Cloud Config remediates non-compliant resource configurations to maintain continuous compliance. Enable remediation when you create a rule to automatically correct non-compliant resources upon detection.
Remediation methods
|
Method |
Description |
Limits |
Related service |
Reference |
|
Template remediation |
Uses Operation Orchestration Service (OOS) templates to remediate non-compliant resources. |
One remediation setting per rule. Only rules created from certain Rule templates support this method. |
OOS is automatically activated at no cost. Introduction to OOS |
|
|
Custom remediation |
Runs custom Function Compute code to remediate non-compliant resources. |
One remediation setting per rule. Both template-based and custom rules support this method. |
Function Compute requires manual activation and incurs fees. What is Function Compute? |
Manage the AliyunServiceRoleForConfigRemediation service-linked role
Cloud Config automatically creates the AliyunServiceRoleForConfigRemediation service-linked role the first time you use automatic remediation. Manage the AliyunServiceRoleForConfigRemediation service-linked role
Usage notes
Automatic remediation corrects non-compliant resource configurations based on the parameters you specify. Misconfigured remediation settings may cause business continuity issues. For example, enabling automatic remediation for the oss-bucket-public-write-prohibited rule automatically sets the Bucket ACL of each OSS bucket to Private. If your business requires public read/write permissions on OSS buckets, data reads and writes are affected.