CLI integration example-Cloud Config(CloudConfig)-阿里云帮助中心

Background

If you are not familiar with Alibaba Cloud CLI, see What is Alibaba Cloud CLI? before you begin.

Prerequisites

You have an Alibaba Cloud account. If you do not have one, visit the Alibaba Cloud official website to create one. We recommend that you use a RAM user for API calls instead of your root account. For more information, see Create a RAM user.
Config is enabled. This service lets you get a cross-region inventory of your resources and perform compliance audits. For instructions, see Enable Config.

Install the Alibaba Cloud CLI

You must install the Alibaba Cloud CLI before using it. Installation packages are available for Windows, Linux, and macOS. Choose the appropriate installation method for your operating system.

Windows: Install the CLI on Windows.
Linux: Install or update the Alibaba Cloud CLI.
macOS: Install the CLI on macOS.

Alternatively, you can use Alibaba Cloud's Cloud Shell to debug Alibaba Cloud CLI commands. For more information about Cloud Shell, see What is Cloud Shell?.

Configure the Alibaba Cloud CLI

Important

Your root account has full API permissions, posing a high security risk. We strongly recommend that you create and use a RAM user for API access and daily operations. The RAM user must be granted the AliyunConfigFullAccess permission to manage CloudConfig.

Before using the Alibaba Cloud CLI, configure your credentials and a region ID. The Alibaba Cloud CLI supports various types of credentials. For details, see Configure and manage credentials. This topic uses AccessKey-based credentials as an example. Follow these steps:

Create a RAM user and grant it the required permissions to manage the product. For more information, see Create a RAM user and Manage RAM user permissions.
After you create and authorize the RAM user, create an AccessKey for the user. Record the AccessKey ID and AccessKey Secret to use when you configure your credentials. For more information, see Create an AccessKey.
Configure a region ID. The Alibaba Cloud CLI uses the specified region to initiate API calls. For a list of available regions, see Endpoints.

Note
When using the Alibaba Cloud CLI, you can use the --region option to specify a region for a command. This option overrides the default region configured in your credentials and environment variables. For more information, see Command-line options.
Use the RAM user's AccessKey to configure the credentials and name the configuration profile AkProfile. For more information, see Configure and manage credentials.

CLI command example

Go to the Config API reference.
In API Explorer, you can search for the API that you want to use in the search box on the left. In the Parameter Configuration section, fill in the parameters based on the API documentation and click the CLI Example tab to the right of Parameter Configuration to generate a command example that includes the parameters.
- Click the Run Command button to open Cloud Shell and debug the command.
- Click the Copy button to copy the CLI example to your clipboard. You can then paste it into your local shell to run it.
  - When you copy the CLI example to a local shell tool for debugging, pay attention to the parameter format. For more information about the parameter format for Alibaba Cloud CLI commands, see Parameter format.
  - The example generated by the OpenAPI portal includes the --region option by default. When you copy this command to run it locally, the Alibaba Cloud CLI ignores the default region in your credentials and environment variables, and uses the specified region instead. You can delete or keep this option as needed.

Call an API

Command structure

The general command-line structure of Alibaba Cloud CLI is as follows. For more information, see Generate and call a command.

aliyun <command> <subcommand> [options and parameters]

Command-line options

In the Alibaba Cloud CLI, command-line options let you modify a command's default behavior or add functionality. Common command-line options are as follows:

--profile <profileName>: When you use the --profile option and specify a valid profile name, profileName, the Alibaba Cloud CLI ignores the default credentials and environment variables and uses the specified profile to make the command call.
--help: To get help for a command, add the --help option. For more details, see Get help information.

For more information, see Command-line options.

Example

Note

The Config API version integrated with the Alibaba Cloud CLI is outdated. We recommend that you call the 2020-09-07 version of the API. To call this API version, you must use the --force and --version options. For usage instructions, see Force an API call.
The OpenAPI portal automatically adds these options when generating command examples for the 2020-09-07 API version. You do not need to add them manually.
For more information about available APIs, see API overview.

The following example demonstrates how to use the Alibaba Cloud CLI to call the ListDiscoveredResources operation of CloudConfig to query resources in the current account.

Run the command.

aliyun config ListDiscoveredResources
  --ResourceTypes "ACS::CloudSSO::User"
  --Regions "cn-shanghai"
  --MaxResults 10
  --version 2020-09-07
  --force

The command returns the following output.

{
    "DiscoveredResourceProfiles": {
        "TotalCount": 1,
        "NextToken": "0uo*****************",
        "MaxResults": 10,
        "DiscoveredResourceProfileList": [
            {
                "ResourceCreationTime": 1720**********,
                "AccountId": 1512************,
                "ResourceId": "d-00*******************",
                "Version": 1720**********,
                "ResourceName": "",
                "Region": "cn-shanghai",
                "ResourceStatus": "Enabled",
                "AvailabilityZone": "",
                "ResourceType": "ACS::CloudSSO::User",
                "Tags": "{}",
                "ResourceDeleted": 1
            }
        ]
    },
    "RequestId": "E992A55B-7BA2-5220-BAAE-8ABD35966932"
}

Note

If a CloudConfig API call returns an error, use the error code to verify that the request parameters and their values are correct.

You can also record the RequestID or SDK error message from the response and use the Alibaba Cloud OpenAPI Diagnostic Platform for self-service diagnosis.