ListEvaluationMetadata - Cloud Governance Center - Alibaba Cloud Documentation Center

Queries the metadata for all available governance evaluation items, including their names, IDs, descriptions, stages, resource detail metadata, and remediation guides.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

governance:ListEvaluationMetadata

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	No	The region ID.	cn-hangzhou
Language	string	No	The language. The definitions of the governance evaluation items are returned in this language. Valid values: en: English. zh: Chinese.	zh
LensCode	string	No
TopicCode	string	No		ResourceUtilization

Response elements

Element	Type	Description	Example
	object	The response.
EvaluationMetadata	array<object>	The metadata of the governance evaluation definitions.
	array<object>	The metadata of the governance evaluation definitions.
Metadata	array<object>	A list of metadata objects for a specific metadata type.
	array<object>	A list of metadata objects for a specific metadata type.
Category	string	The pillar to which the check item belongs.	Security
Description	string	The description of the check item.	主账号 AccessKey 等同于主账号权限，无法进行条件限制（如访问来源 IP、访问时间等），一旦泄漏风险极大。有存在的主账号 AccessKey，则视为不合规。
DisplayName	string	The display name.	主账号存在启用的 AccessKey
Id	string	The random ID of the metadata.	pxgtda****
RecommendationLevel	string	The recommended administration level for the check item.	High
RemediationMetadata	object	The remediation metadata.
Remediation	array<object>	The remediation item.
	array<object>	The remediation item.
Actions	array<object>	The remediation action.
	array<object>	The remediation action.
Classification	string	The category of the remediation method. Note This parameter is returned only when `RemediationType` is `Analysis`.	UnusedAccessKeyInRamUser
CostDescription	string	The cost of the remediation.	当前操作不产生费用
Description	string	The description of the remediation. Note This parameter is returned only when `RemediationType` is `Analysis`.	RAM 用户既启用控制台登录又保有子账号AK，且子账号AK从未使用。
Guidance	array<object>	The remediation content.
	object	The remediation content.
ButtonName	string	The display name of the button for the remediation step.	手动修复
ButtonRef	string	The URL to which the button for the remediation step redirects.	https://ram.console.alibabacloud.com/users
Content	string	The content of the remediation step.	需进行腾挪操作，步骤如下： 1. 进入 RAM 控制台，「身份管理」-「用户」，单击「创建用户」。 2. 填写「登录名称」，下方「访问方式」，勾选 OpenAPI 调用访问。 3. 创建成功后，保存该 RAM 用户的 AccessKey，勾选该 RAM 用户，单击「添加权限」，在弹出的侧边栏中，添加 AdministratorAccess权限。 4. 在程序中将主账号 AccessKey 替换为上步骤中创建的 RAM 用户 AccessKey，在相应的测试环境中验证程序逻辑是否正常。 5. 如果验证通过，将程序发布到生产环境，并将主账号 AccessKey 禁用，观察应用是否正常。 6. 如果应用正常，则等待一定时间（如 3 个月），将禁用的主账号 AccessKey 删除。
Title	string	The title of the remediation step.	情况三：针对「90天内使用中的 AccessKey」
Notice	string	Notes on remediation.	此治理项会在配置审计中开启AccessKey及权限治理最佳实践合规包，从AccessKey、阿里云账号、RAM用户的设置和使用方式等方面进行检测。
Suggestion	string	The suggested remediation. Note This parameter is returned only when `RemediationType` is `Analysis`.	该RAM用户既启用控制台登录又保有子账号AK，且子账号AccessKey从未使用过，因此建议禁用该AccessKey。禁用90天后，如果没有发生与该AcccessKey相关的问题，则可以直接删除该AccessKey。
RemediationType	string	The remediation type. Valid values: Manual: manual remediation. QuickFix: quick fix. Analysis: analysis-assisted decision.	Manual
ResourceMetadata	object	The resource metadata of the check item.
ResourcePropertyMetadata	array<object>	The resource property metadata.
	object	The resource property metadata.
DisplayName	string	The display name of the property.	AccessKey 最后使用时间
PropertyName	string	The name of the resource property.	AkLastUsedTime
PropertyType	string	The type of the resource property.	String
Scope	string	The scope of the check item. Valid values: Account: single-account check item. ResourceDirectory: multi-account check item.	Account
Stage	string	The stage of the check item. Valid values: Released: officially released. Beta: pre-release.	Released
TopicCode	string		ResourceUtilization
Type	string	The metadata type. Valid values: Metric: check item.	Metric
RequestId	string	The request ID.	16B208DD-86BD-5E7D-AC93-FFD44B6FBDF1

Examples

Success response

JSON format

{
  "EvaluationMetadata": [
    {
      "Metadata": [
        {
          "Category": "Security",
          "Description": "主账号 AccessKey 等同于主账号权限，无法进行条件限制（如访问来源 IP、访问时间等），一旦泄漏风险极大。有存在的主账号 AccessKey，则视为不合规。",
          "DisplayName": "主账号存在启用的 AccessKey",
          "Id": "pxgtda****",
          "RecommendationLevel": "High",
          "RemediationMetadata": {
            "Remediation": [
              {
                "Actions": [
                  {
                    "Classification": "UnusedAccessKeyInRamUser",
                    "CostDescription": "当前操作不产生费用",
                    "Description": "RAM 用户既启用控制台登录又保有子账号AK，且子账号AK从未使用。",
                    "Guidance": [
                      {
                        "ButtonName": "手动修复",
                        "ButtonRef": "https://ram.console.alibabacloud.com/users",
                        "Content": "需进行腾挪操作，步骤如下：1. 进入 RAM 控制台，「身份管理」-「用户」，单击「创建用户」。2. 填写「登录名称」，下方「访问方式」，勾选 OpenAPI 调用访问。3. 创建成功后，保存该 RAM 用户的 AccessKey，勾选该 RAM 用户，单击「添加权限」，在弹出的侧边栏中，添加 AdministratorAccess权限。4. 在程序中将主账号 AccessKey 替换为上步骤中创建的 RAM 用户 AccessKey，在相应的测试环境中验证程序逻辑是否正常。5. 如果验证通过，将程序发布到生产环境，并将主账号 AccessKey 禁用，观察应用是否正常。6. 如果应用正常，则等待一定时间（如 3 个月），将禁用的主账号 AccessKey 删除。",
                        "Title": "情况三：针对「90天内使用中的 AccessKey」"
                      }
                    ],
                    "Notice": "此治理项会在配置审计中开启AccessKey及权限治理最佳实践合规包，从AccessKey、阿里云账号、RAM用户的设置和使用方式等方面进行检测。",
                    "Suggestion": "该RAM用户既启用控制台登录又保有子账号AK，且子账号AccessKey从未使用过，因此建议禁用该AccessKey。禁用90天后，如果没有发生与该AcccessKey相关的问题，则可以直接删除该AccessKey。"
                  }
                ],
                "RemediationType": "Manual"
              }
            ]
          },
          "ResourceMetadata": {
            "ResourcePropertyMetadata": [
              {
                "DisplayName": "AccessKey 最后使用时间",
                "PropertyName": "AkLastUsedTime",
                "PropertyType": "String"
              }
            ]
          },
          "Scope": "Account",
          "Stage": "Released",
          "TopicCode": "ResourceUtilization"
        }
      ],
      "Type": "Metric"
    }
  ],
  "RequestId": "16B208DD-86BD-5E7D-AC93-FFD44B6FBDF1"
}

Error codes

HTTP status code	Error code	Error message	Description
500	InternalError	A system error occurred.	A system error occurred.
404	InvalidEnterpriseRealName.NotFound	The specified account has not passed enterprise real name verification. Please complete the verification for the account first.	The specified account has not passed enterprise real-name verification. Please complete the verification for the account first.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.