Aliyun Rules

Total rules: 317

Rules by Severity

High Severity (100 Rules)

Rule ID	Name	IaC Types	Description
ack-cluster-node-multi-zone	ACK Cluster Multi-Zone Deployment	ROS, Terraform	The ACK cluster nodes should be distributed across 3 or more availability zones for high availability.
ack-cluster-public-endpoint-check	ACK Cluster Public Endpoint Check	ROS, Terraform	ACK clusters should not have a public endpoint set, or the associated SLB listener should have ACL enabled.
acs-cluster-node-multi-zone	ACS Cluster Node Multi-Zone Deployment	ROS, Terraform	The ACS cluster nodes should be distributed across 3 or more availability zones for high availability.
actiontrail-enabled	ActionTrail Enabled	ROS, Terraform	Ensures ActionTrail is enabled to record account activities.
actiontrail-trail-intact-enabled	ActionTrail Trail Intact Enabled	ROS, Terraform	ActionTrail trail should be enabled and track all event types (Read and Write).
alb-acl-public-access-check	ALB ACL Does Not Allow Public Access	ROS, Terraform	Ensures that ALB access control lists do not contain 0.0.0.0/0 (allowing all IPs).
alb-all-listener-health-check-enabled	ALB All Listeners Health Check Enabled	ROS, Terraform	Ensures all ALB listeners have health checks enabled.
alb-delete-protection-enabled	ALB Instance Deletion Protection Enabled	ROS, Terraform	Ensures that ALB instances have deletion protection enabled.
alb-instance-multi-zone	ALB Instance Multi-Zone Deployment	ROS, Terraform	ALB instances should be deployed across multiple availability zones for high availability. If only one zone is selected, a zone failure will affect the ALB instance and business stability.
alb-instance-waf-enabled	ALB Instance Has WAF Protection	ROS, Terraform	Ensures that ALB instances have WAF3 (Web Application Firewall) protection enabled.
alb-server-group-multi-server	ALB Server Group Has Multiple Servers	ROS, Terraform	Ensures that ALB server groups contain at least two backend servers for high availability.
alidns-route-53-mx-check	DNS MX Record Has Valid SPF in Associated TXT Record	ROS, Terraform	Ensures that MX records have associated TXT records with valid SPF values for email validation.
api-gateway-group-force-https	API Gateway Group Force HTTPS	ROS, Terraform	Ensures API Gateway groups with public custom domains have HTTPS force redirect enabled.
bastionhost-instance-expired-check	BastionHost Instance Expiration Check	ROS, Terraform	Prepaid BastionHost instances should have auto-renewal enabled.
cdn-domain-multiple-origin-servers	CDN Domain Multiple Origin Servers	ROS, Terraform	CDN domains should be configured with multiple origin servers for high availability and fault tolerance.
cr-instance-any-ip-access-check	CR Instance No Any IP Access	ROS, Terraform	Ensures Container Registry instances do not have any IP (0.0.0.0/0) in their whitelist.
cr-repository-image-scanning-enabled	CR Instance Image Scanning Enabled	ROS, Terraform	Ensures Container Registry instances have image scanning enabled for security vulnerability detection.
cr-repository-type-private	CR Repository Type Private	ROS, Terraform	Ensures that CR repositories are set to PRIVATE.
dcdn-domain-multiple-origin-servers	DCDN Domain Multiple Origin Servers	ROS, Terraform	DCDN domains should be configured with multiple origin servers for high availability and fault tolerance.
eci-containergroup-environment-no-specified-keys	ECI Container Group Does Not Contain Sensitive Environment Variables	ROS, Terraform	Ensures that ECI container groups do not have sensitive environment variables like passwords or access keys.
ecs-available-disk-encrypted	ECS Disk Encryption Enabled	ROS, Terraform	Ensures that all ECS disks are encrypted.
ecs-instance-attached-security-group	ECS Instance Attached Security Group	ROS, Terraform	If the ECS instance is included in the specified security group, the configuration is considered compliant.
ecs-instance-deletion-protection-enabled	ECS Instance Deletion Protection Enabled	ROS, Terraform	Ensures that ECS instances have deletion protection enabled.
ecs-instance-enabled-security-protection	ECS Instance Enabled Security Protection	ROS, Terraform	Ensures that ECS instances have security enhancement strategy enabled.
ecs-instance-expired-check	ECS Prepaid Instance Expiration Check	ROS, Terraform	Prepaid instances should have auto-renewal enabled to avoid service interruption due to expiration.
ecs-instance-no-public-ip	ECS instance should not bind public IP	ROS, Terraform	ECS instances should not directly bind IPv4 public IP or Elastic IP, considered compliant.
ecs-launch-template-version-attach-security-group	ECS launch template version attaches security groups	ROS, Terraform	ECS launch template versions have security groups configured for instances, considered compliant.
ecs-running-instance-no-public-ip	ECS Instance No Public IP	ROS, Terraform	ECS instances should not have a public IP address to reduce direct internet exposure.
ecs-security-group-egress-not-all-access	Security Group Egress Not Set to All Access	ROS, Terraform	Security group egress direction should not be set to allow all access (all protocols, all ports, all destinations).
ecs-security-group-not-internet-cidr-access	Security Group Ingress Source IP Not Include Public IP	ROS, Terraform	Security group ingress rules with accept policy should not have source IP containing public internet IPs.
ecs-security-group-not-open-all-port	Security Group Ingress Not Open All Ports	ROS, Terraform	Security group ingress rules should not allow all ports. When the port range is not set to -1/-1, it is considered compliant.
ecs-security-group-not-open-all-protocol	Security Group Ingress Not Open All Protocols	ROS, Terraform	Security group ingress rules should not allow all protocols. When the protocol type is not set to ALL, it is considered compliant.
ecs-security-group-risky-ports-check-with-protocol	Security Group Risky Ports Check with Protocol	ROS, Terraform	When security group ingress source is set to 0.0.0.0/0, the port range should not include risky ports (22, 3389) for specified protocols (TCP/UDP), to reduce the risk of brute force attacks.
ecs-security-group-white-list-port-check	Security Group Non-Whitelist Port Ingress Check	ROS, Terraform	Except for whitelisted ports (80), other ports should not have ingress rules allowing access from 0.0.0.0/0.
elasticsearch-instance-enabled-kibana-public-check	Elasticsearch Instance Kibana Does Not Enable Public Access	ROS, Terraform	Ensures that Elasticsearch instance Kibana is not accessible from public networks.
elasticsearch-instance-enabled-public-check	Elasticsearch Instance Does Not Enable Public Access	ROS, Terraform	Ensures that Elasticsearch instances are not accessible from public networks.
elasticsearch-instance-node-not-use-specified-spec	Elasticsearch Instance Does Not Use Deprecated Spec	ROS, Terraform	Ensures that Elasticsearch instances do not use deprecated or unsupported node specifications.
elasticsearch-instance-version-not-deprecated	Elasticsearch Instance Does Not Use Deprecated Version	ROS, Terraform	Ensures that Elasticsearch instances are not using deprecated or EOL versions.
elasticsearch-public-and-any-ip-access-check	Elasticsearch Public and Any IP Access Check	ROS, Terraform	Ensures that Elasticsearch instances do not have public access enabled or an open whitelist.
ess-scaling-configuration-data-disk-encrypted	ESS Scaling Configuration Data Disk Encryption	ROS, Terraform	All ESS scaling configuration data disks should be encrypted.
ess-scaling-configuration-sg-public-access	ESS Scaling Configuration Security Group Public Access	ROS, Terraform	ESS scaling configuration security groups should not allow unrestricted public access.
ess-scaling-configuration-system-disk-encrypted	ESS Scaling Configuration System Disk Encryption	ROS, Terraform	ESS scaling configurations should enable system disk encryption to protect system data at rest.
fc-function-runtime-check	FC Function Runtime Check	ROS, Terraform	FC functions should not use deprecated runtimes that may have security vulnerabilities.
fc-trigger-http-not-anonymous	FC HTTP Trigger Authentication Check	ROS, Terraform	FC HTTP triggers should require authentication to prevent unauthorized access.
gpdb-instance-disk-encryption-enabled	GPDB Disk Encryption Enabled	ROS, Terraform	Ensures GPDB instances have disk encryption enabled.
hbase-cluster-expired-check	HBase Prepaid Instance Expiration Check	ROS, Terraform	Prepaid HBase instances should have auto-renewal enabled.
hbase-cluster-ha-check	HBase Cluster High Availability Check	ROS, Terraform	HBase cluster should have at least 2 core instances for high availability.
kafka-instance-disk-encrypted	Kafka Instance Disk Encrypted	ROS, Terraform	Kafka instance should have disk encryption enabled during deployment for data protection.
kafka-instance-public-access-check	Kafka Instance Public Access Check	ROS, Terraform	Kafka instances should not be deployed with public access (deploy_type 5). Use VPC-only deployment (deploy_type 4) to restrict access to internal networks.
maxcompute-project-encryption-enabled	MaxCompute Project Encryption Enabled	ROS, Terraform	Ensures MaxCompute projects have encryption enabled to protect stored data.
maxcompute-project-ip-whitelist-enabled	MaxCompute Project IP Whitelist Enabled	ROS, Terraform	Ensures MaxCompute projects have an IP whitelist configured to restrict access.
mongodb-cluster-expired-check	MongoDB Instance Expiration Check	ROS, Terraform	Prepaid MongoDB instances should have auto-renewal enabled.
mongodb-instance-class-not-shared	MongoDB Instance Uses Dedicated Class	ROS, Terraform	Ensures MongoDB instances use dedicated or exclusive instance classes, not shared instances.
mongodb-min-maxconnections-limit	MongoDB Instance Minimum Connections Spec	ROS, Terraform	MongoDB instance class should meet minimum connection requirements (not use the smallest spec).
mongodb-min-maxiops-limit	MongoDB Instance Minimum IOPS Storage	ROS, Terraform	MongoDB instance storage should be at least 20 GB to meet IOPS requirements.
mongodb-public-access-check	MongoDB Whitelist Internet Restriction	ROS, Terraform	Ensures MongoDB security IP whitelists do not contain 0.0.0.0/0.
mongodb-public-and-any-ip-access-check	MongoDB Public and Any IP Access Check	ROS, Terraform	Ensures that MongoDB instances do not have an open whitelist (0.0.0.0/0).
mse-cluster-architecture-check	MSE Cluster Has Multiple Nodes	ROS, Terraform	MSE cluster instance_count should be greater than 3 for high availability.
mse-cluster-internet-check	MSE Cluster Has No Public Internet Access	ROS, Terraform	Ensures that MSE clusters do not have public internet access enabled.
mse-gateway-architecture-check	MSE Gateway Has Multiple Nodes	ROS, Terraform	MSE gateway should have replica > 1 for high availability.
nas-access-group-public-access-check	NAS Access Group IP Restriction	ROS, Terraform	Ensures NAS access rules do not allow 0.0.0.0/0.
nat-risk-ports-check	NAT Gateway DNAT Risk Ports Check	ROS, Terraform	Ensures NAT gateway DNAT entries do not expose high-risk ports.
oss-bucket-anonymous-prohibited	OSS Bucket Anonymous Access Prohibited	ROS, Terraform	Ensures that anonymous access is prohibited for the OSS bucket.
oss-bucket-only-https-enabled	OSS Bucket Only HTTPS Enabled	ROS, Terraform	Ensures OSS bucket policy enforces HTTPS-only access.
oss-bucket-policy-no-any-anonymous	OSS Bucket Policy No Anonymous Access	ROS, Terraform	Ensures OSS bucket policy does not grant any permissions to anonymous users.
oss-bucket-policy-outside-organization-check	OSS Bucket Policy No Outside Organization Access	ROS, Terraform	Ensures OSS bucket policy does not grant access to principals outside the organization.
oss-bucket-public-read-prohibited	OSS Bucket Public Read Prohibited	ROS, Terraform	Ensures OSS bucket ACL does not allow public read access.
oss-bucket-public-write-prohibited	OSS Bucket Public Write Prohibited	ROS, Terraform	OSS buckets should not allow public write access. Public write access allows anyone to upload, modify, or delete objects in the bucket, which poses significant security risks.
oss-bucket-server-side-encryption-enabled	OSS Bucket Server-Side Encryption Enabled	ROS, Terraform	Ensures OSS bucket has server-side encryption enabled.
parameter-sensitive-noecho-check	Sensitive Parameters Must Have NoEcho	ROS	Template parameters that contain sensitive information (passwords, API keys, secrets) must be protected by either setting NoEcho to true or using valid AssociationProperty values to prevent them from being displayed in plain text.
polardb-cluster-enabled-tde	PolarDB Cluster TDE Enabled	ROS, Terraform	Ensures PolarDB clusters have Transparent Data Encryption (TDE) enabled.
polardb-cluster-expired-check	PolarDB Cluster Expiration Check	ROS, Terraform	Prepaid PolarDB clusters should have auto-renewal enabled.
polardb-public-access-check	PolarDB Public Access Check	ROS, Terraform	Ensures PolarDB security_ips is not set to allow all source IPs (0.0.0.0/0).
polardb-public-and-any-ip-access-check	PolarDB Public and Any IP Access Check	ROS, Terraform	Ensures that PolarDB clusters do not have public endpoints and are not open to any IP address (0.0.0.0/0).
ram-policy-no-statements-with-admin-access-check	RAM Policy No Admin Access	ROS, Terraform	Ensures custom RAM policies do not grant full AdministratorAccess.
ram-user-mfa-check	RAM User MFA Enabled	ROS, Terraform	RAM users with console access should have multi-factor authentication (MFA) enabled.
ram-user-role-no-product-admin-access	RAM User Role No Product Admin Access	ROS, Terraform	Ensures RAM role policy attachments do not grant product administrative permissions.
ram-user-specified-permission-bound	RAM User Specified Permission Bound	ROS, Terraform	Ensures RAM users do not have specified high-risk permissions bound.
rds-instance-enabled-disk-encryption	RDS Instance Disk Encryption Enabled	ROS, Terraform	Ensures RDS instances have disk encryption enabled.
rds-instance-expired-check	RDS Prepaid Instance Expiration Check	ROS, Terraform	Prepaid RDS instances should have auto-renewal enabled.
rds-public-access-check	RDS Instance Public Access Check	ROS, Terraform	RDS instances should not be configured with public network addresses. Public access exposes databases to potential security threats from the internet.
rds-public-connection-and-any-ip-access-check	RDS Public Connection and Any IP Access Check	ROS, Terraform	Ensures that RDS instances do not have a completely unrestricted security IP whitelist.
rds-white-list-internet-ip-access-check	RDS Whitelist Internet Restriction	ROS, Terraform	Ensures RDS security IP whitelists do not contain 0.0.0.0/0 or 0.0.0.0.
redis-instance-expired-check	Redis Prepaid Instance Expiration Check	ROS, Terraform	Prepaid Redis instances should have auto-renewal enabled.
redis-instance-no-public-ip	Redis Instance No Public IP	ROS, Terraform	Ensures Redis instance does not have public IP assigned.
redis-instance-open-auth-mode	Redis Authentication Mode Enabled	ROS, Terraform	Ensures Redis instances require authentication and are not in 'no-password' mode.
redis-public-and-any-ip-access-check	Redis Public and Any IP Access Check	ROS, Terraform	Ensures that Redis instances do not have public access enabled or an open whitelist.
root-ak-check	Root User AccessKey Check	ROS	Ensures that the root account does not have active AccessKeys.
root-mfa-check	Root User MFA Check	ROS	Ensures that Multi-Factor Authentication (MFA) is enabled for the root account.
sg-public-access-check	Security Group Ingress Valid	ROS, Terraform	Security group ingress rules should not allow all ports (-1/-1) from all sources (0.0.0.0/0) simultaneously.
sg-risky-ports-check	Security group does not open risky ports to 0.0.0.0/0	ROS, Terraform	When security group ingress rule source is set to 0.0.0.0/0, the port range should not include specified risky ports, considered compliant. If source is not 0.0.0.0/0, it's compliant even if risky ports are included.
slb-acl-public-access-check	SLB ACL Public Access Check	ROS, Terraform	Ensures that SLB ACLs do not contain 0.0.0.0/0 to prevent unrestricted public access.
slb-all-listener-health-check-enabled	SLB All Listeners Health Check Enabled	ROS, Terraform	Ensures all SLB listeners have health checks enabled.
slb-all-listener-servers-multi-zone	SLB Multi-Zone with Multi-Zone Backend Servers	ROS, Terraform	SLB instances should be multi-zone, with master_zone_id and slave_zone_id configured to different zones.
slb-delete-protection-enabled	SLB Instance Deletion Protection Enabled	ROS, Terraform	Ensures that SLB instances have deletion protection enabled.
slb-listener-risk-ports-check	SLB Listener Risk Ports Check	ROS, Terraform	Ensures SLB listeners do not expose high-risk ports like 22 or 3389.
transit-router-vpc-attachment-multi-zone	Transit Router VPC Attachment Multi-Zone Configuration	ROS, Terraform	Transit Router VPC attachments should be configured with vSwitches in at least two different availability zones for cross-zone high availability.
tsdb-instance-security-ip-check	TSDB Instance Does Not Allow Any IP Access	ROS, Terraform	Ensures that TSDB instances do not have security whitelists that allow all IPs.
use-waf-instance-for-security-protection	Use WAF for Security Protection	ROS, Terraform	WEB Application Firewall (WAF) should be used to protect websites and APPs from web-based attacks.
vpc-network-acl-risky-ports-check	VPC Network ACL Risky Ports Check	ROS, Terraform	Ensures VPC Network ACLs do not allow unrestricted access to risky ports (22, 3389).

Medium Severity (176 Rules)

Rule ID	Name	IaC Types	Description
ack-cluster-encryption-enabled	ACK Cluster Secret Encryption Enabled	ROS, Terraform	ACK Pro clusters should have Secret encryption at rest enabled using KMS.
ack-cluster-inspect-kubelet-version-outdate-check	ACK Kubelet Version Check	ROS, Terraform	Ensures the Kubelet version in the ACK cluster is up to date.
ack-cluster-log-plugin-installed	ACK Cluster Log Plugin Installed	ROS, Terraform	Ensures the log-service addon is installed in the ACK cluster.
ack-cluster-rrsa-enabled	ACK Cluster RRSA Enabled	ROS, Terraform	Ensures that the RAM Roles for Service Accounts (RRSA) feature is enabled for the ACK cluster.
ack-cluster-supported-version	ACK Cluster Supported Version	ROS, Terraform	Ensures that the ACK cluster is running a supported version.
ack-cluster-upgrade-latest-version	ACK Cluster Upgraded to Latest Version	ROS, Terraform	Ensures that the ACK cluster is running the latest available version.
adb-cluster-multi-zone	ADB Cluster Multi-Zone Deployment	ROS, Terraform	The ADB cluster should be deployed in multi-zone mode.
alb-all-listenter-has-server	ALB Listener Has Backend Server	ROS, Terraform	Ensures all ALB listeners are associated with a non-empty server group.
alb-instance-bind-security-group-or-enabled-acl	ALB Instance Bind Security Group or Enable ACL	ROS, Terraform	ALB instance should have security groups associated or ACL configured for all running listeners.
alb-server-group-multi-zone	ALB Server Group Multi-Zone Distribution	ROS, Terraform	ALB server groups should have backend servers distributed across multiple availability zones for high availability. This rule does not apply to server groups with no attached servers, or to IP/Function Compute type server groups.
alidns-domain-regex-match	Alibaba Cloud DNS Domain Names Match Naming Convention	ROS, Terraform	Ensures that Alibaba Cloud DNS domain names match the specified naming convention regex.
api-gateway-api-auth-jwt	API Gateway API Auth JWT	ROS, Terraform	Ensures API Gateway APIs use JWT authentication.
api-gateway-api-auth-required	API Gateway API Auth Required	ROS, Terraform	Ensures API Gateway APIs have authentication configured.
api-gateway-api-internet-request-https	API Gateway Internet Request HTTPS Enabled	ROS, Terraform	Ensures that API Gateway APIs exposed to the internet use HTTPS protocol.
api-gateway-api-visibility-private	API Gateway API Visibility Private	ROS, Terraform	Ensures API Gateway APIs are set to PRIVATE visibility.
api-gateway-group-bind-domain	API Gateway Group Bind Domain	ROS, Terraform	Ensures API Gateway groups have custom domains bound.
api-gateway-group-enabled-ssl	API Gateway Group SSL Enabled	ROS, Terraform	Ensures that SSL is enabled for API Gateway groups.
api-gateway-group-https-policy-check	API Gateway Group HTTPS Policy Check	ROS, Terraform	Ensures API Gateway groups have HTTPS security policy set correctly.
api-gateway-group-log-enabled	API Gateway Group Log Enabled	ROS, Terraform	Ensures API Gateway groups have logging configured.
apigateway-instance-multi-zone	API Gateway Instance Multi-Zone Deployment	ROS, Terraform	API Gateway instances should be deployed in multi-zone configuration for high availability.
bastionhost-instance-spec-check	BastionHost Instance Multi-Zone Spec Check	ROS, Terraform	The BastionHost instance should use the Enterprise version which supports multi-zone deployment.
cen-cross-region-bandwidth-check	CEN Cross-Region Bandwidth Check	ROS, Terraform	CEN instance cross-region connections should have sufficient bandwidth allocation to meet performance requirements.
clickhouse-dbcluster-multi-zone	ClickHouse DBCluster Multi-Zone Deployment	ROS, Terraform	ClickHouse clusters should use the HighAvailability (Double-replica) edition for multi-zone deployment. Note: This applies only to community edition.
cr-instance-multi-zone	CR Instance with Zone-Redundant OSS Bucket	ROS, Terraform	Container Registry instances should be associated with zone-redundant OSS buckets for high availability.
ecs-disk-all-encrypted-by-kms	ECS disk with KMS encryption enabled	ROS, Terraform	ECS disks are encrypted with KMS, considered compliant.
ecs-disk-encrypted	ECS data disk encryption enabled	ROS, Terraform	ECS data disk has encryption enabled, considered compliant.
ecs-disk-in-use	ECS disk is in use	ROS, Terraform	ECS disks are attached to an instance or in use state, considered compliant. Disks that are available or unattached may be idle resources.
ecs-disk-retain-auto-snapshot	Retain auto snapshot when ECS disk is released	ROS, Terraform	Configure ECS disks to retain auto snapshots when released, considered compliant. This helps protect data from accidental deletion.
ecs-in-use-disk-encrypted	ECS In-Use Disk Encryption	ROS, Terraform	ECS data disks should have encryption enabled to protect data at rest. Encrypted disks use KMS keys to encrypt data, ensuring data security and compliance with regulatory requirements.
ecs-instance-auto-renewal-enabled	ECS subscription instance has auto-renewal enabled	ROS, Terraform	ECS subscription (prepaid) instances have auto-renewal enabled, considered compliant. Pay-as-you-go instances are not applicable.
ecs-instance-image-expired-check	ECS Instance Image Expired Check	ROS, Terraform	Ensures that the image used by the ECS instance has not expired.
ecs-instance-image-type-check	ECS Instance Image Type Check	ROS, Terraform	Ensures ECS instances use images from authorized sources.
ecs-instance-login-use-keypair	ECS Instance Login Using Key Pair	ROS, Terraform	Ensures that ECS instances use key pairs for login instead of passwords.
ecs-instance-meta-data-mode-check	ECS instance metadata access uses security-enhanced mode (IMDSv2)	ROS, Terraform	When accessing ECS instance metadata, security-enhanced mode (IMDSv2) is enforced, considered compliant. Instances associated with ACK clusters are not applicable.
ecs-instance-no-public-and-anyip	ECS Instance Should Not Bind Public IP or Allow Any IP Access	ROS, Terraform	ECS instances should not directly bind IPv4 public IPs or Elastic IPs, and associated security groups should not expose 0.0.0.0/0. Compliant when no public IP is bound.
ecs-instance-not-bind-key-pair	ECS Instance Not Bound to Key Pair	ROS, Terraform	Ensures that ECS instances use key pairs for authentication instead of passwords.
ecs-instance-type-family-not-deprecated	ECS Instance Type Not Deprecated	ROS, Terraform	Ensures ECS instances do not use deprecated or legacy instance types.
ecs-instances-in-vpc	ECS Instances in VPC	ROS, Terraform	ECS instances should be deployed in VPC (Virtual Private Cloud) networks rather than classic networks. VPC provides better network isolation, security, and flexibility.
ecs-internetmaxbandwidth-check	ECS Internet Max Bandwidth Check	ROS, Terraform	Ensures ECS internet outbound bandwidth does not exceed specified limits.
ecs-launch-template-network-type-check	ECS launch template uses VPC network type	ROS, Terraform	ECS launch template versions have network type set to VPC, considered compliant. Classic network type is not recommended for production environments.
ecs-launch-template-version-data-disk-encrypted	ECS launch template version enables data disk encryption	ROS, Terraform	All data disks configured in ECS launch template versions are encrypted, considered compliant.
ecs-launch-template-version-image-type-check	Launch Template Image Type Check	ROS, Terraform	Ensures ECS launch templates use authorized image types.
ecs-running-instances-in-vpc	Running ECS instances are in VPC	ROS, Terraform	Running ECS instances are deployed in Virtual Private Cloud (VPC), considered compliant. This provides network isolation and enhanced security.
ecs-snapshot-policy-timepoints-check	ECS auto snapshot policy timepoints configured reasonably	ROS, Terraform	The snapshot creation timepoints in the auto snapshot policy are within the specified time range, considered compliant. Creating snapshots temporarily reduces block storage I/O performance, with performance differences generally within 10%, causing brief slowdowns. It is recommended to select timepoints that avoid business peak hours.
eip-delete-protection-enabled	EIP Deletion Protection Enabled	ROS, Terraform	Ensures that EIP instances have deletion protection enabled.
elasticsearch-instance-enabled-data-node-encryption	Elasticsearch Data Node Encryption Enabled	ROS, Terraform	Ensures that data nodes in the Elasticsearch instance have disk encryption enabled.
elasticsearch-instance-enabled-node-config-disk-encryption	ES Node Config Disk Encryption	ROS, Terraform	Ensures Elasticsearch elastic node configurations have disk encryption enabled.
elasticsearch-instance-multi-zone	Elasticsearch Instance Multi-Zone Deployment	ROS, Terraform	Elasticsearch instances should be deployed across multiple availability zones.
emr-cluster-master-public-access-check	EMR Cluster Master Node Public Access Check	ROS, Terraform	EMR on ECS cluster master nodes should not have public IP enabled.
ess-group-health-check	ESS Scaling Group Health Check	ROS, Terraform	ESS scaling groups should enable ECS instance health checks.
ess-scaling-configuration-attach-security-group	ESS Scaling Configuration Security Group	ROS, Terraform	ESS scaling configurations should attach security groups to instances for proper network isolation and access control.
ess-scaling-configuration-enabled-internet-check	ESS Scaling Configuration Internet Access Check	ROS, Terraform	ESS scaling configurations should not enable public bandwidth for instances unless necessary.
ess-scaling-configuration-image-check	ESS Scaling Configuration Image Check	ROS, Terraform	ESS scaling configurations should use maintained images to ensure security and stability.
ess-scaling-configuration-image-type-check	ESS Scaling Configuration Image Type Check	ROS, Terraform	ESS scaling configurations should use images from specified sources.
ess-scaling-group-attach-multi-switch	ESS Scaling Group Multi-VSwitch	ROS, Terraform	ESS scaling groups should be associated with at least two VSwitches for high availability across multiple zones.
ess-scaling-group-attach-slb	ESS Scaling Group Attach SLB	ROS, Terraform	ESS scaling groups should be attached to Classic Load Balancer.
ess-scaling-group-loadbalancer-check	ESS Scaling Group Load Balancer Existence Check	ROS, Terraform	ESS scaling groups should be attached to load balancers for traffic distribution.
fc-function-custom-domain-and-cert-enable	FC Function Custom Domain Certificate Check	ROS, Terraform	FC custom domains should have SSL certificates configured for secure communication.
fc-function-custom-domain-and-https-enable	FC Function Custom Domain HTTPS Check	ROS, Terraform	FC custom domains should have HTTPS enabled for secure communication.
fc-function-custom-domain-and-tls-enable	FC Function Custom Domain and TLS Enabled	ROS, Terraform	Ensures that custom domains for Function Compute functions have TLS enabled.
fc-function-internet-and-custom-domain-enable	FC Service Internet Access with Custom Domain	ROS, Terraform	FC services with internet access should be bound to custom domains for proper access control.
fc-function-settings-check	FC Function Settings Check	ROS, Terraform	FC function settings should meet specified requirements for optimal performance and security.
fc-service-bind-role	FC Service Bound to RAM Role	ROS, Terraform	Ensures that the Function Compute service has a RAM role bound to it.
fc-service-internet-access-disable	FC Service Internet Access Disabled	ROS, Terraform	Ensures that the Function Compute service has internet access disabled when it should only access internal resources.
fc-service-log-enable	FC Service Log Enable	ROS, Terraform	FC services should have logging enabled for monitoring and troubleshooting.
fc-service-tracing-enable	FC Service Tracing Enable	ROS, Terraform	FC services should have tracing enabled for performance monitoring and debugging.
fc-service-vpc-binding	FC Service VPC Binding Enabled	ROS, Terraform	Ensures that the Function Compute service is configured to access resources within a VPC.
firewall-asset-open-protect	Cloud Firewall Asset Protection Enabled	ROS, Terraform	Ensures assets are protected by Cloud Firewall.
gpdb-instance-multi-zone	GPDB Instance Multi-Zone Deployment	ROS, Terraform	GPDB instances should be deployed with a standby zone for high availability.
gwlb-loadbalancer-multi-zone	GWLB LoadBalancer Multi-Zone Deployment	ROS, Terraform	GWLB LoadBalancer instances should be deployed across at least two availability zones.
hbase-cluster-deletion-protection	HBase Cluster Deletion Protection Enabled	ROS, Terraform	Ensures that HBase instances have deletion protection enabled.
hbase-cluster-in-vpc	HBase Cluster Deployed in VPC	ROS, Terraform	Ensures that HBase instances are deployed within a VPC.
hbase-cluster-multi-zone	HBase Cluster Multi-Zone Deployment	ROS, Terraform	HBase clusters should be deployed in cluster mode with at least 2 nodes for high availability.
internet-nat-gateway-in-specified-vpc	Internet NAT Gateway in Specified VPC	ROS, Terraform	Internet-facing NAT gateways should be created in specified VPCs according to network security requirements.
intranet-nat-gateway-in-specified-vpc	Intranet NAT Gateway in Specified VPC	ROS, Terraform	Intranet-facing NAT gateways should be created in specified VPCs according to network security requirements.
kafka-instance-multi-zone	Kafka Instance Multi-Zone Deployment	ROS, Terraform	Kafka instances should be deployed across multiple availability zones for high availability.
kms-instance-multi-zone	KMS Instance Multi-Zone Deployment	ROS, Terraform	KMS instances should be deployed across at least two availability zones for high availability and disaster recovery.
kms-key-delete-protection-enabled	KMS Key Deletion Protection Enabled	ROS, Terraform	Ensures that KMS keys have deletion protection enabled to prevent accidental deletion.
kms-key-rotation-enabled	KMS Key Automatic Rotation Enabled	ROS, Terraform	Ensures that KMS keys have automatic rotation enabled to enhance security by periodically rotating key material.
kms-secret-rotation-enabled	KMS Secret Automatic Rotation Enabled	ROS, Terraform	Ensures that KMS secrets have automatic rotation enabled to enhance security by periodically rotating secret values.
lindorm-instance-in-vpc	Lindorm in VPC Check	ROS, Terraform	Ensures Lindorm instances are deployed within a VPC.
lindorm-instance-multi-zone	Lindorm Instance Multi-Zone Deployment	ROS, Terraform	Lindorm instance should have at least 4 table engine nodes for multi-zone deployment capability.
mongodb-instance-enabled-ssl	MongoDB Instance SSL Enabled	ROS, Terraform	MongoDB instances should have SSL enabled to encrypt data in transit.
mongodb-instance-encryption-byok-check	MongoDB Instance TDE with Custom KMS Key	ROS, Terraform	MongoDB instances should have TDE enabled with a customer-managed KMS encryption key (BYOK).
mongodb-instance-in-vpc	MongoDB Instance Uses VPC Network	ROS, Terraform	Ensures MongoDB instances are deployed in a Virtual Private Cloud (VPC) network.
mongodb-instance-log-audit	MongoDB Instance Audit Logging Enabled	ROS, Terraform	MongoDB instances should have audit logging enabled for security monitoring.
mongodb-instance-multi-node	MongoDB Instance Multi-Node for High Availability	ROS, Terraform	MongoDB instances should have a replication_factor of at least 3 for high availability.
mongodb-instance-multi-zone	MongoDB Instance Multi-Zone Deployment	ROS, Terraform	MongoDB instances should be deployed across multiple availability zones for disaster recovery.
mongodb-instance-release-protection	MongoDB Instance Release Protection Enabled	ROS, Terraform	MongoDB instances should have release protection enabled to prevent accidental deletion.
mse-cluster-config-auth-enabled	MSE Cluster Config Auth Enabled	ROS, Terraform	MSE cluster should have ACL entry list configured for authentication and access control.
mse-cluster-multi-availability-area-architecture-check	MSE Cluster High-Availability Configuration	ROS, Terraform	MSE clusters should use the Professional Edition with at least 3 instances (odd number) for high availability.
mse-cluster-stable-version-check	MSE Cluster Uses Stable Version	ROS, Terraform	Ensures that MSE cluster engine version is greater than the minimum stable version.
mse-gateway-multi-availability-area-architecture-check	MSE Gateway Multi-Availability Zone Deployment	ROS, Terraform	MSE gateways should be deployed across multiple availability zones by configuring a backup VSwitch.
nas-filesystem-mount-target-access-group-check	NAS Mount Target Access Group Check	ROS, Terraform	Ensures NAS mount targets do not use the 'DEFAULT_VPC_GROUP_NAME'.
natgateway-delete-protection-enabled	NAT Gateway Deletion Protection Enabled	ROS, Terraform	Ensures that NAT gateway instances have deletion protection enabled.
natgateway-eip-used-check	NAT Gateway EIP Usage Check	ROS, Terraform	SNAT and DNAT should not use the same EIP to avoid potential conflicts and improve network segmentation.
natgateway-snat-eip-bandwidth-check	NAT Gateway SNAT EIP Bandwidth Consistency	ROS, Terraform	NAT gateway specification should not be Small to ensure adequate SNAT EIP bandwidth capacity.
nlb-loadbalancer-multi-zone	NLB LoadBalancer Multi-Zone Deployment	ROS, Terraform	NLB LoadBalancer instances should be deployed across at least two availability zones for high availability.
nlb-server-group-multi-zone	NLB Server Group Multi-Zone Distribution	ROS, Terraform	NLB server groups should have backend servers distributed across multiple availability zones for high availability. This rule does not apply to server groups with no attached servers, or to IP type server groups.
oss-bucket-authorize-specified-ip	OSS Bucket Authorize Specified IP	ROS, Terraform	Ensures OSS bucket policies restrict access to specified IP ranges.
oss-bucket-backup-enable	OSS Backup Enabled	ROS, Terraform	Ensures OSS bucket has versioning enabled for backup purposes.
oss-bucket-logging-enabled	OSS Bucket Logging Enabled	ROS, Terraform	Ensures OSS bucket has access logging enabled.
oss-bucket-remote-replication	OSS Bucket Remote Replication Enabled	ROS, Terraform	Ensures that cross-region replication is enabled for the OSS bucket for disaster recovery.
oss-bucket-tls-version-check	OSS Bucket TLS Version Check	ROS, Terraform	Ensures OSS bucket has a policy set to enforce TLS requirements.
oss-bucket-versioning-enabled	OSS Bucket Versioning Enabled	ROS, Terraform	Ensures OSS bucket has versioning enabled.
oss-default-encryption-kms	OSS bucket server-side KMS encryption enabled	ROS, Terraform	OSS bucket has server-side KMS encryption enabled, considered compliant.
oss-encryption-byok-check	OSS Bucket BYOK Encryption Check	ROS, Terraform	Ensures OSS bucket uses KMS encryption with a customer-managed key (BYOK).
oss-zrs-enabled	OSS Bucket Zone-Redundant Storage Enabled	ROS, Terraform	Ensures OSS bucket uses Zone-Redundant Storage (ZRS) for high availability.
ots-instance-multi-zone	OTS Instance Zone-Redundant Storage	ROS, Terraform	OTS instances should use zone-redundant access mode (ConsoleOrVpc) for high availability.
ots-instance-network-not-normal	OTS Restricted Network Type	ROS, Terraform	OTS instances should not use unrestricted network access (Any). Use Vpc or ConsoleOrVpc instead.
pai-eas-instances-multi-zone	PAI EAS Instance Multi-Zone Deployment	ROS, Terraform	Ensures that PAI EAS instances are deployed across multiple zones for high availability.
polardb-cluster-delete-protection-enabled	PolarDB Cluster Deletion Protection Enabled	ROS, Terraform	Ensures that PolarDB clusters have deletion protection enabled.
polardb-cluster-enabled-ssl	PolarDB Cluster SSL Enabled	ROS, Terraform	Ensures PolarDB clusters have SSL encryption enabled.
polardb-cluster-multi-zone	PolarDB Cluster Multi-Zone Deployment	ROS, Terraform	PolarDB clusters should be deployed across multiple availability zones for high availability.
polardb-dbcluster-in-vpc	PolarDB Cluster in VPC	ROS, Terraform	Ensures PolarDB cluster is deployed in a VPC by setting vswitch_id.
polardb-revision-version-used-check	PolarDB Revision Version Used Check	ROS, Terraform	Ensures PolarDB cluster is using a stable kernel revision version.
polardb-x2-instance-multi-zone	PolarDB-X 2.0 Instance Multi-Zone Deployment	ROS, Terraform	PolarDB-X 2.0 instances should be deployed across 3 availability zones.
privatelink-server-endpoint-multi-zone	PrivateLink VPC Endpoint Service Multi-Zone Deployment	ROS, Terraform	PrivateLink VPC endpoint services should have resources deployed across multiple availability zones for high availability.
privatelink-servier-endpoint-multi-zone	PrivateLink Service Endpoint Multi-Zone Deployment	ROS, Terraform	Ensures that PrivateLink service endpoints are deployed across multiple zones for high availability.
ram-password-policy-check	RAM Password Policy Check	ROS, Terraform	Ensures that the RAM password policy meets the specified security requirements.
ram-policy-no-has-specified-document	RAM Policy No Specified Document	ROS, Terraform	Ensures custom RAM policies do not contain the specified permission configuration.
ram-role-has-specified-policy	RAM Role Has Specified Policy	ROS, Terraform	Ensures RAM roles have the specified policies attached.
ram-role-no-product-admin-access	RAM Role No Product Admin Access	ROS, Terraform	Ensures RAM roles do not have full administrative access or product administrator permissions.
ram-user-activated-ak-quantity-check	RAM User Active AK Quantity Check	ROS, Terraform	Ensures RAM users do not have more than one active AccessKey.
ram-user-ak-create-date-expired-check	RAM User AccessKey Creation Date Expired Check	ROS, Terraform	Ensures that RAM user AccessKeys are properly managed with secure storage.
ram-user-ak-used-expired-check	RAM User AccessKey Last Used Date Check	ROS, Terraform	Ensures that RAM user AccessKeys are in Active status.
ram-user-has-specified-policy	RAM User Has Specified Policy	ROS, Terraform	Ensures RAM users have the required policies attached, including those inherited from groups.
ram-user-login-check	RAM User Login Enabled Check	ROS, Terraform	Ensures that RAM users who do not need console access have login disabled.
ram-user-no-has-specified-policy	RAM User No Specified Policy	ROS, Terraform	Ensures RAM users do not have specified risky policies attached.
ram-user-no-product-admin-access	RAM User No Product Administrative Access	ROS, Terraform	Ensures that RAM users do not have full administrative access to cloud products unless necessary.
rds-instacne-delete-protection-enabled	RDS Instance Deletion Protection Enabled	ROS, Terraform	Ensures that RDS instances have deletion protection enabled.
rds-instance-enabled-auditing	RDS Instance Auditing Enabled	ROS, Terraform	Ensures RDS instances have SQL auditing enabled.
rds-instance-enabled-log-backup	RDS Instance Log Backup Enabled	ROS, Terraform	Ensures RDS instances have log backup enabled.
rds-instance-enabled-ssl	RDS Instance SSL Enabled	ROS, Terraform	Ensures RDS instances have SSL encryption enabled.
rds-instance-enabled-tde-disk-encryption	RDS Instance Enabled TDE or Disk Encryption	ROS, Terraform	RDS instance should have TDE (Transparent Data Encryption) or disk encryption enabled.
rds-instance-has-guard-instance	RDS Instance Has Guard Instance	ROS, Terraform	Ensures production RDS instances have a corresponding guard (disaster recovery) instance.
rds-instances-in-vpc	RDS Instance in VPC	ROS, Terraform	Ensures that the RDS instance is deployed within a VPC.
rds-multi-az-support	RDS Instance Multi-AZ Deployment	ROS, Terraform	RDS instances should be deployed in multi-AZ configuration for high availability and automatic failover.
redis-architecturetype-cluster-check	Redis Architecture Type Cluster Check	ROS, Terraform	Ensures Redis instance uses cluster architecture type.
redis-instance-backup-log-enabled	Redis Instance Backup Log Enabled	ROS, Terraform	Ensures that backup is configured for the Redis instance.
redis-instance-double-node-type	Redis Instance Double Node Type	ROS, Terraform	Ensures Redis instance uses double node type for high availability.
redis-instance-enabled-byok-tde	Redis Instance BYOK TDE Enabled	ROS, Terraform	Ensures that Redis instances have Transparent Data Encryption (TDE) enabled using Bring Your Own Key (BYOK).
redis-instance-enabled-ssl	Redis Instance SSL Enabled	ROS, Terraform	Ensures Redis instances have SSL encryption enabled.
redis-instance-in-vpc	Redis Instance in VPC	ROS, Terraform	Ensures Redis instance is deployed in a VPC.
redis-instance-multi-zone	Redis Instance Multi-Zone Deployment	ROS, Terraform	Redis instances should be deployed across multiple availability zones for high availability.
redis-instance-release-protection	Redis Instance Release Protection Enabled	ROS, Terraform	Ensures that Redis instances have release protection enabled.
redis-instance-tls-version-check	Redis Instance TLS Version Check	ROS, Terraform	Ensures Redis instance has SSL enabled with acceptable TLS version.
redis-min-capacity-limit	Redis Min Capacity Limit	ROS, Terraform	Ensures Redis instance has memory capacity meeting the minimum requirement.
rocketmq-v5-instance-multi-zone	RocketMQ 5.0 Instance Multi-Zone Deployment	ROS, Terraform	RocketMQ 5.0 instances should be deployed in Cluster HA mode which supports multi-zone availability.
security-center-version-check	Security Center Version Check	ROS	Security Center should be at a version that provides sufficient protection features.
slb-all-listener-enabled-acl	SLB All Listeners Have Access Control	ROS, Terraform	All running listeners of SLB instances should have access control lists (ACL) configured for security.
slb-all-listener-http-disabled	SLB All Listeners HTTP Disabled	ROS, Terraform	Ensures no SLB listeners use the insecure HTTP protocol.
slb-all-listener-http-redirect-https	SLB HTTP Redirect to HTTPS Enabled	ROS, Terraform	Ensures SLB HTTP listeners are configured to redirect traffic to HTTPS.
slb-all-listenter-has-server	SLB All Listeners Have Backend Servers	ROS, Terraform	All listeners of SLB instances should have at least the specified number of backend servers attached.
slb-all-listenter-tls-policy-check	SLB Listener TLS Policy Check	ROS, Terraform	Ensures SLB HTTPS listeners use secure TLS cipher policies.
slb-default-server-group-multi-server	SLB Default Server Group Has Multiple Servers	ROS, Terraform	The default server group of SLB instances should have at least two servers to avoid single point of failure.
slb-instance-autorenewal-check	SLB Instance Auto-Renewal Check	ROS, Terraform	Prepaid SLB instances should have auto-renewal enabled to avoid service interruption.
slb-instance-default-server-group-multi-zone	SLB Default Server Group Multi-Zone	ROS, Terraform	The default server group of SLB instances should have resources distributed across multiple availability zones.
slb-instance-log-enabled	SLB Instance Logging Enabled	ROS, Terraform	Ensures that access logging is enabled for the SLB instance.
slb-instance-multi-zone	SLB Instance Multi-Zone Deployment	ROS, Terraform	SLB instances should be deployed across multiple zones by configuring both master and slave zones for high availability.
slb-instance-spec-check	SLB Instance Specification Check	ROS, Terraform	SLB instance specifications should meet the required performance criteria based on the specified list.
slb-listener-https-enabled	SLB Listener HTTPS Enabled	ROS, Terraform	Ensures SLB listeners use HTTPS protocol for secure communication.
slb-loadbalancer-in-vpc	SLB in VPC Check	ROS, Terraform	Ensures SLB instances are deployed within a Virtual Private Cloud (VPC).
slb-master-slave-server-group-multi-zone	SLB Master-Slave Server Group Multi-Zone	ROS, Terraform	The master-slave server group of SLB instances should have resources distributed across multiple availability zones.
slb-no-public-ip	SLB Instance No Public IP	ROS, Terraform	SLB instances should not have public IP addresses to reduce attack surface.
slb-vserver-group-multi-zone	SLB VServer Group Multi-Zone Deployment	ROS, Terraform	Ensures that SLB virtual server groups contain instances from multiple availability zones.
sls-logstore-enabled-encrypt	SLS Logstore Encryption Enabled	ROS, Terraform	Ensures SLS Logstores have server-side encryption enabled.
sls-logstore-encrypt-key-origin-check	SLS Logstore Encryption Key Origin Check	ROS, Terraform	Ensures SLS Logstores use externally imported key material (BYOK) for encryption, which provides better control over encryption keys.
sls-project-multi-zone	SLS Project Zone-Redundant Storage	ROS, Terraform	SLS projects should use zone-redundant storage (ZRS) for high availability and data durability.
vpc-flow-logs-enabled	VPC Flow Logs Enabled	ROS, Terraform	Ensures VPC flow logs are enabled for monitoring network traffic.
vpc-network-acl-not-empty	VPC Network ACL Not Empty	ROS, Terraform	Ensures VPC Network ACLs have at least one rule configured.
vpn-connection-master-slave-established	VPN Connection Dual Tunnel Established	ROS, Terraform	Use dual-tunnel VPN gateway and both master and slave tunnels are established with the peer.
vpn-gateway-multi-zone	VPN Gateway Multi-Zone Deployment	ROS, Terraform	VPN Gateways should be configured with a disaster recovery VSwitch to support multi-zone availability.
vswitch-available-ip-count	VSwitch Available IP Count Check	ROS, Terraform	Ensures that the VSwitch has a sufficient number of available IP addresses.
waf-instance-logging-enabled	WAF Instance Logging Enabled	ROS, Terraform	Ensures that logging is enabled for the WAF instance for auditing and security analysis.
waf3-defense-resource-logging-enabled	WAF 3.0 Logging Enabled	ROS, Terraform	Ensures that logging is enabled for resources protected by WAF 3.0.

Low Severity (41 Rules)

Rule ID	Name	IaC Types	Description
ack-cluster-spec-check	ACK Cluster Spec Check	ROS, Terraform	Ensures ACK clusters use approved specifications (e.g., ACK Pro).
alb-address-type-check	ALB Address Type Check	ROS, Terraform	Ensures ALB instances use the preferred address type (e.g., Intranet).
apig-group-custom-trace-enabled	API Gateway Group Custom Trace Enabled	ROS, Terraform	Ensures API Gateway groups have custom tracing enabled.
cr-repository-immutablity-enable	Container Registry repository image version is immutable	ROS, Terraform	Container Registry repository image version is immutable, considered compliant.
eci-container-group-volumn-mounts	ECI Volume Mounting Check	ROS, Terraform	Ensures ECI container groups have volumes mounted for persistent data storage.
ecs-disk-auto-snapshot-policy	ECS disk has auto snapshot policy configured	ROS, Terraform	ECS disk has auto snapshot policy configured, considered compliant. Disks not in use, disks that do not support auto snapshot policy, and non-persistent disks mounted by ACK clusters are not applicable. After enabling auto snapshot policy, Alibaba Cloud will automatically create snapshots for cloud disks according to preset time points and cycles, enabling quick recovery from virus intrusion or ransomware attacks.
ecs-disk-idle-check	ECS Disk Idle Check	ROS, Terraform	Ensures that ECS disks are attached to an instance and not in an idle state.
ecs-disk-regional-auto-check	ECS Disk Zone-Redundant ESSD Storage	ROS, Terraform	ECS data disks should use zone-redundant ESSD storage for high availability. System disks are not applicable to this rule.
ecs-instance-chargetype-check	ECS Instance Charge Type Check	ROS, Terraform	Ensures ECS instances use the authorized charge type.
ecs-instance-multiple-eni-check	ECS instance is bound to only one elastic network interface	ROS, Terraform	ECS instances are bound to only one elastic network interface, considered compliant. This helps simplify network configuration and reduce complexity.
ecs-instance-ram-role-attached	ECS Instance RAM Role Attached	ROS, Terraform	Ensures that ECS instances have an IAM role attached for secure access to other cloud services.
ecs-internet-charge-type-check	ECS Internet Charge Type Check	ROS, Terraform	Ensures ECS instances use the preferred internet charge type.
ecs-security-group-description-check	Security Group Description Not Empty	ROS, Terraform	Security group description should not be empty. Having a description helps with management and auditing.
ecs-security-group-type-not-normal	Use Enterprise Security Group Type	ROS, Terraform	ECS security group type should not be normal type. Using enterprise security group is considered compliant.
ecs-snapshot-retention-days	ECS auto snapshot retention days meets requirements	ROS, Terraform	ECS auto snapshot policy retention days is greater than the specified number of days, considered compliant. Default value: 7 days.
ecs-system-disk-size-check	ECS System Disk Size Check	ROS, Terraform	Ensures ECS system disks meet the minimum required size.
eip-attached	EIP Attached	ROS, Terraform	Ensures that EIP instances are associated with a resource.
eip-bandwidth-limit	EIP Bandwidth Limit	ROS, Terraform	Ensures EIP bandwidth does not exceed a specified maximum value.
hbase-cluster-type-check	HBase Cluster Engine Type Check	ROS, Terraform	HBase cluster should not use a deprecated engine type.
metadata-ros-composer-check	Template Metadata ALIYUN::ROS::Composer Check	ROS	Template must have Metadata.ALIYUN::ROS::Composer configured. The value must be a dictionary (object).
nas-filesystem-encrypt-type-check	NAS file system encryption configured	ROS, Terraform	Ensures that NAS file systems have encryption enabled (encrypt_type set to 1 or 2).
oss-bucket-referer-limit	OSS Bucket Referer Hotlink Protection	ROS, Terraform	Ensures OSS bucket has referer-based hotlink protection configured.
polardb-cluster-default-time-zone-not-system	PolarDB Cluster Default Time Zone Not System	ROS, Terraform	Ensures PolarDB cluster has parameters configured with explicit timezone settings.
polardb-cluster-maintain-time-check	PolarDB Cluster Maintenance Window Check	ROS, Terraform	Ensures that the PolarDB cluster has a maintenance window configured.
ram-group-has-member-check	RAM Group Has Member	ROS, Terraform	Ensures RAM groups have at least one member.
ram-group-in-use-check	RAM Group In Use Check	ROS, Terraform	Ensures RAM groups are not idle - must have at least one member and at least one attached policy.
ram-policy-in-use-check	RAM Policy In Use Check	ROS, Terraform	Ensures RAM policies are attached to at least one RAM user, group, or role.
ram-user-group-membership-check	RAM User Group Membership Check	ROS, Terraform	Ensures that RAM users belong to at least one group for easier permission management.
ram-user-last-login-expired-check	RAM User Last Login Check	ROS, Terraform	Checks if RAM users have not logged in for a long time.
ram-user-no-policy-check	RAM User Has Policy	ROS, Terraform	Ensures RAM users have at least one policy attached.
rds-instance-maintain-time-check	RDS Instance Maintenance Window Check	ROS, Terraform	Ensures that the RDS instance has a maintenance window configured.
rds-instance-storage-autoscale-enable	RDS Storage Autoscale Enabled	ROS, Terraform	Ensures RDS instances have storage autoscale enabled to prevent downtime due to full disks.
redis-instance-backup-time-check	Redis Instance Backup Window Check	ROS, Terraform	Ensures that the Redis instance has a backup window configured.
root-has-specified-role	Root Account Has Specified Role	ROS	Ensures that the root account has a specified RAM role for governance and management.
slb-backendserver-weight-check	SLB Backend Server Weight Check	ROS, Terraform	Ensures SLB backend servers have reasonable weight configurations.
slb-instance-loadbalancerspec-check	SLB Instance Spec Check	ROS, Terraform	Ensures SLB instances use approved performance specifications.
slb-loadbalancer-bandwidth-limit	SLB Bandwidth Limit	ROS, Terraform	Ensures SLB instance bandwidth does not exceed a specified maximum value.
slb-modify-protection-check	SLB Modification Protection Enabled	ROS, Terraform	Ensures that SLB instances have modification protection enabled.
sls-logstore-hot-ttl-check	SLS Logstore Smart Tier Storage Enabled	ROS, Terraform	Ensures SLS Logstores have intelligent hot/cold tier storage enabled for cost optimization.
vpn-gateway-enabled-ssl-vpn	VPN Gateway SSL-VPN Enabled	ROS, Terraform	Ensures the VPN gateway has SSL-VPN enabled for secure client access.
vpn-ipsec-connection-health-check-open	VPN IPsec Health Check Enabled	ROS, Terraform	Ensures VPN IPsec connections have health checks enabled to detect tunnel failures.