API standard and pre-built SDKs in multi-language
The OpenAPI specification of this product (Config/2020-09-07) follows the RPC standard. Alibaba Cloud provides pre-built SDKs for popular programming languages to abstract low-level complexities such as request signing. This enables developers to call APIs using language-specific syntax without dealing with HTTP details directly.
Custom signature
If your specific needs, such as a customized signature, are not supported by the SDK, manually sign requests using the signature mechanism. Note that manual signing requires significant effort (usually about 5 business days). For support, join our DingTalk group (ID: 147535001692).
Before you begin
An Alibaba Cloud account has full administrative privileges. A compromised AccessKey pair exposes all associated resources to unauthorized access, posing a significant security risk. To call APIs securely, create a Resource Access Management (RAM) user with API access only, configure its AccessKey pairs, and implement the principle of least privilege (PoLP) through RAM policies. Use the Alibaba Cloud account only when its permissions are explicitly required for specific scenarios.
Account Groups
|
API |
Title |
Description |
| CreateAggregator | CreateAggregator | A management account or a delegated administrator account in a resource directory can create an account group to centrally manage resources, compliance packages, and rules across multiple member accounts. |
| UpdateAggregator | UpdateAggregator | The management account or a delegated administrator account of a resource directory can modify the name and description of an account group, and add or remove members. |
| GetAggregator | GetAggregator | Queries the name, creation time, members, and type of an account group. |
Resources
|
API |
Title |
Description |
| Single-account | Single-account | |
| ListDiscoveredResources | ListDiscoveredResources | Queries a list of resources that are aggregated across regions in the current Alibaba Cloud account. |
| GetDiscoveredResource | GetDiscoveredResource | Queries the details of a specific resource. |
| GetResourceConfigurationTimeline | GetResourceConfigurationTimeline | Queries the configuration history of a specified resource. Cloud Config records every configuration and relationship change for a resource in a configuration history. Recording starts after you enable the Cloud Config service. By default, the history is retained for 10 years. |
| GetResourceComplianceTimeline | GetResourceComplianceTimeline | Queries the compliance evaluation history of a specified resource. The history is a set of compliance evaluation records that contain the timestamp and details of each evaluation. |
| GenerateResourceInventory | GenerateResourceInventory | Generates a downloadable inventory of global resources. |
| GetResourceInventory | GetResourceInventory | Queries information about the most recently generated global resource inventory for the current account. |
| Multi-account | Multi-account | |
| ListAggregateDiscoveredResources | ListAggregateDiscoveredResources | Queries the resources in a specified account group. |
| GetAggregateDiscoveredResource | GetAggregateDiscoveredResource | Queries the details of a specific resource in an account group. |
| GetAggregateResourceConfigurationTimeline | GetAggregateResourceConfigurationTimeline | Queries the configuration history of a specific resource in a specified account group. After you enable Cloud Config, the service records all configuration and relationship changes for your resources and organizes them into a configuration history. This history is saved for 10 years by default. |
| GetAggregateResourceComplianceTimeline | GetAggregateResourceComplianceTimeline | Queries the compliance timeline of a specific resource in an account group. A compliance timeline is a set of compliance evaluation records for a resource. Each record includes the time and content of an evaluation. |
| ListAggregateResourcesByAdvancedSearch | ListAggregateResourcesByAdvancedSearch | You can use SQL Select statements to search for resources in a specific account group based on fields in the resource properties. |
| CreateAggregateAdvancedSearchFile | CreateAggregateAdvancedSearchFile | Creates a downloadable file of advanced search results for resources in an account group. |
| GetSupportedResourceRelationConfig | GetSupportedResourceRelationConfig | Queries the supported resource relations for a specified resource type. |
| ListSupportedProducts | ListSupportedProducts | Queries the cloud services and resource types that are supported by Cloud Config. |
Rules
|
API |
Title |
Description |
| Single-account | Single-account | |
| CreateConfigRule | CreateConfigRule | Creates a rule from a template or a custom rule using Function Compute to check resource compliance. After you create a rule, Cloud Config runs an initial evaluation and then automatically triggers subsequent evaluations based on the rule's trigger. You can also run evaluations manually. |
| UpdateConfigRule | UpdateConfigRule | Modifies the description, input parameters, and risk level of a rule. |
| ListConfigRules | ListConfigRules | Queries a list of rules. |
| GetConfigRule | GetConfigRule | Queries the details of a specified rule. |
| ListConfigRuleEvaluationResults | ListConfigRuleEvaluationResults | Queries the compliance evaluation results of a rule. |
| ListResourceEvaluationResults | ListResourceEvaluationResults | Queries the evaluation results for a resource based on a rule. |
| StartConfigRuleEvaluation | StartConfigRuleEvaluation | Re-evaluates a specific rule or all rules in a compliance package. |
| IgnoreEvaluationResults | IgnoreEvaluationResults | Ignores the evaluation results of a rule for specific resources. You can also set a time period to ignore the rule. When the ignore period expires, the system automatically resumes displaying the evaluation results of the rule for the resources. |
| GetConfigRuleSummaryByRiskLevel | GetConfigRuleSummaryByRiskLevel | Queries the compliance summary based on the risk level of a rule. |
| GetComplianceSummary | GetComplianceSummary | Queries the compliance summary for the current account. |
| Multi-account | Multi-account | |
| CreateAggregateConfigRule | CreateAggregateConfigRule | Creates a rule for a specified account group. You can create a rule from a template or create a custom rule using Function Compute. The rule checks your resources for compliance. After a rule is created, it automatically runs once. Cloud Config then runs evaluations based on the rule's trigger. You can also run evaluations manually. |
| UpdateAggregateConfigRule | UpdateAggregateConfigRule | Modifies the description, input parameters, and risk level of a rule in a specified account group. |
| ListAggregateConfigRules | ListAggregateConfigRules | Queries the rules in a specified account group. |
| GetAggregateConfigRule | GetAggregateConfigRule | Queries the details of a specific rule in a specified account group. |
| ListAggregateConfigRuleEvaluationResults | ListAggregateConfigRuleEvaluationResults | Queries the evaluation results of a rule for resources in a specified account group. |
| ListAggregateResourceEvaluationResults | ListAggregateResourceEvaluationResults | Queries the rule evaluation results for resources in a specified account group. |
| GetAggregateComplianceSummary | GetAggregateComplianceSummary | Queries the compliance summary for a specified account group. |
| ListManagedRules | ListManagedRules | Queries the rule templates that are supported by Cloud Config. |
| GetManagedRule | GetManagedRule | Queries the details of a specified rule template. |
| ListPreManagedRules | ListPreManagedRules | Queries the proactive rules supported by Cloud Config. |
| EvaluatePreConfigRules | EvaluatePreConfigRules | Executes evaluation rules to perform compliance pre-checks on resources. |
Compliance Package
|
API |
Title |
Description |
| Single-account | Single-account | |
| UpdateCompliancePack | UpdateCompliancePack | Updates the configuration of a specified compliance pack in the current account. |
| ListCompliancePacks | ListCompliancePacks | Lists the compliance packs for the current account. |
| GetCompliancePack | GetCompliancePack | Queries the details of a specific compliance package. |
| GetConfigRuleComplianceByPack | GetConfigRuleComplianceByPack | Queries the compliance statistics for rules in a specified compliance package. |
| GetResourceComplianceByPack | GetResourceComplianceByPack | Queries the compliance results for resources in a compliance package. |
| DetachConfigRuleToCompliancePack | DetachConfigRuleToCompliancePack | This operation detaches one or more rules from a compliance package. |
| Multi-account | Multi-account | |
| CreateAggregateCompliancePack | CreateAggregateCompliancePack | Creates a compliance pack for a specified account group. |
| UpdateAggregateCompliancePack | UpdateAggregateCompliancePack | Updates a compliance pack in a specified account group. |
| ListAggregateCompliancePacks | ListAggregateCompliancePacks | Queries the compliance packs in a specified account group. |
| GetAggregateCompliancePack | GetAggregateCompliancePack | Queries the details of a compliance pack in a specified account group. |
| GenerateAggregateCompliancePackReport | GenerateAggregateCompliancePackReport | Generates an assessment report for a specified compliance package in a specified account group. |
| GetAggregateResourceComplianceByPack | GetAggregateResourceComplianceByPack | Queries the compliance statistics for resources in a specified compliance package within a specified account group. |
| GetAggregateConfigRuleComplianceByPack | GetAggregateConfigRuleComplianceByPack | Queries the compliance results of rules in a specified compliance pack within a specified account group. |
| ListCompliancePackTemplates | ListCompliancePackTemplates | Queries the details of all compliance pack templates provided by CloudConfig. |
Remediation templates
|
API |
Title |
Description |
| Single-account | Single-account | |
| CreateRemediation | CreateRemediation | Creates a remediation for an existing rule. |
| UpdateRemediation | UpdateRemediation | Updates the specified remediation setting. |
| DeleteRemediations | DeleteRemediations | Deletes specified remediation settings. |
| Multi-account | Multi-account | |
| CreateAggregateRemediation | CreateAggregateRemediation | Creates a remediation for a rule in a specified account group. |
| UpdateAggregateRemediation | UpdateAggregateRemediation | Updates a specified rule remediation. |
| ListAggregateRemediations | ListAggregateRemediations | Queries the remediations in a specified account group. |
| DeleteAggregateRemediations | DeleteAggregateRemediations | Deletes the remediation settings for a rule in a specified account group. |
| GetRemediationTemplate | GetRemediationTemplate | Queries the details of an automatic remediation template. |
Deliveries
|
API |
Title |
Description |
| Single-account | Single-account | |
| CreateConfigDeliveryChannel | CreateConfigDeliveryChannel | Creates a delivery channel to deliver resource data to Simple Log Service (SLS), Object Storage Service (OSS), or Simple Message Queue (formerly MNS). |
| UpdateConfigDeliveryChannel | UpdateConfigDeliveryChannel | This operation modifies a delivery channel for the current account. |
| ListConfigDeliveryChannels | ListConfigDeliveryChannels | Returns a list of delivery channels. |
| GetConfigDeliveryChannel | GetConfigDeliveryChannel | Queries the details of a specified delivery channel. |
| Multi-account | Multi-account | |
| CreateAggregateConfigDeliveryChannel | CreateAggregateConfigDeliveryChannel | Creates a delivery channel for a specified account group to deliver resource data to Simple Log Service (SLS), Object Storage Service (OSS), or Simple Message Queue (formerly MNS). |
Tags
|
API |
Title |
Description |
| ListTagResources | ListTagResources | Queries the tags attached to resources in Cloud Config. |
| TagResources | TagResources | Attaches tags to CloudConfig rules, account groups, and compliance packages. |
| UntagResources | UntagResources | Detaches tags from resources in Cloud Config. |
Service integration
|
API |
Title |
Description |
| ListIntegratedService | ListIntegratedService | Queries the services integrated with CloudConfig and their statuses. |
Service settings
|
API |
Title |
Description |
| GetConfigurationRecorder | GetConfigurationRecorder | Queries the status of the Cloud Config service and the resource monitoring scope for the current account. |
Report Template
|
API |
Title |
Description |
| CreateReportTemplate | Create Report Template | Create a compliance report template for the current UID. |
| GetReportTemplate | Retrieve Compliance Report Template Details | Retrieve details of a compliance report template. |
| UpdateReportTemplate | Update Compliance Report template | Update Compliance Report template |
| ListReportTemplates | Batch retrieve compliance report template details | Queries the details of compliance report templates in batches. |
| DeleteReportTemplate | Delete a Compliance Report template | Deletes a compliance report template. |
| GenerateReportFromTemplate | Generate a report based on a report template | Generate a report ID from a report template. |
| GetReportFromTemplate | Obtain the latest report generated based on a report template. | Retrieves a report generated from a report template. |
| TriggerReportSend | Latest report on completed real-time Testing Notifications by template ID | Sends a real-time test notification. |
Others
|
API |
Title |
Description |
| DryRunConfigRule | DryRunConfigRule | This API performs a dry run on rules for proactive compliance pre-checks. |
| DescribeDiscoveredResourceBatch | DescribeDiscoveredResourceBatch | This operation retrieves the details of multiple resources in a batch. |
| DescribeIntegratedServiceStatus | DescribeIntegratedServiceStatus | Queries the authorization status of an integrated cloud service. |
| GetResourceConfigurationSample | GetResourceConfigurationSample | This operation obtains configuration samples for a specified resource type. |
| GetResourceTypeProperties | GetResourceTypeProperties | This operation retrieves the property descriptions for a specified resource type. |
| ListAggregateRecommendManagedRules | ListAggregateRecommendManagedRules | This operation retrieves the list of recommended managed rules for an account group. |
| ListConfigRuleOperators | ListConfigRuleOperators | Lists the operators available for Cloud Config rules. |
| ListRecommendManagedRules | ListRecommendManagedRules | This operation obtains a list of recommended managed rules. |
| StartConfigRuleEvaluationByResource | StartConfigRuleEvaluationByResource | Starts a re-evaluation of a single resource. |
| ActiveAggregateConfigRules | ActiveAggregateConfigRules | Enables one or more rules in an account group. After a rule is enabled, the rule continues to automatically evaluate resources based on the trigger mechanism. |
| ActiveConfigRules | ActiveConfigRules | Enables a rule in Cloud Config. After a rule is enabled, Cloud Config automatically evaluates the compliance of a resource based on the trigger mechanism of the rule. |
| AttachAggregateConfigRuleToCompliancePack | AttachAggregateConfigRuleToCompliancePack | Adds one or more rules in an account group to a compliance package. |
| AttachConfigRuleToCompliancePack | AttachConfigRuleToCompliancePack | Adds one or more rules to a compliance package. |
| CopyCompliancePacks | CopyCompliancePacks | Replicates compliance packages. |
| CopyConfigRules | CopyConfigRules | Replicates rules. |
| CreateAdvancedSearchFile | CreateAdvancedSearchFile | Creates a downloadable resource file for the current Alibaba Cloud account. |
| CreateCompliancePack | CreateCompliancePack | Creates a compliance package for the current account. |
| DeactiveAggregateConfigRules | DeactiveAggregateConfigRules | Disables one or more rules in an account group. After a rule is disabled, the resource in the rule is no longer evaluated. The compliance evaluation results before the rule is disabled are still displayed. |
| DeactiveConfigRules | DeactiveConfigRules | Disables a rule. After a rule is disabled, the resource in the rule is no longer evaluated. The compliance evaluation results before the rule is disabled are still displayed. |
| DeleteAggregateCompliancePacks | DeleteAggregateCompliancePacks | Deletes the compliance packages of an account group. |
| DeleteAggregateConfigDeliveryChannel | DeleteAggregateConfigDeliveryChannel | Deletes a delivery channel from an account group. |
| DeleteAggregateConfigRules | DeleteAggregateConfigRules | Deletes one or more rules from an account group. You can delete a rule in the Cloud Config console. After you delete the rule, the configurations of the rule are deleted. |
| DeleteAggregators | DeleteAggregators | The management account or delegated administrator account of a resource directory can delete an account group. |
| DeleteCompliancePacks | DeleteCompliancePacks | Deletes one or more compliance packages. |
| DeleteConfigDeliveryChannel | DeleteConfigDeliveryChannel | Deletes a delivery channel. |
| DeleteConfigRules | DeleteConfigRules | Deletes rules. |
| DescribeRemediation | DescribeRemediation | This topic provides an example on how to query the details of a remediation configuration whose ID is crr-f381cf0c1c2f004e\\*\\*\\*\\*. |
| DetachAggregateConfigRuleToCompliancePack | DetachAggregateConfigRuleToCompliancePack | Removes one or more rules in an account group from a compliance package. |
| GenerateAggregateConfigRulesReport | GenerateAggregateConfigRulesReport | Generates a compliance evaluation report for the rules in a specified account group. |
| GenerateAggregateResourceInventory | GenerateAggregateResourceInventory | Generates a downloadable inventory for global resources in an account group. |
| GenerateCompliancePackReport | GenerateCompliancePackReport | Generates a compliance evaluation report based on a compliance package. |
| GenerateConfigRulesReport | GenerateConfigRulesReport | Generates a compliance evaluation report for a rule. |
| GetAdvancedSearchFile | GetAdvancedSearchFile | Obtains the last resource advanced search file that is generated within the current account. You can call this operation to obtain the URL of the resource advanced search file. |
| GetAggregateAccountComplianceByPack | GetAggregateAccountComplianceByPack | Queries the compliance evaluation results of member accounts for which a compliance package takes effect in an account group. |
| GetAggregateAdvancedSearchFile | GetAggregateAdvancedSearchFile | Obtains the most recently generated resource advanced search file within a specific account group. |
| GetAggregateCompliancePackReport | GetAggregateCompliancePackReport | Queries the compliance evaluation report that is generated based on a compliance package of an account group. |
| GetAggregateConfigDeliveryChannel | GetAggregateConfigDeliveryChannel | Queries the information about a delivery channel in an account group. |
| GetAggregateConfigRuleSummaryByRiskLevel | GetAggregateConfigRuleSummaryByRiskLevel | Queries the summary of compliance evaluation results by rule risk level in an account group. |
| GetAggregateConfigRulesReport | GetAggregateConfigRulesReport | Downloads the compliance evaluation report in the Excel format to your on-premises machine. This allows you to assign tasks and modify incompliant resource configurations. |
| GetAggregateResourceComplianceByConfigRule | GetAggregateResourceComplianceByConfigRule | Queries compliance evaluation results based on the rules in a compliance package in an account group. |
| GetAggregateResourceComplianceGroupByRegion | GetAggregateResourceComplianceGroupByRegion | Queries the evaluation results grouped by resource type for an account group rule. |
| GetAggregateResourceComplianceGroupByResourceType | GetAggregateResourceComplianceGroupByResourceType | Queries the evaluation results grouped by resource type for an account group rule. |
| GetAggregateResourceCountsGroupByRegion | GetAggregateResourceCountsGroupByRegion | Queries the statistics on the resources in an account group by region. |
| GetAggregateResourceCountsGroupByResourceType | GetAggregateResourceCountsGroupByResourceType | Queries the statistics on the resources in an account group by resource type. |
| GetAggregateResourceInventory | GetAggregateResourceInventory | Obtains the last resource inventory that is generated on the Global Resources page within the current account group. |
| GetCompliancePackReport | GetCompliancePackReport | Queries the compliance evaluation report that is generated based on a compliance package. |
| GetConfigRulesReport | GetConfigRulesReport | Downloads the compliance evaluation report in the Excel format to your on-premises machine. This allows you to assign tasks and modify incompliant resource configurations. |
| GetDiscoveredResourceCountsGroupByRegion | GetDiscoveredResourceCountsGroupByRegion | Queries the statistics on resources by region. |
| GetDiscoveredResourceCountsGroupByResourceType | GetDiscoveredResourceCountsGroupByResourceType | Queries the statistics on resources by resource type. |
| GetIntegratedServiceStatus | GetIntegratedServiceStatus | Queries the integration status of a specific cloud service. |
| GetResourceComplianceByConfigRule | GetResourceComplianceByConfigRule | Queries the compliance summary based on the compliance evaluation result of a rule. |
| GetResourceComplianceGroupByRegion | GetResourceComplianceGroupByRegion | Queries compliance evaluation results of resources based on a rule and displays the evaluation results grouped by region. |
| GetResourceComplianceGroupByResourceType | GetResourceComplianceGroupByResourceType | Queries compliance evaluation results of resources based on a rule and displays the evaluation results grouped by resource type. |
| IgnoreAggregateEvaluationResults | IgnoreAggregateEvaluationResults | Ignores the evaluation results of some resources in an account group based on a specific rule. You can also specify a time period for ignoring the evaluation results. After the period elapses, the evaluation results of the resources based on the rule are automatically displayed. |
| ListAggregateConfigDeliveryChannels | ListAggregateConfigDeliveryChannels | Queries the information about all delivery channels in an account group. |
| ListAggregateConfigRuleEvaluationStatistics | ListAggregateConfigRuleEvaluationStatistics | Queries the statistics of compliance evaluation results of an account group. |
| ListAggregateRemediationExecutions | ListAggregateRemediationExecutions | Queries the remediation records of a rule in an account group. |
| ListAggregateResourceRelations | ListAggregateResourceRelations | Queries a list of the resources of a specific resource in an account group. |
| ListAggregators | ListAggregators | Queries all account groups within the current management account or delegated administrator account. |
| ListConfigRuleEvaluationStatistics | ListConfigRuleEvaluationStatistics | Queries the statistics of compliance evaluation results of the current Alibaba Cloud account. |
| ListRemediationExecutions | ListRemediationExecutions | Queries the remediation records of a rule. |
| ListRemediationTemplates | ListRemediationTemplates | Queries a list of remediation templates for a managed rule. |
| ListRemediations | ListRemediations | Queries the information about the execution of remediation templates. |
| ListResourceRelations | ListResourceRelations | Queries a list of resources that associate with a specific resource. |
| ListResourcesByAdvancedSearch | ListResourcesByAdvancedSearch | Obtains resources based on the fields in the resource properties by using a SELECT statement. |
| PutEvaluations | PutEvaluations | Submits the evaluation results of a rule from Function Compute. |
| RevertAggregateEvaluationResults | RevertAggregateEvaluationResults | Re-evaluates resources that are evaluated based on a rule after the evaluation results on some resources of an ignored rule in an account group are resumed. |
| RevertEvaluationResults | RevertEvaluationResults | Re-evaluates resources that are evaluated based on a rule after the evaluation results on some resources of an ignored rule are resumed. |
| StartAggregateConfigRuleEvaluation | StartAggregateConfigRuleEvaluation | Re-evaluates the compliance of resources based on a rule or based on all rules in a compliance package in a specific account group. |
| StartAggregateRemediation | StartAggregateRemediation | Performs a remediation operation by using a rule in an account group. |
| StartConfigurationRecorder | StartConfigurationRecorder | Enables Cloud Config to monitor the resources of your Alibaba Cloud account. |
| StartRemediation | StartRemediation | Performs a remediation operation based on a rule. |
| StopConfigurationRecorder | StopConfigurationRecorder | Deactivates Cloud Config. |
| UpdateAggregateConfigDeliveryChannel | UpdateAggregateConfigDeliveryChannel | Modifies a delivery channel in an account group. |
| UpdateConfigurationRecorder | UpdateConfigurationRecorder | Modifies the resource monitoring scope of the current account. |
| UpdateIntegratedServiceStatus | UpdateIntegratedServiceStatus | Enables or disables the integration of a cloud service. |