Terms

Term

Description

Resource type

A classification for resources. For example, the resource type of ECS instances is ECS Instance. Resources include:

• Entity resources, such as compute instances and storage instances.

• Application-level management resources, such as workgroups and workflows.

• Permission-related management resources, such as roles and policies.

Resource configuration details

Cloud Config retrieves all resources under your Alibaba Cloud account through the resource query APIs of each service. You can view resource configurations in the resource list or manage resources in the corresponding service console.

Monitoring scope

The monitoring scope defines which resource types Cloud Config tracks. Monitoring operates at the resource type level.

• When a resource type is in scope, Cloud Config tracks all resources of that type under your account and records configuration changes every 10 minutes.

• When a resource type is removed from scope, Cloud Config stops recording configuration changes for resources of that type.

Rule

A rule determines whether a resource configuration is compliant. Cloud Config hosts rule code as Function Compute functions. When a rule is attached to a resource type, configuration changes to resources of that type automatically trigger an evaluation. Rules can also run on a periodic schedule. Cloud Config supports the following rule types:

• Rule template

  Available templates are listed in List of rule templates.

• Custom rule

  Create a function in the Function Compute console, then select the function ARN in Cloud Config. Definition and working principle of custom function rules.

Configuration history

Cloud Config provides a configuration history for each monitored resource.

• For resources that already exist when you enable Cloud Config, the configuration history starts from the time you enable the service.

• For resources created after you enable Cloud Config, the history starts from the time each resource is created. Cloud Config records changes every 10 minutes. Each configuration change creates a node in the history that shows the resource configuration, change details, and related management events.

Compliance history

Rule evaluations are triggered when resource configurations change. Each resource's configuration history has a corresponding compliance history that records evaluation results. The records depend on the rule's trigger method.

• Periodic trigger: the history includes only periodic evaluation records.

• Configuration change trigger: the history includes only change-triggered evaluation records.

• Both triggers: the history includes records from both methods.

Classified protection precheck

The MLPS 2.0 precheck is a cloud-based compliance check that dynamically and continuously checks your Alibaba Cloud resources for compliance, helping you avoid repeated rectifications and pass the official assessment faster.

CIS

CIS (Center for Internet Security) is a community of organizations and individuals that want actionable security resources. The CIS Controls list the top 20 objectives enterprises must meet for basic network security.

Resource directory

Resource Directory is an Alibaba Cloud service that helps enterprise customers manage multi-level relationships between resources and accounts.

Management account

An Alibaba Cloud account that has passed enterprise verification and enabled a resource directory. The management account is the super administrator with full permissions over the resource directory, all folders, and all members. Each resource directory has exactly one management account.

Member

An account within a resource directory. Members are either resource accounts (created in the directory to isolate project or application resources) or cloud accounts (existing Alibaba Cloud accounts invited to join).

• Resource account

  Created within a resource directory. Root users are disabled for resource accounts, providing higher security. For more information about how to create a resource account, see Create a member.

• Cloud account

  An existing Alibaba Cloud account invited to join a resource directory. Cloud accounts retain their root users. For more information about how to invite an Alibaba Cloud account to join a resource directory, see Invite an account to a resource directory.

Account group

A collection of members in a resource directory. The management account adds all or some members to an account group for centralized compliance management. The group also serves as a resource pool that aggregates resources from its members.

The management account can view resource lists, details, configuration histories, compliance histories, and linked instances of all members. It can also create rules and compliance packages that apply to all member resources for continuous compliance evaluation.