A compliance package is a collection of rules that Cloud Config customizes for specific compliance scenarios. When you create a compliance package, you can use default rules from a compliance package template, or select rules from rule templates and existing rules. After a compliance package is created, you can view the evaluation results by rule, resource, and member account (in multi-account mode only).
Background information
For information about the default compliance package templates provided by Cloud Config, see Overview.
The Rules list also displays rules created from a new compliance package. The total number of rules in the list cannot exceed 200.
After you create a compliance package, its rules run an initial evaluation by default. Subsequent evaluations are automatically triggered based on each rule's trigger mechanism, or you can run them manually. You can also modify, delete, enable, or disable these rules.
Procedure
This topic describes how to create a compliance package from the BestPracticesForECS compliance package template to check the compliance of ECS instances.
Log on to the Cloud Config console.
Optional. In the upper-left corner, select an account group.
This operation is required only if you are using a management account of a resource directory. Otherwise, you do not need to perform the operation.
In the left-side navigation pane, choose .
On the Compliance Package page, click Create Package in the upper-left corner.
On the Select Template (Optional) page, click the
icon in the upper-right corner of the BestPracticesForECS compliance package template, and then click Next.On the Set Basic Properties page, set a name for the compliance package, keep the default values for the other parameters, and then click Next.
On the Select rules page, all rules in the BestPracticesForECS compliance package template are selected by default. Click Next.
NoteIf you did not select a compliance package template in Step 5, follow these steps to select rules:
In the Add More Rules panel, select the target rules from the Rule Templates tab or the List of existing rules tab, and then click OK.
On the Select rules page, select the target rules and click Next.
On the Set Rule Parameters page, set the parameters for any rules that have them, and then click OK.
NoteTo learn how to set rule parameters, see the links in the Resource Type column of Supported resource types and relationships in Cloud Config.
View the compliance evaluation results of the compliance package.
On the Compliance Package page, click the target compliance package's ID, or click Details in the Actions column for the package.
On the Rule Result tab, you can view the number of non-compliant resources by rule. You can also perform the following operations on the rules in the compliance package:
Click Edit or Delete in the Actions column for a rule to modify or delete it from the current compliance package and the Rules list.
Click Remove in the Actions column for a rule to remove it from the current compliance package.
On the Resource Result tab, you can view a list of non-compliant resources. You can also perform the following operations:
Click a resource's ID or name to view its Details, Related Resources, Historical Configuration Changes, and Compliance Timeline. For more information, see View resource information, View related resource information, View the configuration change history of a resource, and View the compliance timeline of a resource.
Click Ignore Evaluation Result in the Actions column for a resource to ignore a rule's evaluation result for that resource. For more information, see Ignore evaluation results.
On the Member Result tab, you can view non-compliant member accounts.
A member account is considered non-compliant if it contains any non-compliant resources.
NoteThe Member Result tab appears only in multi-account mode.