:ListEvaluationMetadata

RAM authorization

Request parameters

Response elements

Examples

Success response

JSON format

{
  "EvaluationMetadata": [
    {
      "Metadata": [
        {
          "Category": "Security",
          "Description": "If you use an AccessKey pair of an Alibaba Cloud account, you have full permissions that cannot be restricted by conditions such as source IP address or access time. Once leaked, the risk is extremely high. If an AccessKey pair exists for the Alibaba Cloud account, it is considered non-compliant.",
          "DisplayName": "An AccessKey pair is enabled for the Alibaba Cloud account.",
          "Id": "pxgtda****",
          "RecommendationLevel": "High",
          "RemediationMetadata": {
            "Remediation": [
              {
                "Actions": [
                  {
                    "Classification": "UnusedAccessKeyInRamUser",
                    "CostDescription": "You are not charged for this operation.",
                    "Description": "A RAM user has both console logon and an AccessKey pair enabled, but the AccessKey pair has never been used.",
                    "Guidance": [
                      {
                        "ButtonName": "Manual fix",
                        "ButtonRef": "https://ram.console.alibabacloud.com/users",
                        "Content": "You must replace the AccessKey pair of your Alibaba Cloud account. To do so, perform the following steps:1. Log on to the RAM console. In the left-side navigation pane, choose Identities > Users. On the Users page, click Create User.2. On the Create User page, enter a logon name and select OpenAPI Access for the Access Mode parameter.3. After the RAM user is created, save the AccessKey pair. Then, find the user that you created on the Users page and click Add Permissions in the Actions column. In the Grant Permission panel, find the AdministratorAccess policy and attach it to the RAM user.4. In a program, replace the AccessKey pair of the Alibaba Cloud account with the AccessKey pair of the RAM user created in the previous step and check whether the program runs as expected in the test environment.5. If the program runs as expected, publish the program to the production environment and disable the previous AccessKey pair of your Alibaba Cloud account. Then, check whether the program runs as expected.6. If the program runs as expected, delete the disabled AccessKey pair after the specified period of time, such as 90 days.",
                        "Title": "Scenario 3: AccessKey pair that is used within the last 90 days"
                      }
                    ],
                    "Notice": "This governance item enables the Best Practices for AccessKey and Permission Governance compliance package in Cloud Config to check the settings and usage of AccessKey pairs, Alibaba Cloud accounts, and RAM users.",
                    "Suggestion": "Console logon is enabled for the RAM user and the RAM user owns an AccessKey pair, while the AccessKey pair has never been used by the RAM user. We recommend that you disable the AccessKey pair for 90 days. If no related issue occurs during this period, you can delete the AccessKey pair."
                  }
                ],
                "RemediationType": "Manual"
              }
            ]
          },
          "ResourceMetadata": {
            "ResourcePropertyMetadata": [
              {
                "DisplayName": "Last time the AccessKey pair was used",
                "PropertyName": "AkLastUsedTime",
                "PropertyType": "String"
              }
            ]
          },
          "Scope": "Account",
          "Stage": "Released",
          "TopicCode": "ResourceUtilization"
        }
      ],
      "Type": "Metric"
    }
  ],
  "RequestId": "16B208DD-86BD-5E7D-AC93-FFD44B6FBDF1"
}

Error codes

Release notes