Definition and execution of evaluation rules

Evaluation rules share the same evaluation logic as rule templates. When you configure an evaluation rule, you must specify the resource configuration items and the evaluation conditions. Core elements of an evaluation rule:

• Resource configuration items are resource properties, such as the specifications, region, name, status, port, and network interface controller (NIC) status.

• Evaluation conditions are the logical code that determines whether a resource is compliant. For example, if deletion protection is enabled for each Elastic Compute Service (ECS) instance, the evaluation result is Compliant. If deletion protection is disabled for an ECS instance, the result is Non-compliant.

• The evaluation result of a resource is the same as its compliance result.

The following figure shows how an evaluation rule works:

Procedure:

1. Parse a resource and query the type and properties of the resource.

2. Call the ListPreManagedRules operation to query all the evaluation rules that are supported by the resource.

3. Select an evaluation rule and call the EvaluatePreConfigRules operation to send an evaluation request.

   You can enable the rule templates feature.

   • If you enable the rule template feature, the corresponding rule template is activated and continuously checks resource compliance. You can modify, delete, disable, or enable the rule template in the Cloud Config console.

   • If you disable the rule template feature, you can only evaluate the resource.

4. Obtain the evaluation result.

   You can remediate a non-compliant resource and re-evaluate the resource.

You can use Resource Orchestration Service (ROS) to integrate evaluation rules. After you create an ROS template and configure parameters, you can obtain the type and properties of a resource. Before deployment, you can run an evaluation rule to check resource compliance, as shown in the following figure.