inbound rules of security groups do not allow access for all protocols	Ninguna	Sí
	Outbound rules of security groups are not set to allow all traffic	Ninguna	Sí
	Inbound rules for ports not on the whitelist are valid	Ninguna	Sí
	The source IP addresses allowed by inbound security group rules do not include public IP addresses	Ninguna	Sí
	A security group description is required	Ninguna	Sí
	Idle security groups are checked	Ninguna	No
	Enterprise security groups are used	Ninguna	No
	Public network access is not configured in ECS launch templates	Ninguna	No
	ECS instances use specified images	Ninguna	Sí
	The source of ECS instance images meets specified requirements	Ninguna	No
	ECS instances use images shared by a specified account	Ninguna	No
	ECS instances use images that are within their validity period	Ninguna	No
	Images from a specified source are used in ECS launch template versions	Ninguna	No
	Security groups are specified in ECS launch template versions	Ninguna	No
	Data disk encryption is configured in ECS launch template versions	Ninguna	No
	System disk encryption is configured in ECS launch template versions	Ninguna	No
	An instance RAM role is granted to ECS instances	Ninguna	No
	ECS instances are not associated with an SSH key pair	Ninguna	No
	Key pairs are used to log on to Linux hosts	Ninguna	Sí
	System disk encryption is enabled for ECS instances	Ninguna	No
	Data disk encryption is enabled for ECS instances	Ninguna	Sí
	The memory size of ECS instances meets the minimum requirement	Ninguna	Sí
	Encryption is enabled for ECS data disks that are to be attached	Ninguna	No
	Encryption is enabled for in-use ECS data disks	Ninguna	No
	KMS encryption is enabled for ECS disks	Ninguna	No
	An automatic snapshot policy is configured for ECS disks	Ninguna	Sí
	A reasonable creation time is set for the automatic snapshot policy	Ninguna	No
	The retention period of automatic snapshots for ECS instances meets specified requirements	Ninguna	No
	Automatic snapshots are retained when ECS data disks are released	Ninguna	Sí
	ECS disks are not locked	Ninguna	No
	The automatic snapshot policy for ECS disks or the entire-machine backup feature of Cloud Backup is used	Ninguna	No
	Cross-region replication for automatic snapshots of ECS disks or remote replication for entire-machine backups in Cloud Backup is enabled	Ninguna	No
	Cross-region replication is enabled for the File Backup repository of an ECS instance	Ninguna	No
	The data protection score for ECS instance backups is checked	Ninguna	No
	A process with a specified name runs on an ECS instance	Ninguna	No
	A process with a specified name is disabled on an ECS instance	Ninguna	No
Software with a specified name is installed on an ECS instance	Ninguna	No
Running ECS instances have no unpatched vulnerabilities	Ninguna	No
The CloudMonitor agent is installed on running ECS instances	Ninguna	No
The reinforced mode is enforced for accessing ECS instance metadata	Ninguna	No
The content of Cloud Assistant commands is checked	Ninguna	No
Brute-force attack protection rules are created for ECS instances	Ninguna	No
Simple Log Service is used for centralized business log collection and monitoring	Ninguna	No
Application Load Balancer is used to build a high-availability application architecture	Ninguna	No
An ECS instance is attached to only one elastic network interface (ENI)	Ninguna	No
The number of ECS instances is unbalanced across zones	Ninguna	No
Zone-redundant ESSD data disks are used	Ninguna	No
The Anti-DDoS protection status for ECS instances is checked	Ninguna	No
Idle ECS instances are detected based on CPU utilization	Ninguna	No
Idle ECS instances are detected based on memory usage	Ninguna	No
Idle ECS instances are detected based on disk usage	Ninguna	No
The application checklist for ECS instances is checked	Ninguna	No
Health check is enabled for ECS instances in an Auto Scaling group	Ninguna	No
Idle ECS instances are detected based on GPU utilization	Ninguna	No
Idle ECS instances are detected based on GPU memory usage	Ninguna	No
File Backup or self-managed database backup is enabled for ECS instances	Ninguna	No
ECS instances are not associated with public IP addresses and do not allow inbound traffic from all IP addresses	Ninguna	No
Dedicated Host (DDH)	The number of CPU cores for a Dedicated Host meets the minimum requirement	Ninguna	No
	The memory size of a Dedicated Host meets the minimum requirement	Ninguna	No
	The number of sockets for a Dedicated Host meets the minimum requirement	Ninguna	No
Auto Scaling	A security group is associated with instances in an Auto Scaling configuration	Ninguna	No
	The security group configured for an ESS scaling group is not set to 0.0.0.0/0	Ninguna	No
	Data disk encryption is configured in an Auto Scaling configuration	Ninguna	No
	System disk encryption is configured in an Auto Scaling configuration	Ninguna	No
	Images from a specified source are used in an Auto Scaling configuration	Ninguna	No
	Images in an Auto Scaling configuration are checked	Ninguna	No
	The existence of the Server Load Balancer instance associated with an Auto Scaling group is checked	Ninguna	No
Function Compute	A Function Compute service is configured to be invoked only from a specified VPC	Ninguna	No
	Public network access is disabled for a Function Compute service	Ninguna	No
	A Function Compute service can be accessed from the Internet and is mapped to a custom domain name	Ninguna	No
	An HTTP trigger for a function is configured to require identity verification	Ninguna	No
	A Function Compute function is mapped to a custom domain name and a specified TLS version is enabled	Ninguna	No
	A Function Compute function is mapped to a custom domain name and a certificate is uploaded	Ninguna	No
	A Function Compute function is mapped to a custom domain name and HTTPS is enabled	Ninguna	No
	Tracing Analysis is enabled for a Function Compute service	Ninguna	No
	The logging feature is enabled for a Function Compute service	Ninguna	No
	A server role is configured for a Function Compute service	Ninguna	No
	Deprecated runtimes are not used in Function Compute	Ninguna	No
	The settings of a function in Function Compute meet specified parameter requirements	Ninguna	No

Contenedores

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para corrección	¿Se puede ejecutar una prueba en seco?
Container Service for Kubernetes	Enable release protection for ACK clusters	Ninguna	No
	Use managed ACK clusters of the Professional Edition	Ninguna	No
	The ACK cluster is running the latest version	Ninguna	No
	Use a supported ACK version	Ninguna	No
	Enable the managed node pool feature for ACK clusters	Ninguna	No
	Enable node autoscaling for ACK node pools	Ninguna	No
	Check the availability of scaling configurations for ACK node pools	Ninguna	No
	Check the availability of security groups for ACK node pools	Ninguna	No
	Check the availability of vSwitches for ACK node pools	Ninguna	No
	Check the availability of scaling groups for ACK node pools	Ninguna	No
	An ACK cluster without an Internet endpoint	Ninguna	No
	Use the Terway network plugin for ACK clusters	Ninguna	No
	Use multi-zone ACS clusters at the region level	Ninguna	No
	Use multi-zone ACK clusters at the region level	Ninguna	No
	Enable the RRSA feature for ACK clusters	Ninguna	No
	Install the ack-ram-authenticator component in ACK clusters for RAM-based request authentication	Ninguna	No
	Enable and configure container security policies for ACK clusters	Ninguna	No
	Configure at-rest encryption for Secrets in ACK clusters	Ninguna	No
	Install the CloudMonitor agent on ACK cluster nodes	Ninguna	No
	Install the CloudMonitor agent on running nodes in ACK clusters	Ninguna	No
	Enable logging for control plane components in ACK clusters	Ninguna	No
	Install the audit log plugin in ACK clusters	Ninguna	No
	Enable the API Server audit feature for ACK clusters	Ninguna	No
	Install the intra-container audit component in ACK clusters to audit executed commands	Ninguna	No
	Check that the number of backend servers for the CoreDNS service is not zero in ACK clusters	Ninguna	No
	Check the number of replicas for CoreDNS in ACK clusters	Ninguna	No
	Check the pod status of CoreDNS in ACK clusters	Ninguna	No
	Check the backend status of the CLB instance for the API Server in ACK clusters	Ninguna	No
	Check that the CLB instance attached to the API Server exists in ACK clusters	Ninguna	No
	Check that the CLB instance attached to the API Server is in the Normal status in ACK clusters	Ninguna	No
	Check that the port listener configuration of the CLB instance attached to the API Server is normal in ACK clusters	Ninguna	No
	Check the availability of APIService in ACK clusters	Ninguna	No
	Check the status of elasticity components in ACK clusters	Ninguna	No
	Install and configure the inspection component in ACK clusters to check for workload security threats	Ninguna	No
	Check for medium-risk threats during ACK cluster inspections	Ninguna	No
	Enable the AIOps-based inspection feature for ACK clusters	Ninguna	No
	Install the cost analysis component in ACK clusters	Ninguna	No
	Check for Kubelet version consistency across ACK cluster nodes	Ninguna	No
	Check for certificate ID consistency for LoadBalancer services in ACK clusters	Ninguna	No
	Check for billing method consistency for LoadBalancer services in ACK clusters	Ninguna	No
Container Registry (ACR)	Set the image repository type to private in Container Registry	Ninguna	Sí
	Image versions in Container Registry are immutable	Ninguna	No
	Check the whitelist for Container Registry instances	Ninguna	No
	Public network access is disabled for the Container Registry instance	Ninguna	No
	Check for idle Container Registry instances	Ninguna	No
	Update image versions in image repositories within the specified time	Ninguna	No
	Enable security scanning for Container Registry instances	Ninguna	No
	Associate Container Registry instances with zone-redundant OSS buckets	Ninguna	No
Elastic Container Instance	Mount volumes to container groups in ECI instances	Ninguna	No
	Ensure environment variables for ECI container groups do not contain sensitive information	Ninguna	No
	Ensure that running ECI instances have no vulnerabilities to be fixed	Ninguna	No
	Enable Security Center protection for running ECI container groups	Ninguna	No

Almacenamiento

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para remediación	¿Este servicio admite ejecución en seco?
Object Storage Service (OSS)	OSS bucket ACL prohibits public-read access	ACS-OSS-PutBucketAcl	No
	OSS bucket ACL prohibits public-read-write access	ACS-OSS-PutBucketAcl	Sí
	OSS bucket access policy is configured for secure access	Ninguna	No
	OSS bucket does not grant permissions to anonymous accounts	Ninguna	Sí
	Public OSS bucket has an access policy and does not grant permissions to anonymous accounts	Ninguna	No
	OSS bucket authorization policy is configured with IP address restrictions	Ninguna	No
	Bucket policy is checked for authorization outside the organization	Ninguna	No
	Bucket policy does not grant authorization outside the organization	Ninguna	No
	OSS bucket policy does not contain the authorization specified by parameters	Ninguna	No
	Server-side encryption with KMS is enabled for the OSS bucket	Ninguna	No
	Default server-side encryption is enabled for the OSS bucket	ACS-OSS-PutBucketEncryption	Sí
	OSS bucket is encrypted using a custom KMS key	Ninguna	No
	Versioning is enabled for the OSS bucket	ACS-OSS-PutBucketVersioning	No
	Zone-redundant storage is enabled for the OSS bucket	ACS-OSS-EnableBucketZRS	No
	Cloud Backup is enabled for the OSS bucket	Ninguna	No
	Cross-region replication is enabled for the OSS bucket	Ninguna	No
	Cross-region replication is enabled for the OSS bucket backup vault	Ninguna	No
	Data protection score is checked for OSS bucket backups	Ninguna	No
	Log storage is enabled for the OSS bucket	ACS-OSS-BulkyPutBucketLogging	Sí
	Prefix matching for log storage is enabled for the OSS bucket	Ninguna	Sí
	Real-time logging is enabled for Object Storage Service	Ninguna	No
	Delivery of OOS execution records is configured for the specified region	Ninguna	No
	Hotlink protection is enabled for the OSS bucket	Ninguna	No
	Referer for the OSS bucket is in the specified hotlink protection whitelist	ACS-OSS-PutBucketReferer	No
	Check for custom domain names is enabled for the OSS bucket	Ninguna	No
	TLS version is checked for the OSS bucket	Ninguna	No
	OSS bucket name matches the regular expression	Ninguna	No
File Storage NAS	Encryption is configured for the NAS file system	Ninguna	Sí
	NAS file system is in the specified status	Ninguna	No
	NAS file system is checked for inactivity	Ninguna	No
	Authorization object for the NAS permission group rule is not set to all network segments	Ninguna	No
	Permission group used by the NAS file system is not open to all sources	Ninguna	No
	RAM policies are enabled for the NAS access point	Ninguna	No
	Root directory of the NAS access point is not set to the default directory	Ninguna	No
	Recycle bin is enabled for the NAS file system	ACS-NAS-BulkyEnableRecycleBin	No
	A backup plan is created for the NAS file system	Ninguna	No
	Cross-region replication is enabled for the NAS backup vault	Ninguna	No
	Data protection score is checked for the NAS backup vault	ACS-NAS-BulkyEnableRecycleBin	No
Tablestore	Network type for the Tablestore instance is set to VPC-only or console-only access	ACS-Config-OTS-RemovePublicAccess	Sí
	All data tables in the Tablestore instance are encrypted	Ninguna	No
	Tablestore instance uses zone-redundant storage	Ninguna	No
	Cloud Backup is enabled for the Tablestore instance	Ninguna	No
	Cross-region backup is enabled for the Tablestore backup vault	Ninguna	No
	Data protection score is checked for the Tablestore instance	Ninguna	No
Simple Log Service	Data encryption is configured for the Simple Log Service Logstore	Ninguna	No
	Key material for Simple Log Service Logstore encryption is imported by the user	Ninguna	No
	Automatic storage tiering is enabled for the SLS Logstore	Ninguna	No
	Log project uses zone-redundant storage	Ninguna	No
Cloud Storage Gateway	A cross-zone high-availability Cloud Storage Gateway is used	Ninguna	No
	Cloud Storage Gateway uses an OSS bucket with an SSL connection	Ninguna	No
	Server-side encryption is used for shares of the Cloud Storage Gateway	Ninguna	No

Red y CDN

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para corrección de configuración	¿Admite ejecución en seco?
Classic Load Balancer (CLB)	Enable release protection for an SLB instance	ACS-SLB-BulkySetLoadBalancerDeleteProtection	Sí
	Enable configuration read-only mode for an SLB instance	ACS-SLB-BulkySetLoadBalancerModificationProtection	Sí
	Check for SLB subscription instance expiration	ACS-BssOpenApi-SetRenewal ACS-BssOpenApi-EnableAutoRenewal	No
	Enable auto-renewal for a subscription SLB instance	Ninguna	Sí
	Idle detection for subscription Server Load Balancer instances	Ninguna	No
	SLB idle detection	Ninguna	No
	The SLB instance status is Running	Ninguna	No
	Use an SLB instance in a VPC	Ninguna	Sí
	The SLB instance is not bound to a public IP address	Ninguna	Sí
	SLB access control lists do not allow entries for all address segments	Ninguna	Sí
	Set Resource Access Management for all running listeners on an SLB instance	Ninguna	No
	The access control whitelist for the SLB instance contains specified IP addresses or CIDR blocks.	Ninguna	No
	The access control whitelist of the SLB instance does not include the specified IP address or network segment	Ninguna	No
	The SLB instance listener does not include the specified port	Ninguna	Sí
	Check the Anti-DDoS status of SLB	Ninguna	No
	SLB instance has an unconfigured HTTP listener	Ninguna	No
	Enable an HTTPS listener for SLB	Ninguna	Sí
	The HTTPS listener of an SLB instance uses a specified security policy suite	Ninguna	No
	Use an Alibaba Cloud-issued certificate for SLB	Ninguna	No
	The SLB server certificate is valid	Ninguna	No
	SLB certificate expiration check	Ninguna	No
	Use a multi-zone SLB instance	Ninguna	Sí
	Use a multi-zone SLB instance and add resources from multiple zones to the server group	Ninguna	No
	All listeners of the Server Load Balancer have at least the specified number of backend servers	Ninguna	No
	The default server group of an SLB instance contains at least two servers	Ninguna	No
	Add resources from multiple zones to a default server group of Server Load Balancer	Ninguna	No
	Add resources from multiple zones to an SLB primary/secondary server group	Ninguna	No
	Add resources from multiple zones to an SLB vServer group	Ninguna	No
	The SLB instance is a guaranteed-performance instance	Ninguna	Sí
	The SLB instance meets the specified bandwidth requirements	Ninguna	Sí
	The SLB instance type meets the requirements	Ninguna	Sí
	Check for average utilization rate of maximum connections on an SLB instance	Ninguna	No
	Checking the average new connection usage rate for an SLB instance	Ninguna	No
	SLB instance outbound bandwidth average utilization check	Ninguna	No
	All SLB listeners have health checks set up	Ninguna	No
	The server weight for an SLB instance is not 0	Ninguna	No
	Enable access logs for an SLB instance	Ninguna	No
	Troubleshoot a non-existent threshold abnormality for a CLB instance	Ninguna	No
Application Load Balancer (ALB)	Enabling release protection for an ALB instance	Ninguna	No
	ALB idle connection detection	Ninguna	No
	Monitoring the outbound bandwidth utilization of an Internet Shared Bandwidth associated with an ALB instance	Ninguna	No
	Monitoring outbound bandwidth usage for EIPs associated with an ALB	Ninguna	No
	The network type of the ALB instance is private	Ninguna	No
	Set access control for all running listeners of the ALB instance	Ninguna	No
	ALB access control lists do not allow configuring all address segments	Ninguna	No
	The access control whitelist for the ALB instance does not contain the specified IP address or network segment	Ninguna	No
	The access control whitelist for an ALB instance contains specified IP addresses or network segments.	Ninguna	No
	Remove Header forwarding feature for an ALB HTTP listener	Ninguna	No
	Using multi-zone ALB instances	Ninguna	No
	The ALB server group contains at least two servers	Ninguna	No
	Add resources from multiple zones to an ALB server group	Ninguna	No
	All ALB listeners and forwarding rules have health checks configured	Ninguna	No
	The default forwarding rule for each listener on an Application Load Balancer (ALB) contains at least a specified number of servers	Ninguna	No
	Expiration check for SSL certificates on listeners of running ALB instances	Ninguna	No
	Enable Web Application Firewall for an ALB instance	Ninguna	No
	ALB instance connection failure rate check	Ninguna	No
	ALB instance 4xx error rate detection	Ninguna	No
	ALB instance 5xx error rate detection	Ninguna	No
	ALB instance TLS handshake failure rate check	Ninguna	No
	The virtual IP of an ALB instance is unavailable for processing due to an abnormal high-water mark	Ninguna	No
Network Load Balancer (NLB)	Using a multi-zone Network Load Balancer instance	Ninguna	No
	Add resources from multiple zones to a Network Load Balancer server group	Ninguna	No
	Missing threshold abnormality in virtual IP processing for an NLB instance	Ninguna	No
	Specified security policy for an NLB instance listener	Ninguna	No
Gateway Load Balancer (GWLB)	Use a multi-zone Gateway Load Balancer instance	Ninguna	No
Gateway Load Balancer (GWLB)	GWLB server group servers are deployed across multiple zones	Ninguna	No
Elastic IP Address	Subscription Elastic IP Address expiration check	Ninguna	No
	Detect idle Elastic IP Addresses	Ninguna	No
	Idle EIP detection	Ninguna	No
	Enable deletion protection for an Elastic IP Address	Ninguna	No
	The service status of the Elastic IP Address instance is Normal	Ninguna	No
	The bandwidth of the Elastic IP address (EIP) instance meets the minimum requirements	Ninguna	No
	No abnormal bandwidth level for the Elastic IP Address instance	Ninguna	No
	Enable Cloud Firewall protection for an EIP	Ninguna	No
	Check the Anti-DDoS status of an EIP	Ninguna	No
	A public IPv4 address is not assigned in the scaling configuration	Ninguna	No
	Associate an Auto Scaling group with a Server Load Balancer	Ninguna	No
	Associate an Auto Scaling group with at least two vSwitches	Ninguna	No
	Detecting EIP tag inheritance from an associated resource	ACS-TAG-TagResourcesIgnoreCaseSensitive	No
Internet Shared Bandwidth (CBWP)	Internet Shared Bandwidth instance expiration check	Ninguna	Sí
Internet Shared Bandwidth (CBWP)	Idle shared bandwidth detection	Ninguna	No
Virtual Private Cloud (VPC)	Routing is set for the custom VPC network segment	Ninguna	No
	The destination CIDR block of the VPC custom route is not set to all CIDR blocks	Ninguna	No
	The IP address ranges of vSwitches in the same region cannot overlap	Ninguna	No
	The available IP address count for a VPC vSwitch is greater than a specified value	Ninguna	No
	VPC network ACL has no open risky ports	Ninguna	No
	The VPC network ACL is not empty	Ninguna	No
	Attach a network ACL to at least one resource	Ninguna	No
	Enable flow logs for a VPC	Ninguna	No

IPsec VPN connection is normal	Ninguna	No
Enable a health check for an IPsec VPN connection	Ninguna	No
Configure multiple zones for an endpoint service	Ninguna	No
Peer account ID check for an Express Connect router interface	Ninguna	No
NAT Gateway	NAT Gateway does not allow mapping for specified threat ports	ACS-VPC-BulkyDeleteForwardEntry	No
	An Internet NAT gateway is created in a specific virtual private cloud (VPC).	Ninguna	No
	A private NAT gateway is created in a specified virtual private cloud (VPC).	Ninguna	No
	NAT Gateway not using the specified network type	Ninguna	No
	SNAT and DNAT do not use the same EIP in a NAT Gateway	Ninguna	No
	Consistent peak bandwidth settings when attaching multiple EIPs to an SNAT entry	Ninguna	No
	Enable release protection for a NAT Gateway	Ninguna	No
	NAT Gateway idle detection	Ninguna	No
	VPC private gateway idle detection	Ninguna	No
	Abnormal threshold handling when a NAT Gateway is missing	Ninguna	No
	NAT Gateway zone independence	Ninguna	No
	NAT Gateway status check	Ninguna	No
CEN	Expiration check for Cloud Enterprise Network bandwidth plans	ACS-BssOpenApi-SetRenewal ACS-BssOpenApi-EnableAutoRenewal	No
	The bandwidth allocation for the inter-region connection in the CEN instance meets the specified requirements	Ninguna	No
	Health checks are configured for all VBR connections in the CEN instance	Ninguna	No
	Configure multiple zones for a TransitRouter VPC connection	Ninguna	No
	No abnormal cross-region bandwidth levels	Ninguna	No
	No threat of exceeding the TR route entry limit	Ninguna	No
VPN Gateway	VPN Gateway not activated	Ninguna	No
	VPN Gateway idle detection	Ninguna	No
	VPN instance expiration check	ACS-BssOpenApi-EnableAutoRenewal	No
	The encryption algorithm for the VPN connection is not None	Ninguna	No
	Use a multi-zone VPN Gateway	Ninguna	No
	The VPN Gateway status is Normal	Ninguna	No
	Both the active and standby tunnels of a dual-tunnel VPN Gateway are connected	Ninguna	No
	VPN Gateway inbound bandwidth utilization check	Ninguna	No
	VPN Gateway outbound bandwidth usage check	Ninguna	No
	The VPN Gateway service has no abnormal thresholds	Ninguna	No
Express Connect	Using Express Connect in high-reliability mode	Ninguna	No
	Configure a health check for a VBR instance	Ninguna	No
	The VBR instance has no missing redundancy	Ninguna	No
	The BGP connection status of the VBR instance is normal.	Ninguna	No
	No abnormal ports on the Express Connect circuit	Ninguna	No
	Multiple valid routes on an Express Connect circuit gateway	Ninguna	No
CDN	Enable HTTPS encryption for an accelerated domain name	Ninguna	No
	The CDN SSL certificate has not expired	Ninguna	No
	Enable force redirect from HTTP to HTTPS for an accelerated domain name	Ninguna	No
	Enable Referer hotlink protection for an accelerated domain name	Ninguna	No
	Enable URL signing for an accelerated domain name	Ninguna	No
	Enable OCSP stapling for an accelerated domain name	Ninguna	No
	Enable TLS 1.3 detection for an accelerated domain name	Ninguna	No
	Set CDN cache for a domain name	Ninguna	No
	Enable Gzip compression for an accelerated domain name	Ninguna	No
	Enable Brotli compression for an accelerated domain name	Ninguna	No
	Enable range origin fetch for an accelerated domain name	Ninguna	No
	Enable parameter filtering for an accelerated domain name	Ninguna	No
	Optimize OSS data transmission using CDN	Ninguna	No
	The source of a CDN configuration should not point to a non-existent OSS bucket	Ninguna	No
	The OSS origin configuration for the accelerated domain name is consistent	Ninguna	No
	Configure multiple origins for an accelerated domain name	Ninguna	No
	Enable IPv6 access for an accelerated domain name	Ninguna	No
Edge Security Acceleration	Configure multiple sources for a DCDN accelerated domain name	Ninguna	No
Alibaba Cloud DNS	The CNAME record in DNS points to an existing OSS bucket Endpoint	Ninguna	No
	The domain name format in Cloud DNS matches a specified regular expression	Ninguna	No
	DNS MX record compliance check	Ninguna	No

Seguridad

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para corregir la configuración	¿Es compatible con ejecución en seco?
Anti-DDoS	DDoS instance expiration check	Ninguna	No
	Prevent DDoS attacks with Anti-DDoS	Ninguna	No
	Status check for the protected IP of an Anti-DDoS Pro or Anti-DDoS Premium instance	Ninguna	No
Web Application Firewall	Use a web firewall to protect a website or app	Ninguna	No
	Add an API group domain from API Gateway to WAF	Ninguna	No
	Enable a specific protection feature for a WAF-protected domain name	Ninguna	No
	Enable a specific prevention mode for a specific protection feature of a WAF domain name	Ninguna	No
	Enable a specific protection rule for a WAF instance	Ninguna	No
	Enable log collection for a WAF instance	ACS-WAF-BulkyModifyLogServiceStatus	No
	Enable log detection for a WAF 3.0 protected object	Ninguna	No
Cloud Firewall	All assets in Cloud Firewall are protected	Ninguna	No
	No control policy in Cloud Firewall matches the specified conditions	Ninguna	No
	A control policy in Cloud Firewall matches the specified conditions	Ninguna	No
	Enable protection for assets in Cloud Firewall	Ninguna	No
	Cloud Firewall IPS has basic protection enabled	ACS-Cloudfw-ModifyIPSConfig	No
	Cloud Firewall IPS has threat intelligence enabled	ACS-Cloudfw-ModifyIPSConfig	No
	Cloud Firewall IPS has enabled Virtual Patches	ACS-Cloudfw-ModifyIPSConfig	No
	The Cloud Firewall intrusion prevention system (IPS) is in Block Mode	ACS-Cloudfw-ModifyIPSConfig	No
	Use Cloud Firewall to secure network borders	Ninguna	No
Security Center	Use Security Center Enterprise Edition	Ninguna	No
	All ECS instances in the account have the Security Center proxy installed	Ninguna	No
	A notification method is set for the Security Center notification item	Ninguna	No
	All ECS instance vulnerabilities are fixed	Ninguna	No
	No pending image vulnerabilities in Security Center	Ninguna	No
	Configure a vulnerability scan for a specified priority in Security Center	Ninguna	No
	Security Center detects no leaked AccessKeys	Ninguna	No
	Security Center found no assets with high-risk weak passwords	Ninguna	No
	Enable specific types of proactive protection in Security Center	Ninguna	No
	Enable asset fingerprint collection for specific types in Security Center	Ninguna	No
Digital Certificate Management Service (SSL Certificate)	SSL certificate expiration check	Ninguna	No
Key Management Service	Enable delete protection for a KMS master key	ACS-KMS-BulkySetDeletionProtection	No
	The KMS master key is not scheduled for deletion	Ninguna	No
	Set automatic master key rotation in Key Management Service	ACS-KMS-BulkyUpdateRotationPolicy	No
	Set automatic credential rotation in Key Management Service (KMS)	Ninguna	No
	KMS credential successfully rotated	Ninguna	No
	Not using a KMS master key from an external source	Ninguna	No
	Using multi-zone KMS instances	Ninguna	No
	KMS instance expiration check	ACS-BssOpenApi-EnableAutoRenewal	No
Data Security Center	Sensitive data detection is not enabled in Data Security Center	Ninguna	No
Bastionhost	Bastionhost instance expiration check	Ninguna	No
	Bastionhost versions that support multi-zone deployment	Ninguna	No
	Available storage for the Bastionhost meets minimum requirements	Ninguna	No

Middleware

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para corrección	¿Es posible ejecutar una prueba en seco?
Microservices Engine (MSE)	MSE cluster allows public network access and enables authentication	Ninguna	No
	MSE cluster public network access check	Ninguna	No
	Use a High-availability Edition MSE registry	Ninguna	No
	MSE registry multi-node deployment check	Ninguna	No
	MSE registry DPI engine version check	Ninguna	No
	MSE registry capacity check	Ninguna	No
	MSE cloud-native gateway multi-node deployment check	Ninguna	No
	Deploy an MSE cloud-native gateway in multiple zones	Ninguna	No
	MSE cloud-native gateway version check	Ninguna	No
Enterprise Distributed Application Service (EDAS)	Log collection is not configured for EDAS	Ninguna	No
ApsaraMQ for RocketMQ	Use a multi-zone ApsaraMQ for RocketMQ 5.0 instance	Ninguna	No
ApsaraMQ for RocketMQ	Use a Platinum Edition ApsaraMQ for RocketMQ instance	Ninguna	No
Message Queue for Apache Kafka	The public IP address whitelist of a Kafka instance is not open to all IP addresses	Ninguna	No
Message Queue for Apache Kafka	Use a multi-zone Message Queue for Apache Kafka instance	Ninguna	No
Cola de mensajes ligera	Disable public network access for MNS queues	Ninguna	No
API Gateway	Set APIs in API Gateway to private	Ninguna	No
	Enable IPv4 access control for an API Gateway instance and configure a valid list	Ninguna	No
	Enable IPv6 access control for an API Gateway instance and configure a valid list	Ninguna	No
	Set the request method to HTTPS for APIs in API Gateway that allow public network access	ACS-ApiGateway-BulkyModifyApiGroupNetworkPolicy	No
	The HTTPS security policy of an API group in API Gateway meets requirements	Ninguna	No
	Attach a custom domain name to an API group in API Gateway	Ninguna	No
	Configure an SSL certificate for the custom domain name of an API group in API Gateway	Ninguna	No
	Attach an independent domain name to an API group and enable force redirect to HTTPS	Ninguna	No
	Set the API security authentication method to JWT in API Gateway	Ninguna	No
	Configure API security authentication in API Gateway	Ninguna	No
	Configure log storage for API calls in an API group	Ninguna	No
	Connect the domain name attached to an API group in API Gateway to WAF or WAF 3.0	Ninguna	No
	Configure the Tracing Analysis feature for an API group	Ninguna	No
	Use a multi-zone API Gateway instance	Ninguna	No

Base de datos

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para corrección	¿Compatible con ejecución de prueba?
Base de datos nativa de la nube PolarDB	PolarDB subscription cluster expiration check	Ninguna	No
	PolarDB-X1 instance expiration check	Ninguna	No
	PolarDB-X2 instance expiration check	Ninguna	No
	Enable delete protection for a PolarDB cluster	Ninguna	No
	Set a maintenance window for a PolarDB cluster	Ninguna	No
	The log backup retention period for PolarDB clusters meets specified requirements	Ninguna	No
	The level-2 backup retention period for the PolarDB cluster meets the specified requirements	Ninguna	No
	The level-1 backup retention period for the PolarDB cluster meets the specified requirements	Ninguna	No
	Use a PolarDB instance in a virtual private cloud (VPC)	Ninguna	No
	Use a dedicated PolarDB instance	Ninguna	No
	The PolarDB product series is the Cluster Edition.	Ninguna	No
	Use a multi-zone PolarDB-X2 instance	Ninguna	No
	PolarDB cluster with a stable kernel version	Ninguna	No
	The PolarDB database minor version is stable	Ninguna	No
	The IP whitelist for a PolarDB instance cannot be set to all network segments	Ninguna	Sí
	No PolarDB cluster endpoints are enabled for public access	Ninguna	No
	The PolarDB instance has no Internet endpoint, or its IP whitelist is not set to all network segments	Ninguna	No
	Set the connection type of PolarDB cluster endpoints to a specified value	Ninguna	No
	Set the read/write pattern of the PolarDB cluster endpoint to Read/Write	Ninguna	No
	Set the session consistency level for the PolarDB cluster endpoint to a specified value	Ninguna	No
	The connection format of the PolarDB cluster endpoint is valid.	Ninguna	No
	The connection format for the primary endpoint of the PolarDB cluster is valid.	Ninguna	No
	The format of the read-only connection string for the PolarDB cluster is correct	Ninguna	No
	Enable a hot standby cluster for a PolarDB cluster	Ninguna	No
	Disable automatic addition of new nodes to a read-only endpoint of a PolarDB cluster	Ninguna	No
	Enable automatic addition of new nodes to PolarDB cluster endpoints	Ninguna	No
	Set the PolarDB cluster endpoints to accept reads on the primary database	Ninguna	No
	The transaction splitting status for the PolarDB cluster endpoints is set to Shutdown	Ninguna	No
	Enable TDE for a PolarDB cluster	Ninguna	No
	Configure SSL encryption for a PolarDB cluster	Ninguna	No
	Enable SQL Audit for a PolarDB cluster	Ninguna	No
	The default time zone parameter of the PolarDB cluster is not System	Ninguna	No
	The description for each account in a PolarDB cluster is not empty	Ninguna	No
ApsaraDB RDS	RDS subscription instance expiration check	Ninguna	Sí
	Long-running pay-as-you-go RDS instance check	Ninguna	No
	Enable delete protection for an RDS instance	Ninguna	No
	The RDS instance is not accessible over the Internet, or the IP whitelist is not set to all network segments	Ninguna	No
	The RDS instance is not connected to the Internet, and the IP whitelist is not set to all network segments	Ninguna	No
	No outdated RDS instances are used	Ninguna	No
	The RDS instance type meets the specified requirements	Ninguna	No
	The RDS instance meets the minimum CPU core requirements	Ninguna	No
	The RDS instance meets the minimum memory requirements	Ninguna	Sí
	The RDS instance meets minimum storage requirements	Ninguna	No
	The RDS instance meets the minimum read/write frequency	Ninguna	No
	Average connection utilization check for an RDS instance	Ninguna	No
	Average CPU utilization check for an RDS instance	Ninguna	Sí
	RDS instance average IOPS utilization check	Ninguna	No
	Average memory usage check for an RDS instance	Ninguna	No
	Idle CPU utilization check for an RDS instance	Ninguna	No
	RDS instance idle disk usage check	Ninguna	Sí
	Idle memory usage check for an RDS instance	Ninguna	No
	Check the remaining storage space of an RDS instance	Ninguna	No
	Use a dedicated RDS instance	Ninguna	No
	Use an RDS instance that runs in Cluster Edition	Ninguna	No
	Use an RDS instance in a virtual private cloud (VPC)	Ninguna	No
	The network type of the RDS instance is a virtual private cloud (VPC).	Ninguna	No
	The RDS instance has no public IP address	ACS-RDS-ReleaseInstancePublicConnection	No
	Configure the whitelist for an RDS instance	ACS-RDS-BulkyModifySecurityIpsByInstanceIPArray	Sí
	The IP whitelist of an RDS instance does not include the Internet	Ninguna	No
	Enable enhanced whitelist mode for an RDS instance	ACS-RDS-BulkyMigrateSecurityIPMode	No
	Use an SSL certificate for an RDS instance	Ninguna	No
	Enable SSL and specify a TLS version for an RDS instance	Ninguna	No
	Access SQL Server using the database proxy pattern	Ninguna	No
	Use a high-availability RDS instance	Ninguna	No
	Use a multi-zone RDS instance	Ninguna	No
	Automatic switchover configuration check for a primary/standby RDS instance	ACS-RDS-BulkyModifyHASwitchConfig	No
	RDS instance data replication is not asynchronous	Ninguna	No
	Create a disaster recovery instance for RDS	Ninguna	No
	RDS read/write instance latency check	Ninguna	No
	The primary and secondary nodes of an RDS cluster have inconsistent CPU and memory configurations	Ninguna	No
	The primary and secondary nodes of the RDS cluster are not configured with the same instance class	Ninguna	No
	Enable TDE for an RDS instance	Ninguna	No
	Enable TDE for an RDS instance using a custom key	Ninguna	No
	Enable disk encryption for an RDS instance	Ninguna	No
	RDS PostgreSQL data durability check	ACS-RDS-BulkyModifyParameter	No
	Enable log backup for an RDS instance	Ninguna	No
	Enable cross-region backup for an RDS instance	Ninguna	No
	RDS instance storage auto-scaling check	ACS-RDS-BulkyModifyDasInstanceConfig	No
	Check if auto scaling is enabled for RDS instances	Ninguna	No
	Enable SQL Audit for an RDS instance	ACS-RDS-BulkyModifySQLCollectorPolicy	No
	The SQL audit log for an RDS instance has the required retention period.	ACS-RDS-BulkyModifySQLCollectorRetention	No
	Enable historical events for an RDS instance	ACS-RDS-BulkyModifyActionEventPolicy	No
	Slow SQL statement detection for RDS instances	Ninguna	No
	Enable automatic minor version updates for an RDS instance	ACS-RDS-BulkyModifyDBInstanceAutoUpgradeMinorVersion	No
	Set a reasonable maintenance window for an RDS instance	Ninguna	No
	The RDS monitoring granularity settings meet the requirements.	Ninguna	No
	Create a dynamic ApsaraDB RDS secret for an RDS instance	Ninguna	No
	Set the PostgreSQL database parameter log_connections to on	Ninguna	No
	Set the PostgreSQL database parameter log_disconnections to on	Ninguna	No

Set the PostgreSQL database parameter log_duration to on	Ninguna	No
Enable security audit for a database instance	Ninguna	No
Enable SQL Audit for a database instance	Ninguna	No
ApsaraDB Tair (compatible con Redis)	Expiration check for Redis subscription instances	Ninguna	No
	Enable release protection for a Redis instance	Ninguna	No
	Set a reasonable backup time window for a Redis instance	Ninguna	No
	Enable incremental backup for a Redis instance	Ninguna	No
	Upgrade a Redis instance to the latest minor version	Ninguna	No
	Meet the required queries per second (QPS) for a Redis instance	Ninguna	No
	The Redis instance meets the specified bandwidth requirements	Ninguna	No
	The Redis instance meets the memory capacity requirement	Ninguna	No
	Average connection usage check for a Redis instance	Ninguna	No
	Average CPU usage of a Redis instance	Ninguna	No
	Average memory usage check for Redis instances	Ninguna	No
	Use a Redis instance in a VPC	Ninguna	No
	The Redis instance does not have a public IP address	ACS-Redis-ReleaseInstancePublicConnection	No
	Do not set the IP whitelist for a Redis instance to all network segments	ACS-Redis-BulkyDeleteSecurityIpFromInstanceIPArray	Sí
	Internet access is not enabled for the Redis instance, or the whitelist is not set to allow access from any source	Ninguna	No
	Enable password authentication for a Redis instance	Ninguna	No
	Enable SSL encryption for a Redis instance	Ninguna	No
	Enable SSL and specify a TLS version for a Redis instance	Ninguna	No
	Use a cluster Redis instance	Ninguna	No
	The Redis instance is a multi-zone instance	Ninguna	No
	The Redis instance has a dual-replica node type	Ninguna	No
	Use an Enterprise Edition Redis instance	Ninguna	No
	Enable TDE encryption for a Redis instance	Ninguna	No
	Enable transparent data encryption (TDE) for a Redis instance with a custom key	Ninguna	No
	Disable AOF persistence for a Tair instance	Ninguna	No
	Enable the audit log for a Redis instance	ACS-REDIS-BulkyModifyAuditLogConfig	No
	The audit logs for a Redis instance are kept for the required number of days	ACS-REDIS-BulkyModifyAuditLogConfig	No
	Disable high-risk commands for a Redis instance	ACS-Redis-BulkyModifyInstanceConfig	No
	Specified high-risk commands are disabled for the Redis instance	Ninguna	No
	Using DTS data synchronization to build real-time cache consistency	Ninguna	No
	Idle CPU utilization check for a Redis instance	Ninguna	No
	Idle detection for Redis instance memory usage	Ninguna	No
Lindorm	Use a multi-zone Lindorm instance	Ninguna	No
Lindorm	Public network access is not enabled for the Lindorm instance	Ninguna	No
ApsaraDB MongoDB	MongoDB subscription cluster expiration check	Ninguna	No
	Enable release protection for a MongoDB instance	Ninguna	No
	The MongoDB instance is not locked	Ninguna	No
	Enable the audit log on a MongoDB cluster	Ninguna	No
	Enable log backup for a MongoDB instance	Ninguna	No
	The MongoDB instance meets the specified read/write count requirement	Ninguna	No
	MongoDB meets the specified connection requirements	Ninguna	No
	MongoDB: Using dedicated or exclusive instances	Ninguna	No
	Use a MongoDB instance in a VPC	Ninguna	No
	Do not set the IP whitelist for a MongoDB instance to all network segments	Ninguna	No
	The MongoDB instance has no Internet access, or its security whitelist is not set to allow access from any source	Ninguna	No
	Enable Secure Sockets Layer (SSL) encryption for a MongoDB instance	Ninguna	No
	Use a multi-node MongoDB instance	Ninguna	No
	Using a multi-zone MongoDB instance	Ninguna	No
	Use a custom key to set TDE for MongoDB	Ninguna	No
	Idle CPU detection for a MongoDB instance	Ninguna	No
	MongoDB instance idle check by memory usage	Ninguna	No
	Free disk space check for MongoDB instances	Ninguna	No
AnalyticDB for MySQL	The AnalyticDB for MySQL cluster has no Internet endpoint	Ninguna	No
	The ADB cluster is in multi-zone deployment mode	Ninguna	No
	Enable SQL audit logs for an ADB cluster	Ninguna	No
	Enable log backup for an ADB cluster	Ninguna	No
	Set a reasonable maintenance window for an ADB cluster	Ninguna	No
	Check instance expiration for AnalyticDB for Data Warehouse	Ninguna	No
Almacén de datos nativo de la nube AnalyticDB for PostgreSQL	Use a multi-zone cloud-native data warehouse AnalyticDB instance	Ninguna	No
	Enable disk encryption for a PostgreSQL instance	Ninguna	No
	Enable SSL encryption for a PostgreSQL instance	Ninguna	No
	AnalyticDB for PostgreSQL: Check active data backups	Ninguna	No
ApsaraDB for ClickHouse	Using a multi-zone ApsaraDB for ClickHouse cluster instance	Ninguna	No
Time Series Database (TSDB)	The TSDB instance has no Internet access	Ninguna	No
Time Series Database (TSDB)	TSDB instance security whitelist check	Ninguna	No
ApsaraDB for HBase	The HBase cluster type is Cluster Edition	Ninguna	No
	HBase cluster in a VPC	Ninguna	No
	The HBase cluster does not have an Internet address	Ninguna	No
	Configure an HBase cluster for high availability	Ninguna	No
	Use a multi-zone HBase cluster	Ninguna	No
	Enable deletion protection for an HBase cluster	Ninguna	No
	HBase subscription cluster expiration check	Ninguna	No
ApsaraDB OceanBase	Enable Secure Sockets Layer (SSL) encryption for an OceanBase cluster	Ninguna	No
	The IP whitelist group settings for an OceanBase tenant are effective.	Ninguna	No
	Internet access is not enabled for the OceanBase tenant, or the security whitelist is not set to allow access from any source	Ninguna	No
	Enable transparent data encryption (TDE) for an OceanBase tenant	Ninguna	No
	Enable database backup for an OceanBase cluster	Ninguna	No
	Enable SQL diagnostics in an OceanBase cluster	Ninguna	No
Data Management (DMS)	Enable Stable Change checks in a DMS instance	Ninguna	No
Data Management (DMS)	Enable sensitive data protection for a database instance	Ninguna	No
Data Transmission Service (DTS)	Use a secure SSL connection for the source and destination databases of a DTS migration task	Ninguna	No
	Use SSL for the source database of a DTS tracking task	Ninguna	No
	Use SSL connections for the source and destination databases of a DTS sync task	Ninguna	No
	Enable geo-disaster recovery for a database instance using DTS	Ninguna	No

Cómputo de big data

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para remediación	¿Admite ejecución en seco?
Servicio de cómputo de big data nativo de la nube	Enable encryption for a MaxCompute project	Ninguna	No
	Enable an IP whitelist for a MaxCompute project	Ninguna	No
	A MaxCompute project uses a zone-disaster recovery architecture	Ninguna	No
Hologres	The Hologram instance has remote backup data	Ninguna	No
Realtime Compute for Apache Flink	Use multi-zone Flink instances	Ninguna	No
Retrieval and Analysis Service (Elasticsearch Edition)	Elasticsearch instance in a virtual private cloud (VPC)	Ninguna	No
	Kibana public network access is disabled for the Elasticsearch instance	Ninguna	Sí
	The Elasticsearch instance does not have public network access	Ninguna	Sí
	Internet access is not enabled for the Elasticsearch instance or access from any IP address is not allowed	Ninguna	No
	Enable disk encryption for data nodes of an Elasticsearch instance	Ninguna	No
	Enable disk encryption on elastic data nodes in an Elasticsearch instance	Ninguna	No
	Enable disk encryption for cold data nodes of an Elasticsearch instance	Ninguna	No
	Use the HTTPS transport protocol for an Elasticsearch instance	Ninguna	No
	Use a multi-zone Elasticsearch instance	Ninguna	No
	Enable automatic backups for an Elasticsearch instance	Ninguna	No
	Deprecated Elasticsearch instances are not used	Ninguna	No
	All Elasticsearch instances use supported versions	Ninguna	No
Plataforma de big data de código abierto E-MapReduce	Internet access check for the master node of an EMR cluster	Ninguna	No
Plataforma de big data de código abierto E-MapReduce	Unrestricted whitelist in EMR cluster security group	Ninguna	No

Gestión de migraciones y operaciones

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para remediación	Admite ejecución en seco
Resource Access Management (RAM)	No AccessKey for the Alibaba Cloud account	Ninguna	No
	No RAM users are created for the Alibaba Cloud account	Ninguna	No
	MFA is enabled for the Alibaba Cloud account	Ninguna	No
	Available credit alert is enabled	ACS-Config-BSS-ModifyAlarm	No
	Check your account password policy	Ninguna	No
	Resources with a specified name exist under the Alibaba Cloud account	Ninguna	No
	Simple Log Service data transformation tasks that meet specified requirements exist under the Alibaba Cloud account	Ninguna	No
	RAM user logon is checked	Ninguna	No
	RAM users have logged on within a specified period	Ninguna	No
	AccessKeys for RAM users are rotated within a specified period	Ninguna	No
	No active keys exist for RAM users	Ninguna	No
	No idle AccessKeys exist for RAM users	Ninguna	No
	No disabled AccessKeys exist for RAM users	Ninguna	No
	No access policies that meet specified conditions are attached to RAM users or their user groups	Ninguna	No
	No specified high-risk permissions are granted to RAM users	Ninguna	No
	A RAM user has no more than one active AccessKey	Ninguna	No
	Console access and API call access are not enabled for a RAM user at the same time	Ninguna	No
	The password policy for RAM users meets requirements	ACS-RAM-SetPasswordPolicy	No
	Password complexity in the password policy for RAM users meets requirements	Ninguna	No
	Maximum logon retries in the password policy for RAM users meets requirements	Ninguna	No
	Password expiration period in the password policy for RAM users meets requirements	Ninguna	No
	MFA is enabled for high-privilege RAM users	Ninguna	No
	MFA is enabled for RAM users	ACS-ECS-BulkyUpdateLoginProfile	No
	Check if a RAM user has enabled MFA for logon	Ninguna	No
	Permissions are not granted directly to RAM users	Ninguna	No
	RAM users belong to a user group	Ninguna	No
	RAM user groups are not empty	Ninguna	No
	No super administrator exists	Ninguna	No
	RAM users and their user groups do not have super administrator permissions or administrator permissions for any Alibaba Cloud service	Ninguna	No
	An access policy that meets specified parameter conditions is attached to RAM users	Ninguna	No
	Custom RAM policies do not contain the permission configuration specified by parameters	Ninguna	No
	No idle RAM access policies exist	Ninguna	No
	No idle RAM user groups exist	Ninguna	No
	The Alibaba Cloud account has a role with the specified name	Ninguna	No
	Roles defined by RAM users do not include product management permissions	Ninguna	No
	RAM roles do not have super administrator permissions or administrator permissions for any Alibaba Cloud service	Ninguna	No
	An access policy that meets specified parameter conditions is attached to RAM roles	Ninguna	No
	Role-based SSO is enabled	Ninguna	No
	SSO is enabled for RAM users	Ninguna	No
	CloudSSO SAML signing certificate expiration is checked	Ninguna	No
	CloudSSO SCIM key expiration is checked	Ninguna	No
Resource Management	Resources are located in specified regions	Ninguna	No
	Resource names match the specified regular expression	Ninguna	No
	Resource groups for linked instances are inherited from the parent ECS instance	ACS-Config-ResourceManager-BulkyMoveResources	No
	Linked resources inherit the resource group of the ECS disk	ACS-Config-ResourceManager-BulkyMoveResources	No
	Linked resources inherit the resource group of the ECS network interface card	ACS-Config-ResourceManager-BulkyMoveResources	No
	Linked resources inherit the resource group of the NAT Gateway	ACS-Config-ResourceManager-BulkyMoveResources	No
	Linked resources inherit the resource group of the SLB instance	ACS-Config-ResourceManager-BulkyMoveResources	No
	The resource group associated with a resource is not the default resource group	Ninguna	No
	Resources inherit specified tags from the resource group	ACS-TAG-TagResourcesIgnoreCaseSensitive	No
	Resources inherit tags from disks	ACS-TAG-TagResourcesIgnoreCaseSensitive	No
	Resources inherit tags from the parent ECS instance	Ninguna	No
	The account type for Resource Management is checked	Ninguna	No
	Resources inherit tags from Kafka instances	ACS-TAG-TagResourcesIgnoreCaseSensitive	No
Etiquetas Nota Para obtener información sobre los servicios de Alibaba Cloud compatibles con etiquetas, consulte Alibaba Cloud services that support tags.	All specified tags exist	ACS-TAG-TagResources	No
	At least one specified tag exists	Ninguna	No
	Matching multiple tag values with an enumeration	Ninguna	No
	All specified tags are matched	Ninguna	No
	Resources have tags	Ninguna	No
	Resource tags match the specified regular expression	ACS-TAG-TagResources	No
	Resource tags have consistent case and no leading or trailing whitespace	ACS-Config-Tag-TagResources	No
ActionTrail	A trail is enabled for ActionTrail	Ninguna	No
ActionTrail	Full log tracking is enabled for ActionTrail	Ninguna	No
CloudMonitor	A CloudMonitor alert rule is set for the specified Alibaba Cloud service	Ninguna	No
CloudMonitor	An event-triggered alert rule with the specified name is set in CloudMonitor	Ninguna	No

Inteligencia artificial

Servicio de Alibaba Cloud	Plantilla de regla	ID de plantilla de OOS para corrección	Ejecución en seco compatible
Platform for AI (PAI)	Set alerts for the PAI-DLC distributed training service	Ninguna	No
	Set alerts for the PAI-EAS online model service	Ninguna	No
	Enable AIMaster-based fault tolerance monitoring for PAI distributed training	Ninguna	No
	Enable computing power health checks for PAI distributed training	Ninguna	No
	PAI online model service instances are distributed across multiple zones	Ninguna	No
Alibaba Cloud Model Studio	Enable the input content safety guardrail for Model Studio	Ninguna	No
	Enable the output content safety guardrail for Model Studio	Ninguna	No
	Enable the input content prompt attack safety guardrail for Model Studio	Ninguna	No
	Enable the output content prompt attack safety guardrail for Model Studio	Ninguna	No
	Enable the output content malicious URL safety guardrail for Model Studio	Ninguna	No

Descripción general

Cómputo

ECS

Dedicated Host (DDH)

Auto Scaling

Function Compute

Contenedores

Container Service for Kubernetes

Container Registry (ACR)

Elastic Container Instance

Almacenamiento

Object Storage Service (OSS)

File Storage NAS

Tablestore

Simple Log Service

Cloud Storage Gateway

Red y CDN

Classic Load Balancer (CLB)

Application Load Balancer (ALB)

Network Load Balancer (NLB)

Gateway Load Balancer (GWLB)

Elastic IP Address

Internet Shared Bandwidth (CBWP)

Virtual Private Cloud (VPC)

NAT Gateway

CEN

VPN Gateway

Express Connect

CDN

Edge Security Acceleration

Alibaba Cloud DNS

Seguridad

Anti-DDoS

Web Application Firewall

Cloud Firewall

Security Center

Digital Certificate Management Service (SSL Certificate)

Key Management Service

Data Security Center

Bastionhost

Middleware

Microservices Engine (MSE)

Enterprise Distributed Application Service (EDAS)

ApsaraMQ for RocketMQ

Message Queue for Apache Kafka

Cola de mensajes ligera

API Gateway

Base de datos

Base de datos nativa de la nube PolarDB

ApsaraDB RDS

ApsaraDB Tair (compatible con Redis)

Lindorm

ApsaraDB MongoDB

AnalyticDB for MySQL

Almacén de datos nativo de la nube AnalyticDB for PostgreSQL

ApsaraDB for ClickHouse

Time Series Database (TSDB)

ApsaraDB for HBase

ApsaraDB OceanBase

Data Management (DMS)

Data Transmission Service (DTS)

Cómputo de big data

Servicio de cómputo de big data nativo de la nube

Hologres

Realtime Compute for Apache Flink

Retrieval and Analysis Service (Elasticsearch Edition)

Plataforma de big data de código abierto E-MapReduce

Gestión de migraciones y operaciones

Resource Access Management (RAM)

Resource Management

Etiquetas

ActionTrail

CloudMonitor

Inteligencia artificial

Platform for AI (PAI)

Alibaba Cloud Model Studio