配置化合規包模板功能為您提供了強大的合規管理能力，允許您定義和匯入匯出符合自身業務需求的官方規則樣板集和靈活的自訂條件規則集，來滿足業務合規性要求。通過深入理解合規包模板結構和欄位含義，您可以更加高效地定製符合自身業務情境的各種合規規則集。
模板結構
匯出的合規包模板是一個JSON格式檔案，以合規包名字為檔案名稱，以.json為尾碼。您可以匯入尾碼為.txt或.json的檔案（該檔案必須小於等於1 MB），檔案的結構包括compliancePackTemplate（非必填）和configRuleTemplates（必填）兩部分。
compliancePackTemplate
compliancePackTemplate包括合規包的名稱、描述和風險等級，其定義的JSON結構如下：
{
"riskLevel": 1,
"compliancePackName": "合規包的名稱",
"description": "合規包的描述",
"scope": {
"complianceResourceTypes": [
"適配的資源類型"
],
"complianceResourceIds": [
"評估的資源ID"
],
"complianceExcludeResourceIds": [
"排除的資源ID"
],
"complianceRegionIds": [
"評估的指定地區ID"
],
"complianceExcludeRegionIds": [
"排除的指定地區ID"
],
"complianceResourceGroupIds": [
"評估的指定資源群組ID"
],
"complianceExcludeResourceGroupIds": [
"排除的指定資源群組ID"
],
"complianceTagsScope": [
{
"tagKey": "生效標籤Key",
"tagValue": "生效標籤KeyValue"
}
],
"complianceExcludeTagsScope": [
{
"tagKey": "排除標籤Key",
"tagValue": "排除標籤Value"
}
]
}
}參數 | 是否必填 | 說明 |
compliancePackName | 否 | 合規包名稱。建議使用合規情境定義，合規包的命名有以下兩種方式：
|
riskLevel | 否 | 合規包風險等級。用於區分不同合規包的重要性，取值：
|
description | 否 | 合規包描述。用於補充描述合規包的應用情境。 |
scope | 否 | 關聯設定規則應用範圍。 |
樣本如下：
{
"configRuleTemplates": [],
"compliancePackTemplate": {
"riskLevel": 2,
"compliancePackName": "配置化合規包模版編寫測試",
"scope": {
"complianceResourceIds": [
"i-t4n3u1pz97547xg****.i-t4n3u1pz97547xg0****.",
"i-t4n1bxf3xr70wjh5****",
"i-t4n133q6k9czgun****",
"i-t4n3s3qqti2zaxu****"
],
"complianceResourceGroupIds": [
"rg-aek2yl36l*****"
],
"complianceTagsScope": [
{
"tagKey": "config",
"tagValue": "configTest"
}
],
"complianceRegionIds": [
"ap-southeast-1"
]
},
"description": "配置化合規包模版編寫測試-匯入匯出測試"
}
}configRuleTemplates
合規包中規則在configRuleTemplates中定義為JSON數組，結構如下：
[
{
"configRuleName": "規則名稱",
"riskLevel": 3,
"scope": {
"complianceResourceTypes": [
"適配的資源類型"
],
"complianceResourceIds": [
"評估的資源ID"
],
"complianceExcludeResourceIds": [
"排除的資源ID"
],
"complianceRegionIds": [
"評估的指定地區ID"
],
"complianceExcludeRegionIds": [
"排除的指定地區ID"
],
"complianceResourceGroupIds": [
"評估的指定資源群組ID"
],
"complianceExcludeResourceGroupIds": [
"排除的指定資源群組ID"
],
"complianceTagsScope": [
{
"tagKey": "生效標籤Key",
"tagValue": "生效標籤Value"
}
],
"complianceExcludeTagsScope": [
{
"tagKey": "排除標籤Key",
"tagValue": "排除標籤Value"
}
]
},
"description": "規則描述",
"source": {
"owner": "規則的來源",
"identifier": "規則的標識符",
"sourceDetails": [
{
"messageType": "規則引發類型",
"maximumExecutionFrequency": "觸發周期"
},
{
"messageType": "規則引發類型"
}
],
"conditions": "自訂條件規則的內容"
},
"inputParameters": {
"paramName1": "參數值1",
"paramName2": "參數值2"
}
}
]參數 | 是否必填 | 說明 |
configRuleName | 是 | 規則名稱。 |
scope.complianceResourceTypes | 是 | 規則適配的資源類型，可以是多值數組。 |
description | 否 | 規則描述。 |
source.owner | 是 | 規則的來源。取值：
|
source.identifier | 是 | 規則的標識符。包括以下兩種：
|
source.sourceDetails.messageType | 是 | 規則引發機制。取值：
|
source.sourceDetails.maximumExecutionFrequency | 否 | 規則執行循環。取值：
說明 當 |
source.conditions | 否 | 自訂條件規則的內容。 說明 當 |
inputParameters | 否 | 規則入參。在規則模板列表的每條規則的規則詳情的規則入參中可以看到需要填寫的規則入參，所有規則入參均為字串類型輸入。 |
scope | 否 | 關聯設定規則應用範圍。 |
riskLevel | 否 | 規則風險等級。取值：
|
樣本如下：
{
"configRuleTemplates": [
{
"configRuleName": "ECS執行個體開啟釋放保護",
"riskLevel": 3,
"scope": {
"complianceResourceIds": [
"i-t4n3u1pz97547xg0****.i-t4n3u1pz97547xg0****",
"i-t4n1bxf3xr70wjh5****",
"i-t4n133q6k9czgun****",
"i-t4n3s3qqti2zaxu****"
],
"complianceResourceGroupIds": [
"rg-aek2yl36lg****"
],
"complianceTagsScope": [
{
"tagKey": "config",
"tagValue": "configTest"
}
],
"complianceRegionIds": [
"ap-southea****"
],
"complianceResourceTypes": [
"ACS::ECS::Instance"
]
},
"description": "ECS執行個體開啟釋放保護，視為“合規”。",
"source": {
"owner": "ALIYUN",
"identifier": "ecs-instance-deletion-protection-enabled",
"sourceDetails": [
{
"messageType": "ConfigurationItemChangeNotification"
}
]
},
"inputParameters": {}
}
],
"compliancePackTemplate": {
"riskLevel": 2,
"compliancePackName": "配置化合規包模版編寫測試",
"scope": {
"complianceResourceIds": [
"i-t4n3u1pz97547xg****.i-t4n3u1pz97547xg****",
"i-t4n1bxf3xr70wjh5****",
"i-t4n133q6k9czgunx****",
"i-t4n3s3qqti2zaxux****"
],
"complianceResourceGroupIds": [
"rg-aek2yl36lgo****"
],
"complianceTagsScope": [
{
"tagKey": "config",
"tagValue": "configTest"
}
],
"complianceRegionIds": [
"ap-southeast-1"
]
},
"description": "配置化合規包模版編寫測試-匯入匯出測試"
}
}完整樣本
{
"configRuleTemplates": [
{
"configRuleName": "ECS執行個體付費類型為訂用帳戶",
"riskLevel": 3,
"scope": {
"complianceResourceIds": [
"i-t4n3u1pz97547xg0****.i-t4n3u1pz97547xg*****",
"i-t4n1bxf3xr70wjh5*****",
"i-t4n133q6k9czgun*****",
"i-t4n3s3qqti2zaxu*****"
],
"complianceResourceGroupIds": [
"rg-aek2yl36l*****"
],
"complianceTagsScope": [
{
"tagKey": "config",
"tagValue": "configTest"
}
],
"complianceRegionIds": [
"ap-southeast-1"
],
"complianceResourceTypes": [
"ACS::ECS::Instance"
]
},
"description": "檢測ECS執行個體的付費類型，若執行個體付費類型為訂用帳戶，視為“合規”。",
"source": {
"owner": "ALIYUN",
"identifier": "ecs-instance-chargetype-check",
"sourceDetails": [
{
"messageType": "ConfigurationItemChangeNotification"
}
]
},
"inputParameters": {}
},
{
"configRuleName": "ECS執行個體禁止綁定公網地址",
"riskLevel": 3,
"scope": {
"complianceResourceIds": [
"i-t4n3u1pz97547x*****.i-t4n3u1pz97547*****",
"i-t4n1bxf3xr70w*****",
"i-t4n133q6k9czg*****",
"i-t4n3s3qqti2zax******"
],
"complianceResourceGroupIds": [
"rg-aek2yl36l*****"
],
"complianceTagsScope": [
{
"tagKey": "config",
"tagValue": "configTest"
}
],
"complianceRegionIds": [
"ap-southeast-1"
],
"complianceResourceTypes": [
"ACS::ECS::Instance"
]
},
"description": "ECS執行個體沒有直接綁定IPv4公網IP或Elastic IP Address，視為“合規”。",
"source": {
"owner": "ALIYUN",
"identifier": "ecs-instance-no-public-ip",
"sourceDetails": [
{
"messageType": "ConfigurationItemChangeNotification"
}
]
},
"inputParameters": {}
},
{
"configRuleName": "ECS執行個體開啟釋放保護",
"riskLevel": 3,
"scope": {
"complianceResourceIds": [
"i-t4n3u1pz9754*****.i-t4n3u1pz97547x*****",
"i-t4n1bxf3xr70wj*****",
"i-t4n133q6k9czgu*****",
"i-t4n3s3qqti2zaxu*****"
],
"complianceResourceGroupIds": [
"rg-aek2yl36l****"
],
"complianceTagsScope": [
{
"tagKey": "config",
"tagValue": "configTest"
}
],
"complianceRegionIds": [
"ap-southeast-1"
],
"complianceResourceTypes": [
"ACS::ECS::Instance"
]
},
"description": "ECS執行個體開啟釋放保護，視為“合規”。",
"source": {
"owner": "ALIYUN",
"identifier": "ecs-instance-deletion-protection-enabled",
"sourceDetails": [
{
"messageType": "ConfigurationItemChangeNotification"
}
]
},
"inputParameters": {}
}
],
"compliancePackTemplate": {
"riskLevel": 2,
"compliancePackName": "配置化合規包模版編寫測試",
"scope": {
"complianceResourceIds": [
"i-t4n3u1pz97547xg0*****.i-t4n3u1pz97547xg******",
"i-t4n1bxf3xr70w******",
"i-t4n133q6k9czgun*****",
"i-t4n3s3qqti2zaxux*****"
],
"complianceResourceGroupIds": [
"rg-aek2yl36l******"
],
"complianceTagsScope": [
{
"tagKey": "config",
"tagValue": "configTest"
}
],
"complianceRegionIds": [
"ap-southeast-1"
]
},
"description": "配置化合規包模版編寫測試-匯入匯出測試"
}
}匯入匯出
您可以通過匯入.json或.txt檔案的方式將合規包模板匯入配置審計。您還可以匯出.json格式的合規包模板，匯出的模板檔案可以方便地分享和備份，提高規則管理的靈活性和便捷性。