Template update records

Adjusted managed rule

adb-cluster-multi-zone

Cloud Config evaluation is now based on resource configuration properties. Configuration change triggering is added, and periodic execution every 24 hours is retained.

Adjusted managed rule

cdn-domain-tls13-enabled

Evaluation is now based on resource configuration properties.

Adjusted managed rule

eci-container-group-volumn-mounts

Evaluation is now based on resource configuration properties. Configuration change triggering is added, and periodic execution every 24 hours is retained.

Adjusted managed rule

hbase-public-access-check

Evaluation is now based on resource configuration properties. Configuration change triggering is added, and periodic execution every 24 hours is retained. Public network access evaluation now also recognizes endpoints whose network type is PUBLIC.

Adjusted managed rule

mongodb-instance-multi-zone

Evaluation is now based on resource configuration properties. Configuration change triggering is added, and periodic execution every 24 hours is retained.

Adjusted managed rule

mongodb-public-and-any-ip-access-check

Evaluation is now based on resource configuration properties. Configuration change triggering is added, and periodic execution every 24 hours is retained. The incorrect product name in the English description is corrected from Redis to MongoDB.

Adjusted managed rule

sls-logstore-enabled-encrypt

Evaluation is now based on resource configuration properties.

Adjusted managed rule

vpn-ipsec-connection-encrypt-enable

Evaluation is now based on resource configuration properties. Configuration change triggering is added, and periodic execution every 24 hours is retained. Dual-tunnel VPN connections are now supported. Encryption is considered enabled if an authentication algorithm exists in any IKE configuration at the connection or tunnel level.

New managed rule

ram-role-no-specified-policy-name

A RAM role is considered compliant if no access policy whose name is specified by the parameter is attached to the role. It is considered non-compliant if any such policy is attached. The default parameter value, AliyunSTSAssumeRoleAccess, is a system policy that allows assuming RAM roles. If the list of attached access policies cannot be obtained, the role is considered compliant.

New managed rule

ram-role-trust-policy-no-specified-principal

A RAM role is considered compliant if the Principal in its trust policy statements with Effect set to Allow does not contain any principal keyword specified by the parameter. Otherwise, the role is considered non-compliant. Statements with Effect set to Deny are excluded from evaluation. Including a specified principal in a Deny statement is a reasonable way to restrict access. The default parameter value, :root, represents an entire Alibaba Cloud account as the trusted principal, for example, acs:ram::1234567890123456:root. This configuration may allow all RAM identities in that account to assume the role. If the trust policy contains no Principal with Effect set to Allow, the role is considered compliant. If the trust policy cannot be parsed, the evaluation result is insufficient data.

New managed rule

ram-user-no-specified-policy-name

A Resource Access Management (RAM) user is considered compliant if no access policy whose name is specified by the parameter is attached to the user. The user is considered non-compliant if any such policy is attached. Evaluation covers both permissions attached directly to the user and permissions inherited from user groups to which the user belongs. The default parameter value, AliyunSTSAssumeRoleAccess, is a system policy that allows assuming RAM roles. If the list of attached access policies cannot be obtained, the user is considered compliant.

Adjusted managed rule

alb-server-group-multi-server

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

api-gateway-group-bind-domain

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

api-group-custom-trace-enabled

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

apigateway-instance-multi-zone

Configuration change triggering is added, and periodic execution every 24 hours is retained.

Adjusted managed rule

cloudsso-directory-saml-expired-check

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering. The validity of the second SAML signing certificate is now checked. If no second certificate exists, the evaluation result is unaffected. The method used to determine whether SSO is enabled is corrected.

Adjusted managed rule

csg-gateway-multi-zone

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

dcdn-domain-multiple-origin-servers

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

elasticsearch-instance-enabled-data-node-encryption

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

elasticsearch-instance-enabled-warm-node-disk-encryption

Evaluation is now based on resource configuration properties. The trigger is changed to configuration change triggering only, and periodic execution every 24 hours is removed. Warm nodes are now considered configured if the warm node count is greater than 0. Instances without warm nodes are evaluated as not applicable.

Adjusted managed rule

fc-service-bind-role

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

kafka-instance-public-access-check

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

nas-access-group-public-access-check

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

ots-instance-multi-zone

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

ram-user-ak-create-date-expired-check

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

ram-user-last-login-expired-check

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

ram-user-login-check-v2

Evaluation is now based on resource configuration properties. The trigger is changed to configuration change triggering only, and periodic execution every 24 hours is removed.

Adjusted managed rule

ram-user-never-login-check

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

rds-multi-az-support

Evaluation is now based on resource configuration properties. The trigger is changed to configuration change triggering only, and periodic execution every 24 hours is removed.

Adjusted managed rule

redis-instance-no-public-ip

Evaluation is now based on resource configuration properties. The trigger is changed from periodic execution every 24 hours to configuration change triggering.

Adjusted managed rule

redis-public-and-any-ip-access-check

Evaluation is now based on resource configuration properties. The trigger is changed to configuration change triggering only, and periodic execution every 24 hours is removed.

Adjusted managed rule

slb-instance-expired-check

Evaluation is now based on resource configuration properties. The trigger is changed to configuration change triggering only, and periodic execution every 24 hours is removed.

Adjusted managed rule

sls-logstore-hot-ttl-check

The applicability condition, a data retention period longer than 7 days, is now evaluated based on resource configuration properties.

Adjusted managed rule

ack-cluster-inspect-apiserver-clb-backend-abnormal-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-apiserver-clb-instance-not-exist-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-apiserver-clb-instance-status-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-apiserver-clb-listener-abnormal-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-apiservice-not-available-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-autoscaler-abnormal-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-core-dns-no-endpoint-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-coredns-has-only-one-replica-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-error-items-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-kubelet-version-outdate-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-loadbalancer-service-cert-id-mismatched-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-loadbalancer-service-instance-charge-type-mismatched-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-node-pool-scaling-config-unavailable-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-node-pool-security-group-unavailable-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-node-pool-vswitch-unavailable-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-nodepool-scaling-group-unavailable-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-inspect-some-coredns-pods-not-ready-check

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-node-monitorenabled

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-running-cluster-node-monitorenabled

Add a cluster running-state filter. Clusters in non-running states, including stopped, unavailable, deleted, and creation failed, are evaluated as not applicable to prevent false positives.

Adjusted managed rule

ack-cluster-public-endpoint-check

Correct the field path used to retrieve the access control list (ACL) of a load balancing listener to make public ACL evaluation more accurate.

Adjusted managed rule

alb-listener-https-redirect-enabled

Set Scenarios to all (ALL), and add and enable IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

oss-bucket-anonymous-prohibited

Set Scenarios to all (ALL), and add and enable IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

oss-bucket-authorize-specified-ip

Set Scenarios to all (ALL), add and enable IAC pre-deployment check (Terraform) evaluation, and update the rule help topic link.

Adjusted managed rule

oss-bucket-public-access-prohibited

Correct the field value path used by the IAC pre-deployment check (Terraform template).

Adjusted managed rule

oss-bucket-public-read-prohibited

Add IAC pre-deployment check (Terraform template) evaluation logic.

Adjusted managed rule

oss-bucket-public-write-prohibited

Add IAC pre-deployment check (Terraform template) evaluation logic.

Adjusted managed rule

polardb-cluster-enabled-ssl

Add IAC pre-deployment check (Terraform template) evaluation logic.

Adjusted managed rule

rds-instance-enabled-log-backup

Set Scenarios to all (ALL), and add and enable IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

slb-all-listenter-tls-policy-check

Set Scenarios to all (ALL), and add and enable IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

slb-listener-risk-ports-check

Add IAC pre-deployment check (Terraform) evaluation logic and update the rule help topic link.

New managed rule

amqp-instance-auth-model-ram

An ApsaraMQ for RabbitMQ instance is considered compliant if it has no static username-password accounts and is accessed only by using RAM identity authentication. The instance is considered non-compliant if any static account exists.

New managed rule

amqp-instance-kms-encryption

An ApsaraMQ for RabbitMQ instance is considered compliant if data storage encryption is enabled. This rule applies only to Professional Edition (VIP) and Serverless Professional Edition instances. Other instance types are evaluated as not applicable. The instance is considered non-compliant if the encryption status cannot be obtained.

New managed rule

amqp-instance-ssl-only

An ApsaraMQ for RabbitMQ instance is considered compliant if its listening mode is set to Secure Sockets Layer (SSL) encryption only (ssl_only) and only the encrypted port 5671 is enabled. The instance is considered non-compliant if the listening mode cannot be obtained.

New managed rule

dts-migration-job-separate-database-accounts

A DTS migration task is considered compliant if its source and destination databases use different accounts. The task is considered non-compliant if the source and destination databases share the same account, because this expands the impact of credential disclosure. Instances whose task type is not migration or whose task information is unavailable are evaluated as not applicable.

New managed rule

dts-sync-job-separate-database-accounts

A DTS synchronization task is considered compliant if its source and destination databases use different accounts. The task is considered non-compliant if the source and destination databases share the same account, because this expands the impact of credential disclosure. Instances whose task type is not synchronization or whose task information is unavailable are evaluated as not applicable.

Adjusted managed rule

dts-instance-migration-job-ssl-enabled

Preconfigure the IAC pre-deployment check (Terraform) evaluation structure. Enablement is deferred: the applicable scenario remains at its default setting, and Terraform mapping is pending support.

Adjusted managed rule

dts-instance-subscribe-job-ssl-enabled

Preconfigure the IAC pre-deployment check (Terraform) evaluation structure. Enablement is deferred: the applicable scenario remains at its default setting, and Terraform mapping is pending support.

Adjusted managed rule

dts-instance-sync-job-ssl-enabled

Preconfigure the IAC pre-deployment check (Terraform) evaluation structure. Enablement is deferred: the applicable scenario remains at its default setting, and Terraform mapping is pending support.

Adjusted managed rule

rds-instance-enabled-disk-encryption

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

New managed rule

cdn-domain-tls-version-enabled

Check whether the HTTPS TLS version configuration of a CDN domain is an exact match for the specified versions. The domain is considered compliant if all specified versions are enabled (on) and all unspecified versions are disabled. TLS1.3 is checked by default. Multiple versions can be checked by using comma-separated values, such as tls12,tls13.

New managed rule

account-ak-network-restriction-check

An account-level network access restriction policy is considered compliant if it is enabled (Status=Active) and contains no rule that allows all public network access (0.0.0.0/0 or ::/0). The policy is considered non-compliant if it is not enabled (Status is not Active) or if its IPList contains 0.0.0.0/0 or ::/0.

New managed rule

ram-user-ak-network-restriction-check

A Resource Access Management (RAM) user is considered compliant if all its AccessKeys, including disabled AccessKeys, have network access restriction policies enabled and none of the policies contains a rule that allows all public network access (0.0.0.0/0 or ::/0). The user is considered non-compliant if the effective policy of any AccessKey is not enabled or contains 0.0.0.0/0 or ::/0. The AccessKey-level policy takes precedence; if it is not configured, the account-level policy is inherited. A user without an AccessKey is evaluated as not applicable.

Adjusted managed rule

ack-cluster-network-type-check

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

alb-instance-multi-zone

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

api-gateway-api-internet-request-https

Correct the rule's internal evaluation identifier to ensure that non-compliant results are returned correctly.

Adjusted managed rule

oss-bucket-logging-enabled

Add IAC pre-deployment check (Terraform) evaluation logic.

Adjusted managed rule

oss-bucket-only-https-enabled

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

oss-bucket-policy-no-any-anonymous

Add IAC pre-deployment check (Terraform) evaluation logic.

Adjusted managed rule

oss-bucket-server-side-encryption-enabled

Add IAC pre-deployment check (Terraform) evaluation logic.

Adjusted managed rule

oss-bucket-versioning-enabled

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

oss-zrs-enabled

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

polardb-public-and-any-ip-access-check

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

rds-instance-enabled-byok-tde

Set Scenarios to all (ALL), add IAC pre-deployment check (Terraform) evaluation, and support lowercase field names.

Adjusted managed rule

rds-instance-enabled-ssl

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

rds-instance-enabled-tde

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

rds-instance-has-security-group

Correct the rule's internal evaluation identifier to ensure that non-compliant results are returned correctly.

Adjusted managed rule

rds-instances-in-vpc

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

rds-multi-az-support

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

rds-postgresql-parameter-log-connections

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

rds-postgresql-parameter-log-disconnections

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

rds-postgresql-parameter-log-duration

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

rds-public-connection-and-any-ip-access-check

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

redis-instance-multi-zone

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

redis-instance-open-auth-mode

Set Scenarios to all (ALL), and add and improve IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

redis-public-and-any-ip-access-check

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

slb-acl-public-access-check

Add IAC pre-deployment check (Terraform) evaluation logic.

Adjusted managed rule

slb-loadbalancer-in-vpc

Add IAC pre-deployment check (Terraform) evaluation logic.

Adjusted managed rule

sls-logstore-enabled-encrypt

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

Adjusted managed rule

sls-logstore-hot-ttl-check

Set Scenarios to all (ALL), and add IAC pre-deployment check (Terraform) evaluation.

New managed rule

apig-domain-ai-tls-cipher-suite-secure

An AI gateway domain is considered compliant if it is configured with the TLS encryption algorithm suite for data in transit specified by the parameter. Domains that are not AI gateway domains are evaluated as not applicable.

New managed rule

apig-domain-api-force-https-enabled

An API gateway domain is considered compliant if HTTPS force redirect is enabled (ForceHttps equals true). The domain is considered non-compliant if HTTPS force redirect is not enabled. AI gateway domains are evaluated as not applicable.

New managed rule

apig-domain-api-https-enabled

An API gateway domain is considered compliant if the HTTPS protocol is configured (Protocol equals HTTPS). The domain is considered non-compliant if HTTPS is not configured, because data in transit is not encrypted. AI gateway domains are evaluated as not applicable.

New managed rule

apig-domain-api-tls-cipher-suite-secure

An API gateway domain is considered compliant if it is configured with the TLS encryption algorithm suite for data in transit specified by the parameter. Domains that are not API gateway domains are evaluated as not applicable.

New managed rule

apig-gateway-api-custom-domain-enabled

An API gateway instance is considered compliant if at least one custom domain name is associated with it. The instance is considered non-compliant if no custom domain name is associated. Instances that are not API gateway instances are evaluated as not applicable.

New managed rule

apig-gateway-api-global-auth-enabled

An API gateway instance is considered compliant if a global authentication and authorization policy is configured, including a policy of type ExternalZAuth, OIDCAuth, or JWTAuth. The instance is considered non-compliant if no global authentication and authorization policy is configured. Instances that are not API gateway instances are evaluated as not applicable.

New managed rule

apig-gateway-api-ip-acl-not-allow-all

An API gateway instance is considered compliant if an IP access control policy is configured and the policy does not contain 0.0.0.0/0. The instance is considered non-compliant if no IP access control policy is configured or the policy contains 0.0.0.0/0. Instances that are not API gateway instances are evaluated as not applicable.

New managed rule

apig-gateway-api-jwt-auth-enabled

An API gateway instance is considered compliant if a global authentication and authorization policy of type JWTAuth is configured. The instance is considered non-compliant if no policy of type JWTAuth is configured. Instances that are not API gateway instances are evaluated as not applicable.

New managed rule

apig-gateway-api-public-access-disabled

A cloud-native API gateway is considered compliant if all its load balancing endpoints are private. The gateway is considered non-compliant if it has a public endpoint, the endpoint list is empty, or a required field is missing. Instances that are not API gateway instances are evaluated as not applicable.

New managed rule

apig-gateway-api-tracing-enabled

A cloud-native API gateway is considered compliant if Tracing Analysis is enabled. The gateway is considered non-compliant if Tracing Analysis is not enabled or the enabled status is not returned. AI gateway instances are evaluated as not applicable.

New managed rule

apig-gateway-api-waf-enabled

An API gateway instance is considered compliant if WAF protection is enabled (wafEnable equals true). The instance is considered non-compliant if WAF protection is not enabled. Instances that are not API gateway instances are evaluated as not applicable.

Adjusted managed rule

rds-instance-sql-collector-retention

The compliance evaluation for the retention period is relaxed. Previously, a SQL audit log retention period less than or equal to the specified minimum was evaluated as non-compliant. Now, only a retention period less than the specified minimum is evaluated as non-compliant. This means that a retention period that equals the minimum (180 days by default) is considered compliant.

Adjusted managed rule

redis-instance-audit-log-retention

The audit log retention period is now uniformly retrieved from Database Autonomy Service (DAS) for evaluation, because the Redis audit log feature is upgraded to a new version. The previous multi-path evaluation logic is simplified accordingly. Instances of versions that do not support audit logs are evaluated as not applicable.

Adjusted managed rule

use-ddos-instance-for-security-protection

The rule name and description are changed from "Use DDoS protection" to "Use Anti-DDoS Pro or Premium instances" to more accurately indicate that the rule checks whether an account has enabled Anti-DDoS Pro or Premium instances to defend against attacks.

New managed rule

root-ak-check-v2

An Alibaba Cloud account is considered compliant if it has no unused AccessKey pairs, no AccessKey pairs that were not used recently, and no AccessKey pairs that were used recently. The account is considered non-compliant if any of the preceding AccessKey pair risks exist. If the RAM governance report cannot be obtained, the evaluation result is insufficient data.

New managed rule

sae-application-enabled-security-protection

A running SAE application is considered compliant if all its instances are connected to Security Center and the protection clients are online. The application is considered non-compliant if it is not connected to Security Center or the protection client of any instance is offline. Applications that are not in the running state and applications whose instance specification is 0.5 vCPU or less are evaluated as not applicable.

Adjusted managed rule

apig-consumer-apikey-kms-reference

The remediation guide link of the rule is updated to point to a more relevant official topic.

Adjusted managed rule

apig-consumer-idle-check

The remediation guide link of the rule is updated to point to a more relevant official topic.

Adjusted managed rule

apig-domain-force-https-enabled

The remediation guide link of the rule is updated to point to a more relevant official topic.

Adjusted managed rule

apig-domain-https-enabled

The remediation guide link of the rule is updated to point to a more relevant official topic.

Adjusted managed rule

apig-gateway-ip-acl-enabled

The remediation guide link of the rule is updated to point to a more relevant official topic.

Adjusted managed rule

apig-gateway-waf-enabled

The remediation guide link of the rule is updated to point to a more relevant official topic.

New managed rule

apig-gateway-custom-domain-enabled

An AI gateway instance is considered compliant if at least one custom domain name is associated with it, and non-compliant if no custom domain name is associated. Instances that are not AI gateway instances are evaluated as not applicable.

New managed rule

apig-gateway-ip-acl-not-allow-all

An AI gateway instance is considered compliant if an IP access control policy is configured for it and the policy does not contain 0.0.0.0/0. The instance is considered non-compliant if no IP access control policy is configured or the policy contains 0.0.0.0/0. Instances that are not AI gateway instances are evaluated as not applicable.

New managed rule

ecs-snapshot-idle-check

A snapshot is considered compliant if its source disk still exists, and non-compliant if the source disk has been released or the snapshot is not associated with a source disk.

New managed rule

hbr-vault-backup-job-status-check

A Cloud Backup vault is considered compliant if it has no backup jobs in the "Partially Completed" or "Failed" state, and non-compliant if such jobs exist.

Compliance package update

ct-484cff4e06a300621b62

The following rule is added to the compliance package: idle disk snapshot detection (ecs-snapshot-idle-check).

Compliance package update

ct-484cff4e06a300621b9d

The following rule is added to the compliance package: idle disk snapshot detection (ecs-snapshot-idle-check).

New managed rule

sas-log-analysis-enabled

The configuration is considered compliant if the log analysis feature is enabled for any log type in Security Center.

Adjusted managed rule

ack-cluster-supported-version

The list of supported Kubernetes versions is updated. Versions 1.28, 1.30, 1.31, 1.32, and 1.33 are added to prevent new versions from being flagged as non-compliant by mistake.

New managed rule

apig-consumer-apikey-kms-reference

A consumer is considered compliant if its API key uses the KMS key reference mode, which supports periodic automatic rotation, and non-compliant if the API key is system-generated.

New managed rule

apig-consumer-idle-check

A consumer is considered compliant if it is granted access to at least one API, and non-compliant if it is not granted access to any API.

New managed rule

apig-domain-force-https-enabled

A domain is considered compliant if HTTPS redirect is enabled, and non-compliant if it is not enabled.

New managed rule

apig-domain-https-enabled

A domain is considered compliant if the HTTPS protocol (transport encryption) is configured, and non-compliant if it is not configured.

Adjusted managed rule

ecs-instance-image-type-check

The image source parameter is changed from single-value exact match to multi-value support. For example, both system and self can be allowed at the same time, separated by commas (,).

Adjusted managed rule

resources-tags-not-casesensitive-whitespace

Message Queue for Apache AMQP instances are added to the applicable resource types to expand the coverage of tag compliance checks.

Adjusted managed rule

redis-instance-tls-version-check

A "Not applicable" determination is added: single-replica instances and disk-based instances are not applicable to this check, which avoids false positives for instance types that do not support TLS.

Adjusted managed rule

mse-cluster-stable-version-check

The detection logic is changed from comparison against a fixed version threshold to referencing the version risk items in the MSE health check result (engine version too low, client version risk, or engine version at risk). This check applies only to Professional Edition instances.