Proactive interception is a Cloud Config feature that prevents non-compliant operations. It checks resource configurations in real time before they are created or modified through services like Automation Service (IAC). The system blocks operations that violate preset rules, mitigating compliance risks early in the resource lifecycle. This topic explains the concepts and workflow of proactive interception and guides you through configuring and integrating it into your automated processes.
Limitations
-
Proactive interception currently supports only one integration channel: Automation Service (IAC).
-
Proactive interception supports only template rules, not custom rules.
Workflow
Proactive interception integrates Cloud Config rules with resource creation channels like Automation Service (IAC) to perform a pre-check on resource operations. This workflow separates the responsibilities of the compliance administrator and the resource operator.
-
Create rule: The compliance administrator creates a rule in the Cloud Config console, enables the proactive interception feature, and selects the desired Interception Channel, such as Automation Service (IAC).
-
Confirm success: Cloud Config confirms to the compliance administrator that the rule was created successfully.
-
Initiate request: The resource operator initiates a resource creation or modification request through an integrated channel, such as Automation Service (IAC).
-
Initiate pre-check: After receiving the request, Automation Service (IAC) sends a pre-check request to Cloud Config.
-
Validate rule: Cloud Config checks if the operation triggers any configured proactive interception rules and determines the compliance result.
-
Return result: Cloud Config returns the pre-check response, which indicates whether the resource configuration is compliant, to Automation Service (IAC).
-
The pre-check result determines the next steps:
Non-compliant
-
Return error: Automation Service (IAC) detects a non-compliant pre-check result, returns an error message to the resource operator, and blocks the resource creation or modification.
-
Correct and retry: The resource operator corrects the resource configuration based on the error message, which specifies the matched rule and the reason for non-compliance, and then resubmits the request (returns to step 3).
Compliant
-
Proceed with creation: Automation Service (IAC) detects a compliant pre-check result and proceeds to send the actual resource creation or modification request to the corresponding cloud service.
-
Return result: After the operation is complete, the cloud service returns the result to Automation Service (IAC).
-
-
Automation Service (IAC) reports the final operation result, including success or error details, to the resource operator.
Roles and responsibilities
|
Role |
Responsibility |
|
compliance administrator |
Creates or modifies rules and enables the proactive interception feature in the Cloud Config console. |
|
resource operator |
|
Procedure
Step 1: Enable proactive interception
A compliance administrator creates or modifies a rule and integrates it with an interception channel.
To avoid impacting your workloads, test this feature thoroughly in a non-production environment before enabling it.
Create a rule
-
Log on to the Cloud Config console. In the left-side navigation pane, choose .
-
On the rules list page, click Create Rule.
-
On the Create Rule page, keep the default Create from Template option selected. In the Supports Pre-check Interception filter box, select Supported to filter all rule templates that support proactive interception.
-
Select the rule template that you want to use, such as "ECS instances cannot be assigned a public IP address", and click Next.
-
In the Set Basic Properties step, find and turn on the Enable Pre-check Interception setting.
After you enable proactive interception, if a specified channel detects that a resource configuration is non-compliant, the operation is blocked, which may prevent resources from being created. Test this feature thoroughly before enabling it. For Enable Pre-check Interception, select Yes.
-
In the Enable Pre-check Interception Prompt dialog box, read the risk notice. After you confirm, click I acknowledge the risks and confirm to enable.
Risk notice: After you enable proactive interception, if a specified channel such as Automation Service (IAC) detects that a resource configuration is non-compliant, the operation is blocked. This may prevent the resource from being created. Note that indirect configuration methods, such as using an ECS instance launch template, will be detected as non-compliant and blocked because the complete resource configuration cannot be retrieved. Assess the impact carefully. Confirm that you fully understand the risks, have evaluated the impact on your existing business processes, and have communicated with relevant teams.
-
Select the interception channel that you want to integrate, such as Automation Service (IAC).
The system automatically creates the service-linked role
AliyunServiceRoleForIaCServiceConfigto access other cloud service resources. -
Follow the wizard to complete the remaining settings, and then click Submit.
Modify an existing rule
-
Log on to the Cloud Config console. In the left-side navigation pane, choose .
-
On the rules list page, click the Filter by Category drop-down menu and select Pre-check Interception. In the Supports Pre-check Interception filter box, select Supported to filter existing rules that support proactive interception.
-
Find the rule for which you want to enable proactive interception, and click Modify Rule in the Actions column.
-
On the Edit Rule page, in the Set Basic Properties step, find and turn on the Enable Pre-check Interception setting.
-
In the Enable Pre-check Interception Prompt dialog box, read the risk notice. After you confirm, click I acknowledge the risks and confirm to enable.
-
Select Automation Service (IAC) as the interception channel.
-
Follow the wizard to complete the remaining steps, and then click Submit.
Step 2: Perform a pre-check
The following example shows how a resource operator triggers a pre-check by using Automation Service (IAC).
-
Log on to Automation Service. In the left-side navigation pane, choose .
-
On the template list page, click Create Template. Create a Terraform template, then save, submit, and publish it.
-
Use the created template to create a new resource orchestration task.
-
Run the task manually or configure it to run automatically.
-
Automation Service (IAC) performs a pre-check before creating or modifying the resource and returns the result.
Non-compliant pre-check result
If the pre-check result is Non-compliant, the resource orchestration task details page shows the job status as Compliance Pre-check Failed.
Compliant pre-check result
If the pre-check result is Compliant, the resource orchestration task details page shows the job status as Compliance Pre-check Succeeded.
Step 3: Handle the pre-check result
Compliance Pre-check Failed
If the compliance pre-check fails, the resource creation or modification operation is blocked. The resource operator can troubleshoot and correct the issue as follows:
-
On the task details page, click View Details to see the job execution details.
-
On the job details page, in the Compliance Pre-check Failed area, click View Check Results to see the specific rule that caused the failure and the reason for non-compliance.
The dialog box displays a red alert: "Some resource configurations do not meet the rule requirements. You must fix all issues before you can continue with the resource orchestration task." The statistics indicate one non-compliant rule and 0 compliant rules. The table identifies the non-compliant rule: The security group description cannot be empty.
-
Modify the Terraform template to fix the non-compliant configuration and run the task again.
Compliance Pre-check Succeeded
After the pre-check passes, the system proceeds with the resource creation or modification operation:
-
Automatic execution: If the pre-check result is compliant, Automation Service (IAC) automatically continues the resource creation or modification operation.
-
Manual execution: On the job details page, click Confirm and Execute to start the resource creation or modification operation in Automation Service (IAC).
Step 4: Verify the result
If the resource creation or modification is successful, the status is displayed in the Execution Completed area of the job details page.
alicloud_security_group.default: Creating...
alicloud_security_group.default: Creation complete after 1s [id=xxx]
│ Warning: "inner_access": [DEPRECATED] Field `inner_access` has been deprecated from provider version 1.55.3. New field `inner_access_policy` instead.
│
│ with alicloud_security_group.default,
│ on main.tf line 10, in resource "alicloud_security_group" "default":
│ 10: resource "alicloud_security_group" "default" {
│ 11: }
│
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.