Bare Metal Server (BMS)
|
-BMSs
+ | BMSs
+ |
+bms.servers
|
-Cloud Backup and Recovery (CBR)
+ |
Cloud Backup and Recovery (CBR)
|
-Vaults
+ | Vaults
+ |
+cbr.vault
|
-Cloud Container Engine (CCE)
+ |
Cloud Container Engine (CCE)
|
-Clusters
+ | Clusters
+ |
+cce.clusters
|
-Nodes
+ |
Nodes
+ |
+cce.nodes
|
-Cloud Container Instance (CCI)
+ |
Cloud Container Instance (CCI)
|
-Pods
+ | Pods
+ |
+cci.pods
|
-Cloud Search Service (CSS)
+ |
Config
|
-Clusters
+ | Trackers
+ |
+config.trackers
|
-DataArts Studio (DARTS)
+ |
PolicyAssignments
|
-Instances
+ | config.policyAssignments
|
-CDM Clusters
+ |
Cloud Search Service (CSS)
+ |
+Clusters
+ |
+css.clusters
|
-Workspaces
+ |
DataArts Studio (DARTS)
+ |
+Instances
+ |
+dayu.instances
|
-Database Security Service (DBSS)
+ |
CDM Clusters
|
-Cloud Servers
+ | dayu.cdmClusters
|
-Document Database Service (DDS)
+ |
Workspaces
|
-Instances
+ | dayu.workspaces
|
-Dedicated Host (DeH)
+ |
Database Security Service (DBSS)
|
-DeHs
+ | Cloud Servers
+ |
+dbss.cloudservers
|
-Data Lake Insight (DLI)
+ |
Document Database Service (DDS)
|
-Queues
+ | Instances
+ |
+dds.instances
|
-Elastic Resource Pools
+ |
Dedicated Host (DeH)
+ |
+DeHs
+ |
+deh.dedicatedhosts
|
-Distributed Message Service (DMS)
+ |
Data Lake Insight (DLI)
|
-Kafka Instances
+ | Queues
+ |
+dli.queues
|
-Data Replication Service (DRS)
+ |
Elastic Resource Pools
|
-Backup Migration Tasks
+ | dli.elasticresourcepool
|
-Disaster Recovery Tasks
+ |
Distributed Message Service (DMS)
+ |
+Kafka Instances
+ |
+dms.kafkas
|
-Data Synchronization Tasks
+ |
Data Replication Service (DRS)
+ |
+Backup Migration Tasks
+ |
+drs.backupMigrationJob
|
-Online Migration Tasks
+ |
Disaster Recovery Tasks
+ |
+drs.dataGuardJob
|
-Data Warehouse Service (DWS)
+ |
Data Synchronization Tasks
|
-Clusters
+ | drs.synchronizationJob
|
-Elastic Cloud Server (ECS)
+ |
Online Migration Tasks
|
-ECSs
+ | drs.migrationJob
|
-Elastic Load Balance (ELB)
+ |
Data Warehouse Service (DWS)
|
-Listeners
+ | Clusters
+ |
+dws.clusters
|
-Load Balancers
+ |
Elastic Cloud Server (ECS)
+ |
+ECSs
+ |
+ecs.cloudservers
|
-Enterprise Router (ER)
+ |
Elastic Load Balance (ELB)
|
-Enterprise Routers
+ | Listeners
+ |
+elb.listeners
|
-Attachments
+ |
Load Balancers
+ |
+elb.loadbalancers
|
-Elastic Volume Service (EVS)
+ |
Enterprise Router (ER)
|
-Disks
+ | Enterprise Routers
+ |
+er.instances
|
-GaussDB
+ |
Attachments
|
-Instances
+ | er.attachments
|
-Nodes
+ |
Elastic Volume Service (EVS)
+ |
+Disks
+ |
+evs.volumes
|
-GeminiDB
+ |
GaussDB
|
-Instances
+ | Instances
+ |
+gaussdb.instance
|
-Nodes
+ |
Nodes
+ |
+gaussdb.nodes
|
-Image Management Service (IMS)
+ |
GeminiDB
|
-Images
+ | Instances
+ |
+nosql.instances
|
-Key Management Service (KMS)
+ |
Nodes
|
-Keys
+ | nosql.nodes
|
-MapReduce Service (MRS)
+ |
Image Management Service (IMS)
|
-Clusters
+ | Images
+ |
+ims.images
|
-NAT Gateway (NAT)
+ |
Key Management Service (KMS)
|
-Public NAT Gateways
+ | Keys
+ |
+kms.keys
|
-Object Storage Service (OBS)
+ |
MapReduce Service (MRS)
|
-Buckets
+ | Clusters
+ |
+mrs.mrs
|
-Relational Database Service (RDS)
+ |
NAT Gateway (NAT)
|
-Instances
+ | Public NAT Gateways
+ |
+nat.natGateways
|
-Scalable File Service (SFS)
+ |
Object Storage Service (OBS)
|
-File Systems
+ | Buckets
+ |
+obs.buckets
|
-Simple Message Notification (SMN)
+ |
Relational Database Service (RDS)
|
-Topics
+ | Instances
+ |
+rds.instances
|
-Virtual Private Cloud (VPC)
+ |
Scalable File Service (SFS)
|
-VPCs
+ | File Systems
+ |
+sfsturbo.shares
|
-Bandwidths
+ |
Simple Message Notification (SMN)
+ |
+Topics
+ |
+smn.topic
|
-Security Groups
+ |
Virtual Private Cloud (VPC)
+ |
+VPCs
+ |
+vpc.vpcs
|
-EIPs
+ |
Bandwidths
+ |
+vpc.bandwidths
|
-Virtual Private Network (VPN)
+ |
Security Groups
|
-VPN Connections
+ | vpc.securityGroups
|
-VPN Gateways
+ |
EIPs
+ |
+vpc.publicips
|
-Web Application Firewall (WAF)
+ |
Virtual Private Network (VPN)
|
-Policies
+ | VPN Connections
+ |
+vpnaas.vpnConnections
|
-Certificates
+ |
VPN Gateways
+ |
+vpnaas.vpnGateways
+ |
+
+Web Application Firewall (WAF)
+ |
+Policies
+ |
+waf.policy
+ |
+
+Certificates
+ |
+waf.certificate
+ |
+
+Instances
+ |
+waf.instance
|
diff --git a/docs/config/umn/rms_01_0100.html b/docs/config/umn/rms_01_0100.html
index 32b46993..d2e4f009 100644
--- a/docs/config/umn/rms_01_0100.html
+++ b/docs/config/umn/rms_01_0100.html
@@ -2,7 +2,7 @@
Description
Config allows you to search for, record, and continuously evaluate your resource configurations to make sure that your resources are in expected status.
-
To get full functionality of Config, you need to enable the resource recorder. If the resource recorder is disabled, you may fail to update your resource data or accurately evaluate your resources with rules. For details about how to enable and configure the resource recorder, see Configuring the Resource Recorder.
+
To get full functionality of Config, you need to enable the resource recorder. If the resource recorder is disabled, you may fail to update your resource data or accurately evaluate your resources with rules. For details about how to enable and configure the resource recorder, see Configuring the Resource Recorder
Architecture
Config provides you with resource information, such as resource inventory, details, relationships, and change records. It stores your resource data every 24 hours and notifications of your resource changes every 6 hours. It will also notify you when a change is made to your resources. In addition, it enables you to use Config rules to evaluate your resources.
@@ -10,7 +10,7 @@
Access Methods
You can use either of the following methods to access Config.
- Management Console
The console is a web-based UI, where you can perform operations easily. Log in to the management console, click 
in the upper left corner, and choose Management & Deployment > Config.
- - Application Programming Interfaces (APIs)
To integrate Config into a third-party system for secondary development, you need to access the service by calling APIs. For details, see Config API Reference.
+ - Application Programming Interfaces (APIs)
To integrate Config into a third-party system for secondary development, you need to access the service by calling APIs. For details, see Config API Reference.
diff --git a/docs/config/umn/rms_01_0200.html b/docs/config/umn/rms_01_0200.html
index 26888ced..5a830d1d 100644
--- a/docs/config/umn/rms_01_0200.html
+++ b/docs/config/umn/rms_01_0200.html
@@ -9,7 +9,7 @@
Resource Change Records
Resource change records contain resource changes in a specific period of time.
A record will be generated if there is a change to resource relationships or attributes.
-
Resource attributes are key and value pairs that describe the characteristics of your resources. For example, a resource attribute can be the number of CPU cores of an ECS, the capacity of an EVS disk, or the password strength of an IAM user. For more details, see How Can I Obtain Resource Attributes Reported to Config?
+
Resource attributes are key and value pairs that describe the characteristics of your resources. For example, a resource attribute can be the number of CPU cores of an ECS, the capacity of an EVS disk, or the password strength of an IAM user. For more details, see How Can I Obtain Resource Attributes Reported to Config?.
Resource Recorder
The resource recorder tracks changes to your cloud resources that are supported by Config. What changes are tracked depends on what a service reports to Config.
If you have enabled the resource recorder and specified an OBS bucket and an SMN topic when you configure the resource recorder, Config will notify you if there is a change (creation, modification, deletion, relationship change) to the resources within the monitoring scope and periodically store your notifications and resource snapshots.
diff --git a/docs/config/umn/rms_01_0300.html b/docs/config/umn/rms_01_0300.html
index 8778f2fb..0e59d468 100644
--- a/docs/config/umn/rms_01_0300.html
+++ b/docs/config/umn/rms_01_0300.html
@@ -1,7 +1,7 @@
Function Overview
-
Table 1 lists the common functions of Config.
+
Table 1 lists common functions of Config.
To better understand Config functions, you can learn basic concepts first.
Table 1 Common functionsCategory
@@ -49,47 +49,44 @@
| You can view change records of a resource.
|
|---|
-Resource Compliance
+ |
Resource compliance
|
-Adding a rule
+ | Adding a rule
|
-You can use rules to evaluate resource compliance. You can select a custom or predefined policy and configure other related parameters when creating a rule.
+ | You can add a rule to evaluate resource compliance. To add a rule, you need to set a policy and other related parameters.
|
-Evaluating resource compliance
+ |
Evaluating resources
|
-You can click Evaluate in the Operation column to start the evaluation.
+ | You can click Evaluate in the Operation column for a rule to evaluate the resources that are within the monitoring scope of the rule.
|
-Disabling a rule
+ |
Disabling a rule
|
-You click Disable in the Operation column to disable a rule.
+ | You click Disable in the Operation column to disable a rule.
|
-Enabling a rule
+ |
Enabling a rule
|
-If you want to use a disabled rule, you can enable it.
+ | If you want to use a disabled rule, you can enable it.
|
-Modifying a rule
+ |
Modifying a rule
|
-If a rule does not meet your needs, you can change its configurations as needed.
+ | If a rule does not meet your needs, you can change its configurations as needed.
|
-Deleting a rule
+ |
Deleting a rule
|
-You can delete a rule which is no longer needed.
+ | You can delete a rule which is no longer needed.
|
-Noncompliant resources
+ |
Noncompliant resources
|
-You can view and export information about all noncompliant resources.
+ | You can view and export noncompliant resources.
|
-| |
- |
-
-Resource Recorder
+ |
Resource recorder
|
Enabling the resource recorder
|
diff --git a/docs/config/umn/rms_01_0600.html b/docs/config/umn/rms_01_0600.html
index 7b950d94..18c91cf6 100644
--- a/docs/config/umn/rms_01_0600.html
+++ b/docs/config/umn/rms_01_0600.html
@@ -7,7 +7,7 @@
System-Defined Permissions for Config
By default, new IAM users do not have permissions. You need to add a user to one or more groups and attach policies to the user groups. Users in a group inherit permissions from the group, so that they can perform operations on cloud services based on the permissions.
Config is a global service. You do not need to repeat Config authorization for different regions or switch regions for accessing Config.
A user with Config read-only permissions can view all resources on the Resource List page.
-
Policy: A type of fine-grained authorization method that defines permissions required to perform operations on specific cloud resources under certain conditions. Authorization using policies is more flexible and help you implement least privilege. Most policies define permissions based on APIs. API actions are the minimum granularity of permissions. For API actions supported by Config, see the Permissions Policies and Supported Actions section in Config API Reference. For details about fine-grained permissions and their dependencies for Config, see Fine-Grained Permissions for Config.
+
Policy: A type of fine-grained authorization method that defines permissions required to perform operations on specific cloud resources under certain conditions. Authorization using policies is more flexible and help you implement least privilege. Most policies define permissions based on APIs. API actions are the minimum granularity of permissions. For API actions supported by Config, see the Permissions Policies and Supported Actions section in Config API Reference. For details about fine-grained permissions and their dependencies for Config, see Fine-Grained Permissions for Config.
Table 1 lists all the system-defined permissions supported by Config.
Table 1 System-defined permissions supported by Config.Policy
diff --git a/docs/config/umn/rms_01_1100.html b/docs/config/umn/rms_01_1100.html
index f6e8b128..00f2257d 100644
--- a/docs/config/umn/rms_01_1100.html
+++ b/docs/config/umn/rms_01_1100.html
@@ -42,9 +42,9 @@
| 4,000
|
|---|
-Retention period of resource configuration information
+ |
The default retention period for resource configurations
|
-7 years
+ | 7 years (2,557 days)
|
diff --git a/docs/config/umn/rms_03_0104.html b/docs/config/umn/rms_03_0104.html
index 53060743..32c6d9d7 100644
--- a/docs/config/umn/rms_03_0104.html
+++ b/docs/config/umn/rms_03_0104.html
@@ -1,7 +1,7 @@
Exporting the Resource List
-Scenarios
On the Resource List page, you can export resource information.
+
Scenarios
On the Resource List page, you can export resource information.
Procedure
- Log in to the management console.
- Click
in the upper left corner. Under Management & Deployment, click Config. - Set search options to filter resources and click Export Resource Info above the list.
Only information that you can see in the list will be exported.
- If you do not set any search options, all your resources that are supported by Config will be exported.
- If you set search options to filter resources, only the search results will be exported. For details about how to filter resources, see Filtering Resources.
diff --git a/docs/config/umn/rms_03_0200.html b/docs/config/umn/rms_03_0200.html
index 42ceaa31..c2145a37 100644
--- a/docs/config/umn/rms_03_0200.html
+++ b/docs/config/umn/rms_03_0200.html
@@ -3,12 +3,12 @@
Viewing Resource Relationships
Scenarios
Config allows you to view resource relationships. A resource relationship may be described as that an EVS disk is attached to an ECS or an ECS is deployed in a VPC. Config only provides relationships of supported resources. For more details, see Relationships with Supported Resources.
-
Procedure
- Log in to the management console.
- Click in the upper left corner. Under Management & Deployment, click Config.
- On the Resource List page, click the name of a target resource.
- Click the Associated Resources tab.
Hover over the name of an associated resource to view resource information and resource relationships.
+Procedure
- Log in to the management console.
- Click in the upper left corner. Under Management & Deployment, click Config.
- On the Resource List page, click the name of a target resource.
- Click the Associated Resources tab.
Hover over the name of an associated resource to view resource information and resource relationships.
For each service, you can filter resources by resource ID or resource name.
Figure 1 Viewing associated resources
On the Associated Resources tab, you can click the name of an associated resource to view related information of this resource.
+
On the Associated Resources tab, you can click the name of an associated resource to view related information of this resource.
diff --git a/docs/config/umn/rms_04_0100.html b/docs/config/umn/rms_04_0100.html
index d3a6f5d4..b25f8ce4 100644
--- a/docs/config/umn/rms_04_0100.html
+++ b/docs/config/umn/rms_04_0100.html
@@ -6,7 +6,7 @@
- Notifies you using the specified SMN topic if your resources are created, modified, or deleted.
- Notifies you using the specified SMN topic if there is a change to your resource relationships.
- Stores notifications of your resource changes every 6 hours if you have configured an OBS bucket and an SMN topic.
- Stores resource snapshots every 24 hours if you have configured an OBS bucket.
For details about resources supported by the resource recorder, see Supported Resources.
-
Notes and Constraints
- When enabling and configuring the resource recorder, you must configure Topic or Resource Dump. To enable the resource recorder, you must configure either an SMN topic or an OBS bucket.
- To receive notifications of resource changes with the configured SMN topic, you not only have to create the topic, but also add subscription endpoints and request subscription confirmations for the topic. For details, see Creating a Topic, Adding a Subscription, and Requesting Subscription Confirmation.
- The resource recorder only updates data for the resources within the monitoring scope.
- The resource recorder retains your resource information for seven years (2,557 days).
- There is a delay in synchronizing resource data to Config. The delay varies depending on services. If the resource recorder is enabled, Config will update related data for resources that are included in the monitoring scope within 24 hours. If the resource recorder is disabled, Config will not update resource data.
+
Notes and Constraints
- When enabling and configuring the resource recorder, you must configure Topic or Resource Dump. To enable the resource recorder, you must configure either an SMN topic or an OBS bucket.
- To receive notifications of resource changes with the configured SMN topic, you not only have to create the topic, but also add subscription endpoints and request subscription confirmations for the topic. For details, see Creating a Topic, Adding a Subscription, and Requesting Subscription Confirmation.
- The resource recorder only updates data for the resources within the monitoring scope.
- By default, the resource configuration information is stored for seven years (2,557 days).
- There is a delay in synchronizing resource data to Config. The delay varies depending on services. If the resource recorder is enabled, Config will update related data for resources that are included in the monitoring scope within 24 hours. If the resource recorder is disabled, Config will not update resource data.
To get full functionality of Config, you need to enable the resource recorder. If the resource recorder is disabled, you may fail to update your resource data or accurately evaluate your resources with rules.
diff --git a/docs/config/umn/rms_04_0200.html b/docs/config/umn/rms_04_0200.html
index bc9d3cbb..290bfed4 100644
--- a/docs/config/umn/rms_04_0200.html
+++ b/docs/config/umn/rms_04_0200.html
@@ -15,27 +15,32 @@
- Select an OBS bucket from the current account:
Select Your bucket and then select a bucket from the drop-down list to store resource change notifications and resource snapshots. If you need to store the notifications and snapshots to a specific folder in the OBS bucket, enter the folder name after you select a bucket. If there are no OBS buckets in the current account, create one first. For details, see Creating a Bucket.
- Select an OBS bucket from another account:
Select Other users' bucket and then configure Region ID and Bucket Name. If you need to store the notifications and snapshots to a specific folder in the OBS bucket, enter the folder name after you select a bucket. If you select a bucket from another account, you need required permissions granted by the account. For details, see Cross-Account Authorization.
-
After you specify an OBS bucket from the current or another account, Config will write an empty file named ConfigWritabilityCheckFile to the OBS bucket to verify whether resources can be written to the OBS bucket. If an error is reported, you can resolve related issues based on Why Is an Error Reported When Data Is Dumped to the OBS Bucket After the Resource Recorder Is Enabled?.
+
Figure 3 Configuring an OBS bucket
+
- Specify a data retention period.
Select Seven years (2,557 days) or select A custom period and enter a retention period from 30 days to 2,557 days.
+ The data retention period only applies to resource configuration data and snapshots reserved by Config. It will not affect your data storage with SMN or OBS.
+
Config will delete data that has been reserved for a longer time than the specified retention period.
+
+Figure 4 Configuring a data retention period
- (Optional) Configure an SMN topic.
Toggle on Topic, then select a region and an SMN topic for receiving notifications of resource changes.
- Select a topic from the current account:
Select Your topic, then select a region and an SMN topic. If there are no SMN topics available, create one first. For details, see Creating a Topic.
- - Select a topic from another account:
Select Topic under other account, then enter a topic URN. For more details about topic URN, see Concepts If you select a topic from another account, you need required permissions granted by the account. For details, see Cross-Account Authorization.
+ - Select a topic from another account:
Select Topic under other account, then enter a topic URN. For more details about topic URN, see Concepts. If you select a topic from another account, you need required permissions granted by the account. For details, see Cross-Account Authorization.
- To send notifications with an SMN topic, you not only need to create the topic, but also need to add subscriptions and request subscription confirmations.
+
-
Figure 4 Configuring an SMN topic
-
- Grant permissions.
Modifying the Resource Recorder
You can modify the resource recorder at any time.
-
- In the navigation pane on the left, choose Resource Recorder.
- Click Modify Resource Recorder.
Figure 6 Modify Resource Recorder
+- In the navigation pane on the left, choose Resource Recorder.
- Click Modify Resource Recorder.
Figure 7 Modify Resource Recorder
- Modify configurations.
- Click Save.
- In the displayed dialog box, click Yes.
Disabling the Resource Recorder
You can disable the resource recorder at any time.
-
- In the navigation pane on the left, choose Resource Recorder.
- Toggle off the resource recorder.
- In the displayed dialog box, click OK.
Figure 7 Disabling the resource recorder
+- In the navigation pane on the left, choose Resource Recorder.
- Toggle off the resource recorder.
- In the displayed dialog box, click OK.
Figure 8 Disabling the resource recorder
Cross-Account Authorization
- Granting SMN topic permissions to another account
- Log in to the management console with the authorizing account and go to the SMN console.
- Attach related SMN permissions to target accounts based on Configuring Topic Policies.
@@ -67,7 +72,7 @@
Storing Resource Change Notifications and Resource Snapshots to an Encrypted OBS Bucket
- Using an OBS bucket that is encrypted with a default key of SSE-KMS
If you need to store resource change notifications and snapshots to an OBS bucket encrypted using a default key of SSE-KMS, you need to add the KMS Administrator permission to the agency assigned to the resource recorder.
- Using an OBS bucket that is encrypted with a custom key of SSE-KMS
If you need to store resource change notifications and snapshots to an OBS bucket that is encrypted using a custom key of SSE-KMS, you need to add the KMS Administrator permission to the agency assigned to the resource recorder.
If you need to store resource change notifications and snapshots to an OBS bucket that is from another account, and that is encrypted using a custom key of SSE-KMS, you need to add the KMS Administrator permission to the agency assigned to the resource recorder, and set the cross-account permission for the key at the same time. The procedure is as follows:
-- Log in to the management console and go to the Key Management Service console.
- In the Custom Keys tab, click the alias of a target key to go to its details page and create a grant on it.
- Grant the account the permission for using the key based on Creating a Grant.
- Enter the ID of the account to be authorized for Grantee.
- Select Create Data Key, Describe Key, and Decrypt Data Key for Granted Operations.
+- Log in to the management console and go to the Key Management Service console.
- In the Custom Keys tab, click the alias of a target key to go to its details page and create a grant on it.
- Grant the account the permissions for using the key based on Creating a Grant.
- Enter the ID of the account to be authorized for Grantee.
- Select Create Data Key, Describe Key, and Decrypt Data Key for Granted Operations.
Adding a Rule with a Predefined Policy
-Scenarios
You can create a rule to evaluate your resource compliance. When you create a rule, you can select a built-in policy or custom policy, specify a monitoring scope, and specify the trigger type. Evaluation results are provided for you to check compliance data.
+
Scenarios
You can create a rule to evaluate your resource compliance. When creating a rule, you can select a built-in policy or custom policy, specify a monitoring scope, and specify the trigger type. Evaluation results are provided for you to check compliance data.
This section describes how to add predefined rules.
Constraints and Limitations
- You can add up to 500 rules in an account.
diff --git a/docs/config/umn/rms_05_0300.html b/docs/config/umn/rms_05_0300.html
index e16d13ac..a9459ba8 100644
--- a/docs/config/umn/rms_05_0300.html
+++ b/docs/config/umn/rms_05_0300.html
@@ -15,13 +15,13 @@
Modifying a Rule
- Log in to the management console.
- Click in the upper left corner. Under Management & Deployment, click Config.
- In the navigation pane on the left, choose Resource Compliance.
- On the Rules tab, locate a target rule and click More > Modify in the Operation column.
Figure 3 Modifying a rule
- On Basic Configurations page, modify the rule description and click Next.
- On the Configure Rule Parameters page, configure required parameters and click Next.
The configuration items that you can modify vary for different policies.
-- Filter Type: Can be modified when Trigger Type is set to Configuration change
- Resource Scope: Can be modified when Trigger Type is set to Configuration change
- Filter Scope: Can be modified when Trigger Type is set to Configuration change.
- Execute Every: Can be modified when Trigger Type is set to Periodic execution.
- Configure Rule Parameters: For a rule created with a predefined policy, you can only modify the values of parameters for Configure Rule Parameters. For a custom rule, you can add, delete, and modify parameters.
+- Filter Type: Can be modified when Trigger Type is set to Configuration change
- Resource Scope: Can be modified when Trigger Type is set to Configuration change
- Filter Scope: Can be modified when Trigger Type is set to Configuration change.
- Execute Every: Can be modified when Trigger Type is set to Periodic execution.
- Configure Rule Parameters: For a rule created with a predefined policy, you can only modify the values of parameters for Configure Rule Parameters. For a custom rule, you can add, delete, and modify related parameters.
- Confirm the modifications and click Submit.
After a rule is modified, it will be automatically triggered.
-
Deleting a Rule
Before deleting a rule, you need to disable the rule.
-
- Log in to the management console.
- Click in the upper left corner. Under Management & Deployment, click Config.
- In the navigation pane on the left, choose Resource Compliance.
- On the Rules tab, locate a target rule and click More > Delete in the Operation column.
Figure 4 Deleting a rule
+Deleting a Rule
To delete a rule, you need to disable the rule first.
+
- Log in to the management console.
- Click in the upper left corner. Under Management & Deployment, click Config.
- In the navigation pane on the left, choose Resource Compliance.
- On the Rules tab, locate a target rule and click More > Delete in the Operation column.
Figure 4 Deleting a rule
- Click OK.
diff --git a/docs/config/umn/rms_05_0404.html b/docs/config/umn/rms_05_0404.html
index 048afca1..fceb153f 100644
--- a/docs/config/umn/rms_05_0404.html
+++ b/docs/config/umn/rms_05_0404.html
@@ -14,7 +14,8 @@
For details about how to enable and configure the resource recorder, see Configuring the Resource Recorder.
Creating a Function with FunctionGraph
- Log in to the management console.
- Click
in the upper left corner of the page. In the service list that is displayed, under Compute, select FunctionGraph. - In the navigation pane on the left, choose Functions > Function List.
- In the upper right corner, click Create Function. The Create from scratch tab is displayed by default.
- Set Function Type to Event Function and configure the required IAM agency. The agency grants the function required permissions and must include the rms:policyStates:update permission.
- Click Create Function.
- In the code box, enter a function and click Deploy.
For details about example code, see Example Functions (Python).
+Creating a Function with FunctionGraph
- Log in to the management console.
- Click in the upper left corner of the page. In the service list that is displayed, under Compute, select FunctionGraph.
- In the navigation pane on the left, choose Functions > Function List.
- In the upper right corner, click Create Function. The Create from scratch tab is displayed by default.
- Set Function Type to Event Function and configure other parameters, including the function name and IAM agency.
The agency grants the function required permissions and must include the rms:policyStates:update permission.
+ - Click Create Function.
- In the code box, enter a function and click Deploy.
For details about example code, see Example Functions (Python).
- Click Configurations, modify Execution Timeout (s) and Memory (MB) in the Basic Settings area as required. Configure Concurrency.
- Click Save.
For more details, see Creating an Event Function.
Scenario
After you add a rule, you can view all rules in the rule list and view evaluation results and configurations of a rule on the rule details page.
You can export all evaluation results. On the upper right corner of the rule details page, multiple buttons are provided for you to trigger, modify, enable, disable, or delete a rule.
-
Procedure
- Log in to the management console.
- Click in the upper left corner. Under Management & Deployment, click Config.
- In the navigation pane on the left, choose Resource Compliance.
- On the Rules tab, view rules, rule status, and evaluation results.
- Click the name of the target rule to go to the Rule Details page.
On the left of the Basic Information page, evaluation results are displayed, and on the right, rule details are displayed. Above the evaluation result list, you can filter evaluation results by resource name and ID. You can also export the list.
+Procedure
- Log in to the management console.
- Click in the upper left corner. Under Management & Deployment, click Config.
- In the navigation pane on the left, choose Resource Compliance.
- On the Rules tab, view rules, rule status, and evaluation results.
- Click the name of the target rule to go to the Rule Details page.
On the left of the Basic Information tab, evaluation results are displayed, and on the right, rule details are displayed. Above the list, you can filter the resources by evaluation result, resource name, and resource ID. You can also export all evaluation results.
Figure 1 Rule Details
A rule may be in one of the following statuses:
- Enabled: The rule is available.
- Disabled: The rule is disabled.
- Evaluating: The rule is evaluating resources.
- Submitting: The rule is submitting an evaluation task to the associated FunctionGraph function.
diff --git a/docs/config/umn/rms_06_0701.html b/docs/config/umn/rms_06_0701.html
index 75fe5c49..8c1c2df0 100644
--- a/docs/config/umn/rms_06_0701.html
+++ b/docs/config/umn/rms_06_0701.html
@@ -156,7 +156,7 @@
aggregator_resources contains domain_id that indicates the account ID. The type of a domain ID is a string.
provider and type represent a unique resource. For different resources, properties varies. For example, for an ECS, the provider and type are ecs and cloudservers, and the properties contains flavor. For a VPC, the provider and type are vpc and publicips, and the properties contains bandwidth.
-
You can obtain resource attributes that can be included in the properties element for each resource on Config console or by calling the related API. For more details, see How Can I Obtain Resource Attributes Reported to Config?.
+
You can obtain resource attributes that can be included in the properties element for each resource on Config console or by calling the related API. For more details, see How Can I Obtain Resource Attributes Reported to Config?
properties supports nested queries. The following shows an example of how to query the addresses parameter under properties for the running ECS.
SELECT name, created, updated, properties.addresses FROM resources
WHERE provider = 'ecs' AND type = 'cloudservers' AND properties.status = 'ACTIVE'
diff --git a/docs/config/umn/rms_08_0100.html b/docs/config/umn/rms_08_0100.html
index 6316ced6..03d921fb 100644
--- a/docs/config/umn/rms_08_0100.html
+++ b/docs/config/umn/rms_08_0100.html
@@ -14,7 +14,7 @@
Why Are Resource Change Notifications Not Stored into the Configured OBS Bucket?
To store resource change notifications, you need to configure both an SMN topic and an OBS bucket.
To make an SMN topic effective, you not only need to create a topic, but add subscription endpoints and request subscription confirmation.
-
Why Do I Receive a Notification When I Did Nothing with a Resource?
If you have specified an effective SMN topic when you enabled the resource recorder, Config will send notifications of resource changes that are resulted from both user operations and non-user operations. For more details, see Notifications. You are advised to use HTTPS or FunctionGraph (functions) instead of SMS messages or emails to receive notifications from Config.
+
Why Do I Receive a Notification When I Did Nothing with a Resource?
If you have specified an effective SMN topic when you enabled the resource recorder, Config will send notifications of resource changes that are resulted from both user operations and non-user operations. For more details, see Notifications. You are advised to use HTTPS or FunctionGraph functions instead of SMS messages or emails to receive notifications from Config.
How Can I Obtain Resource Attributes Reported to Config?
You can obtain resource attributes reported to Config in either of the following ways:
- Go to Config console and open the Query Editor. Resource attributes that are reported to Config are displayed on the left side of the Query Editor. The following procedure shows how to open the Query Editor.
- Log in to the management console.
- Click
in the upper left corner of the page. In the service list that is displayed, under Management & Deployment, select Config. - In the navigation pane on the left, choose Advanced Queries.
- On the Default Queries tab, click Query in the Operation column of any rows.
Figure 1 Using a query
@@ -22,7 +22,7 @@
- Alternatively, you can call the the querying schema API (GET /v1/resource-manager/domains/{domain_id}/schemas) to obtain resource attributes. In the response, the type field indicates the resource type, and the schema field indicates resource attributes that are reported to Config. For more details, see Config API Reference.
-
Why Is an Error Reported When Data Is Dumped to the OBS Bucket After the Resource Recorder Is Enabled?
If the message "Failed to write the ConfigWritabilityCheckFile file to the OBS bucket because the OBS bucket or the IAM agency is invalid" is displayed, the possible reasons are as follows:
- The IAM agency assigned to the resource recorder does not contain the permission, obs:object:PutObject.
- If an OBS bucket from the current account was used, the reason may be that the bucket policy explicitly denies the PutObject action from the IAM agency. If an OBS bucket from another account was used, the reason may be that the bucket policy does not explicitly allow the PutObject action from the IAM agency. For more details, see Cross-Account Authorization and Effect.
- You used an encrypted OBS bucket, but the agency assigned to the resource recorder did not contain related KMS permissions. For more details, see Storing Resource Change Notifications and Resource Snapshots to an Encrypted OBS Bucket.
+
Why Is an Error Reported When Data Is Dumped to the OBS Bucket After the Resource Recorder Is Enabled?
If the message "Failed to write the ConfigWritabilityCheckFile file to the OBS bucket because the OBS bucket or the IAM agency is invalid" is displayed, the possible reasons are as follows:
- The IAM agency assigned to the resource recorder does not contain the permission, obs:object:PutObject.
- If an OBS bucket from the current account was used, the reason may be that the bucket policy explicitly denies the PutObject action from the IAM agency. If an OBS bucket from another account was used, the reason may be that the bucket policy does not explicitly allow the PutObject action from the IAM agency. For more details, see Cross-Account Authorization. For permission judgement logic of budget policies, see Effect.
- You used an encrypted OBS bucket, but the agency assigned to the resource recorder did not contain related KMS permissions. For more details, see Storing Resource Change Notifications and Resource Snapshots to an Encrypted OBS Bucket.
diff --git a/docs/config/umn/rms_10_0200.html b/docs/config/umn/rms_10_0200.html
index fbab2cf4..103458fc 100644
--- a/docs/config/umn/rms_10_0200.html
+++ b/docs/config/umn/rms_10_0200.html
@@ -7,6 +7,8 @@
Creating a Custom Query
- Log in to the management console.
- Click in the upper left corner. Under Management & Deployment, click Config.
- In the navigation pane on the left, choose Advanced Queries.
- Choose the Custom Queries tab and click Create Query in the upper right corner.
Figure 1 Create Query
- In the Query Editor, enter the query statements.
On the left of the page, the Schema information is displayed. Schema information shows detailed resource attributes that are specified by the properties parameter in the statement. For details about query statements, see Configuration Examples of Advanced Queries.
+
- Click Save Query and enter the query name and description.
A query name can contain only digits, letters, underscores (_), and hyphens (-). It cannot exceed 64 characters.
- Click OK.
Figure 2 Saving a query
There is a limit to how many custom queries you can create. If you exceed this limit, you will receive a notification: "The maximum number of custom queries has been reached." Although the query cannot be saved, you can still run the query and export the results.
