All Products
Search
Document Center

Security Center:CreateOpaStrategyNew

Last Updated:Nov 13, 2024

Creates a rule to block at-risk images.

Debugging

You can run this interface directly in OpenAPI Explorer, saving you the trouble of calculating signatures. After running successfully, OpenAPI Explorer can automatically generate SDK code samples.

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition Key: the condition key that is defined by the cloud service.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
OperationAccess levelResource typeCondition keyAssociated operation
yundun-sas:CreateOpaStrategyNewcreate
  • All Resources
    *
    none
none

Request parameters

ParameterTypeRequiredDescriptionExample
StrategyIdlongNo

The rule ID.

Note You can call the ListOpaClusterStrategyNew operation to query the rule ID.
Note This parameter is invalid when you create a rule.
16
StrategyTemplateIdlongNo

The ID of the rule template.

Note You can call the GetOpaStrategyTemplateSummary operation to query the ID of the rule template.
109
ClusterIdstringNo

The cluster ID.

Note This parameter is deprecated.
cfa7e2fb8c221483ba59e098c34c6****
StrategyNamestringNo

The rule name.

default
DescriptionstringNo

The rule description.

default policy
ClusterNamestringNo

The cluster name.

Note This parameter is deprecated.
*
UnScanedImagebooleanNo

Specifies whether the rule supports unscanned images. Valid values:

  • true
  • false
true
MaliciousImagebooleanNo

Specifies whether the rule supports malicious Internet images. Valid values:

  • true
  • false
true
ImageNamearrayNo

The image names.

ImageNamestringNo

The image name.

Note You can call the GetOpaClusterImageList operation to query the image name.
testImage
LabelarrayNo

The container tags.

LabelstringNo

The container tag.

Note You can call the GetOpaClusterLabelList operation to query the container tag.
app.kubernetes.io/component:collector
RuleActionintegerNo

The action that is performed when the rule is hit. Valid values:

  • 1: trigger alerts
  • 2: block
  • 3: allow
1
WhiteListarrayNo

The whitelist.

WhiteListstringNo

The entry in the whitelist.

repo-06
AlarmDetailobjectNo

The risks that you want to detect by using the rule.

BaselineobjectNo

The baseline risks.

RiskLevelarrayNo

The risk levels.

RiskLevelstringNo

The risk level. Valid values:

  • high
  • medium
  • low
high
Itemarray<object>No

The baseline check items.

ItemobjectNo
IdstringNo

The ID of the baseline check item.

Note You can call the GetOpaClusterBaseLineList operation to query the ID.
hc.image.checklist.identify.hc_exploit_couchdb_linux.item
NamestringNo

The name of the baseline check item.

Note You can call the GetOpaClusterBaseLineList operation to query the name.
Unauthorized access to CouchDB configuration risk
VulobjectNo

The vulnerability risks.

RiskLevelarrayNo

The risk levels.

RiskLevelstringNo

The risk level. Valid values:

  • high
  • medium
  • low
high
Itemarray<object>No

The vulnerabilities.

ItemobjectNo
IdstringNo

The ID of the vulnerability.

Note You can call the DescribeVulListPage operation to query the ID.
CVE-2023-36034
NamestringNo

The name of the vulnerability.

Note You can call the DescribeVulListPage operation to query the name.
Microsoft Edge vul
RiskClassarray<object>No

Risk type of vulnerability.

ItemobjectNo
IdstringNo

The ID of the vulnerability types. Valid values:

  • cve: system vulnerability
  • app: application vulnerability
cve
NamestringNo

The name of the vulnerability. Valid values:

  • system vulnerability
  • application vulnerability
system vulnerability
MaliciousFileobjectNo

The malicious sample risks.

RiskLevelarrayNo

The risk levels.

RiskLevelstringNo

The risk level. Valid values:

  • high
  • medium
  • low
high
Itemarray<object>No

The malicious samples.

ItemobjectNo
IdstringNo

The ID of the malicious sample.

Note You can call the DescribeMatchedMaliciousNames operation to query the ID.
3685699
NamestringNo

The name of the malicious sample.

Note You can call the DescribeMatchedMaliciousNames operation to query the name.
abnormal binary file
SensitiveFileobjectNo

The configuration of sensitive file.

RiskLevelarrayNo

The risk levels.

RiskLevelstringNo

The risk level. Valid values:

  • high
  • medium
  • low
low
Itemarray<object>No

The configuration of sensitive file.

ItemobjectNo
IdstringNo

The ID of the sensitive files.

Note You can call the GetSensitiveDefineRuleConfig operation to query the ID of the malicious sample.
key
NamestringNo

The name of the sensitive files.

Note You can call the GetSensitiveDefineRuleConfig operation to query the ID of the malicious sample.
name
BuildRiskobjectNo

The configuration of image build risk.

RiskLevelarrayNo

The risk levels.

RiskLevelstringNo

The risk level. Valid values:

  • high
  • medium
  • low
low
Itemarray<object>No

The configuration of image build risk.

ItemobjectNo
IdstringNo

The ID of the image build risk.

Note You can call the ListImageBuildRiskItem operation to query the ID of the malicious sample.
key
NamestringNo

The name of the image build risk.

Note You can call the ListImageBuildRiskItem operation to query the ID of the malicious sample.
name
Scopesarray<object>No

The application scope of the rule.

ScopeobjectNo
ClusterIdstringNo

The ID of the cluster that is specified in the rule.

Note You can call the DescribeGroupedContainerInstances operation to query the cluster ID.
cc50d***015d2
AllNamespaceintegerNo

Specifies whether to include all namespaces. Valid values:

  • 1: includes all namespaces.
  • 0: does not include all namespaces.
1
NamespaceListarrayNo

The namespaces.

Note This parameter is valid only when the AllNamespace parameter is set to 0.
NamespaceListstringNo

The namespace.

Note You can call the GetOpaClusterNamespaceList operation to query the namespace.
namespace1
AckPolicyInstanceIdstringNo

The ID of the cluster node to which the rule is applied.

Note This parameter is not required when you create the instance.
ack-p-1

Response parameters

ParameterTypeDescriptionExample
object

BaseResult

Successboolean

Indicates whether the request was successful. Valid values:

  • true
  • false
true
Codestring

The status code returned. The status code 200 indicates that the request was successful. Other status codes indicate that the request failed. You can identify the cause of the failure based on the status code.

200
Messagestring

The returned message.

success
RequestIdstring

The request ID.

CD380235-A0B8-540D-A0D5-D62884469E3C
HttpStatusCodeinteger

The HTTP status code.

200
Dataarray

The IDs of the clusters that failed to be saved.

datastring

The ID of the cluster that failed to be saved.

['cb8cd***b07ee5']

Examples

Sample success responses

JSONformat

{
  "Success": true,
  "Code": "200",
  "Message": "success",
  "RequestId": "CD380235-A0B8-540D-A0D5-D62884469E3C",
  "HttpStatusCode": 200,
  "Data": [
    "['cb8cd***b07ee5']"
  ]
}

Error codes

HTTP status codeError codeError messageDescription
403NoPermissioncaller has no permissionYou are not authorized to do this operation.
500ServerErrorServerError-

For a list of error codes, visit the Service error codes.

Change history

Change timeSummary of changesOperation
2023-12-22The Error code has changedView Change Details