什么是自定義函數(shù)規(guī)則

自定義函數(shù)規(guī)則是配置審計通過函數(shù)計算服務(wù)的函數(shù)來承載規(guī)則代碼的自定義規(guī)則。

應(yīng)用場景

當(dāng)配置審計預(yù)置的規(guī)則模板和條件規(guī)則均不能滿足檢測資源合規(guī)性的需求時，您可以通過編寫函數(shù)代碼，完成復(fù)雜場景的合規(guī)檢測。更多場景和代碼示例，請參見自定義函數(shù)規(guī)則示例庫。

運行原理

基于函數(shù)計算創(chuàng)建自定義規(guī)則的運行原理如下圖所示。

基于函數(shù)計算創(chuàng)建自定義規(guī)則運行原理的說明如下：

1. 在函數(shù)計算中創(chuàng)建函數(shù)。

2. 在配置審計中基于函數(shù)計算創(chuàng)建自定義規(guī)則，并自動觸發(fā)評估。

   說明

   當(dāng)您創(chuàng)建規(guī)則后，配置審計會自動觸發(fā)一次評估。

3. 配置審計通過配置審計服務(wù)關(guān)聯(lián)角色（AliyunServiceRoleForConfig）獲取GetFunction和InvokeFunction接口的權(quán)限。

4. 配置審計調(diào)用InvokeFunction接口執(zhí)行函數(shù)，獲取資源配置和規(guī)則信息。

5. 函數(shù)執(zhí)行對資源的評估。

6. 函數(shù)計算通過PutEvaluations接口將資源評估結(jié)果返回給配置審計。

   配置審計對資源評估結(jié)果進行保存并在控制臺展示，以便查看。您還可以對不合規(guī)資源進行修正，或設(shè)置將資源數(shù)據(jù)投遞到對應(yīng)云服務(wù)。

函數(shù)代碼

# # !/usr/bin/env python
# # -*- encoding: utf-8 -*-
import json
import logging

from aliyunsdkcore.client import AcsClient
from aliyunsdkcore.request import CommonRequest


logger = logging.getLogger()
# 資源的合規(guī)類型。
COMPLIANCE_TYPE_COMPLIANT = 'COMPLIANT'
COMPLIANCE_TYPE_NON_COMPLIANT = 'NON_COMPLIANT'
COMPLIANCE_TYPE_NOT_APPLICABLE = 'NOT_APPLICABLE'
# 資源配置的推送類型。
CONFIGURATION_TYPE_COMMON = 'COMMON'
CONFIGURATION_TYPE_OVERSIZE = 'OVERSIZE'
CONFIGURATION_TYPE_NONE = 'NONE'


# 入口函數(shù)，完成業(yè)務(wù)邏輯編排和處理。
def handler(event, context):
    """
    處理函數(shù)
    :param event：事件
    :param context：上下文
    :return：評估結(jié)果
    """
    # 校驗Event，代碼可直接復(fù)制。
    evt = validate_event(event)
    if not evt:
        return None
    creds = context.credentials
    rule_parameters = evt.get('ruleParameters')
    result_token = evt.get('resultToken')
    invoking_event = evt.get('invokingEvent')
    ordering_timestamp = evt.get('orderingTimestamp')

    # 資源的配置信息。規(guī)則觸發(fā)機制需要設(shè)置為配置變更。當(dāng)您新建規(guī)則或手動執(zhí)行規(guī)則時，配置審計會逐個調(diào)用函數(shù)觸發(fā)對所有資源的評估。如果資源配置發(fā)生變更，配置審計根據(jù)變更的資源信息自動調(diào)用函數(shù)觸發(fā)一次資源評估。
    configuration_item = invoking_event.get('configurationItem')
    account_id = configuration_item.get('accountId')
    resource_id = configuration_item.get('resourceId')
    resource_type = configuration_item.get('resourceType')
    region_id = configuration_item.get('regionId')

    # 判斷當(dāng)前推送的資源配置信息是否大于等于配置（100 KB），如果是，則需要調(diào)用GetDiscoveredResource查詢資源詳情。
    configuration_type = invoking_event.get('configurationType')
    if configuration_type and configuration_type == CONFIGURATION_TYPE_OVERSIZE:
        resource_result = get_discovered_resource(creds, resource_id, resource_type, region_id)
        resource_json = json.loads(resource_result)
        configuration_item["configuration"] = resource_json["DiscoveredResourceDetail"]["Configuration"]

    # 對資源進行評估，需要根據(jù)實際業(yè)務(wù)自行實現(xiàn)評估邏輯，以下代碼僅供參考。
    compliance_type, annotation = evaluate_configuration_item(
        rule_parameters, configuration_item)

    # 設(shè)置評估結(jié)果，格式需符合以下示例要求。
    evaluations = [
        {
            'accountId': account_id,
            'complianceResourceId': resource_id,
            'complianceResourceType': resource_type,
            'complianceRegionId': region_id,
            'orderingTimestamp': ordering_timestamp,
            'complianceType': compliance_type,
            'annotation': annotation
        }
    ]

    # 返回評估結(jié)果并寫入配置審計，代碼可直接復(fù)制。
    put_evaluations(creds, result_token, evaluations)
    return evaluations


# 根據(jù)規(guī)則信息和資源配置進行評估。需要根據(jù)實際業(yè)務(wù)自行實現(xiàn)評估邏輯，以下代碼僅供參考。
def evaluate_configuration_item(rule_parameters, configuration_item):
    """
    評估邏輯
    :param rule_parameters：規(guī)則信息
    :param configuration_item：資源配置
    :return：評估類型
    """
    # 初始化返回值
    compliance_type = COMPLIANCE_TYPE_NON_COMPLIANT
    annotation = None

    # 獲取資源配置完整信息
    full_configuration = configuration_item['configuration']
    if not full_configuration:
        annotation = 'Configuration is empty.'
        return compliance_type, annotation

    # 轉(zhuǎn)換為JSON
    configuration = parse_json(full_configuration)
    if not configuration:
        annotation = 'Configuration:{} is invalid.'.format(full_configuration)
        return compliance_type, annotation
    return compliance_type, annotation


def validate_event(event):
    """
    校驗Event
    :param event：Event
    :return：JSON對象
    """
    if not event:
        logger.error('Event is empty.')
    evt = parse_json(event)
    logger.info('Loading event: %s .' % evt)

    if 'resultToken' not in evt:
        logger.error('ResultToken is empty.')
        return None
    if 'ruleParameters' not in evt:
        logger.error('RuleParameters is empty.')
        return None
    if 'invokingEvent' not in evt:
        logger.error('InvokingEvent is empty.')
        return None
    return evt


def parse_json(content):
    """
    JSON類型轉(zhuǎn)換
    :param content：JSON字符串
    :return：JSON對象
    """
    try:
        return json.loads(content)
    except Exception as e:
        logger.error('Parse content:{} to json error:{}.'.format(content, e))
        return None


# 返回評估結(jié)果，并寫入配置審計，代碼可直接復(fù)制。
def put_evaluations(creds, result_token, evaluations):
    """
    調(diào)用API返回并寫入評估結(jié)果。
    :param context：函數(shù)計算上下文
    :param result_token：回調(diào)令牌
    :param evaluations：評估結(jié)果
    :return: None
    """
    # 需具備權(quán)限AliyunConfigFullAccess的函數(shù)計算FC的服務(wù)角色。
    client = AcsClient(creds.access_key_id, creds.access_key_secret, region_id='cn-shanghai')

    # 新建Request，并設(shè)置參數(shù)，Domain為config.cn-shanghai.aliyuncs.com。
    request = CommonRequest()
    request.set_domain('config.cn-shanghai.aliyuncs.com')
    request.set_version('2019-01-08')
    request.set_action_name('PutEvaluations')
    request.add_body_params('ResultToken', result_token)
    request.add_body_params('Evaluations', evaluations)
    request.add_body_params('SecurityToken', creds.security_token)
    request.set_method('POST')

    try:
        response = client.do_action_with_exception(request)
        logger.info('PutEvaluations with request: {}, response: {}.'.format(request, response))
    except Exception as e:
        logger.error('PutEvaluations error: %s' % e)


# 獲取資源詳情，代碼可直接復(fù)制。
def get_discovered_resource(creds, resource_id, resource_type, region_id):
    """
    調(diào)用API獲取資源配置詳情
    :param context：函數(shù)計算上下文
    :param resource_id：資源ID
    :param resource_type：資源類型
    :param region_id：資源所屬地域ID
    :return: 資源詳情
    """
    # 需具備權(quán)限AliyunConfigFullAccess的函數(shù)計算FC的服務(wù)角色。
    client = AcsClient(creds.access_key_id, creds.access_key_secret, region_id='cn-shanghai')

    request = CommonRequest()
    request.set_domain('config.cn-shanghai.aliyuncs.com')
    request.set_version('2020-09-07')
    request.set_action_name('GetDiscoveredResource')
    request.add_query_param('ResourceId', resource_id)
    request.add_query_param('ResourceType', resource_type)
    request.add_query_param('Region', region_id)
    request.add_query_param('SecurityToken', creds.security_token)
    request.set_method('GET')

    try:
        response = client.do_action_with_exception(request)
        resource_result = str(response, encoding='utf-8')
        return resource_result
    except Exception as e:
        logger.error('GetDiscoveredResource error: %s' % e)
        

函數(shù)入?yún)?/b>

函數(shù)計算的函數(shù)入?yún)ㄙY源配置和規(guī)則信息兩部分。資源配置信息保存在configurationItem中，規(guī)則的入?yún)⑿畔⒈４嬖?code data-tag="code" code-type="xCode" class="code">ruleParameters中。配置審計向函數(shù)計算推送的內(nèi)容因規(guī)則的觸發(fā)機制而不同，具體如下：

• 當(dāng)規(guī)則的觸發(fā)機制僅設(shè)置為周期執(zhí)行時，配置審計不會推送資源配置信息至函數(shù)計算。

  當(dāng)新創(chuàng)建規(guī)則初次執(zhí)行、規(guī)則周期自動執(zhí)行和規(guī)則手動觸發(fā)執(zhí)行時，配置審計只會推送一條不包含資源配置信息的記錄，JSON示例如下：

  {
      "orderingTimestamp": 1716365226714,
      "invokingEvent": {
          "accountId": 120886317861****,
          "messageType": "ScheduledNotification",
          "notificationCreationTimestamp": 1716365226714,
          "configurationType": "NONE"
      },
      "ruleParameters": {
          "CpuCount": "2"
      },
      "resultToken": "HLQr3BZx/C+DLjwudFcYdXxZFPF2HnGqlg1uHceZ5kDEFeQF2K5LZGofyhn+GE4NP5VgkwANUH3qcdeSjWwODk1ymtmLWLzFV4JForVWYIKdbwwhbDBOgVwF7Ov9c3uVCNz/KpxNElwhTzMkZB95U1vmLs4vUYXuB/Txw4jiCYBYZZnVumhwXWswTLvAhIe5Y451FckObyM3I47AaB+4KtDW3I5q8O+Kx7eSYkqqGTawmJEYjvWXz9CHHMLFtNYyJX54a35mpVdxFSvgeXYDJTStxqb+d9UH/162fZh7T78OHxpQZgl8bcXzZhml****"
  }

• 當(dāng)規(guī)則的觸發(fā)機制包括配置變更時，配置審計會推送資源配置信息至函數(shù)計算。

  當(dāng)新創(chuàng)建規(guī)則初次執(zhí)行、規(guī)則周期自動執(zhí)行和規(guī)則手動觸發(fā)執(zhí)行時，配置審計會將資源配置信息逐條推送至函數(shù)計算。當(dāng)新增資源或已有資源發(fā)生變化時，配置審計僅將變更的單個資源配置信息推送至函數(shù)計算，JSON示例如下：

  {
      "orderingTimestamp":1695786337959,
      "invokingEvent":{
          "accountId":120886317861****,
          "messageType":"Manual",
          "notificationCreationTimestamp":1695786337959,
          "configurationType":"COMMON",
          "configurationItem":{
              "accountId":120886317861****,
              "arn":"acs:ecs:ap-southeast-1:120886317861****:instance/i-t4n0vr6x7v54jdbu****",
              "availabilityZone":"ap-southeast-1a",
              "regionId":"ap-southeast-1",
              "configuration":"{\\"ResourceGroupId\\":\\"\\",\\"Memory\\":4096,\\"InstanceChargeType\\":\\"PostPaid\\",\\"Cpu\\":2,\\"OSName\\":\\"Alibaba Cloud Linux  3.2104 LTS 64\xe4\xbd\x8d\\",\\"InstanceNetworkType\\":\\"vpc\\",\\"InnerIpAddress\\":{\\"IpAddress\\":[]},\\"ExpiredTime\\":\\"2099-12-31T15:59Z\\",\\"ImageId\\":\\"aliyun_3_x64_20G_alibase_20230727.vhd\\",\\"EipAddress\\":{\\"AllocationId\\":\\"\\",\\"IpAddress\\":\\"\\",\\"InternetChargeType\\":\\"\\"},\\"ImageOptions\\":{},\\"VlanId\\":\\"\\",\\"HostName\\":\\"iZt4n0vr6x7v54jdbuk****\\",\\"Status\\":\\"Running\\",\\"HibernationOptions\\":{\\"Configured\\":false},\\"MetadataOptions\\":{\\"HttpTokens\\":\\"\\",\\"HttpEndpoint\\":\\"\\"},\\"InstanceId\\":\\"i-t4n0vr6x7v54jdbu****\\",\\"StoppedMode\\":\\"Not-applicable\\",\\"CpuOptions\\":{\\"ThreadsPerCore\\":2,\\"Numa\\":\\"ON\\",\\"CoreCount\\":1},\\"StartTime\\":\\"2023-08-18T09:02Z\\",\\"DeletionProtection\\":false,\\"VpcAttributes\\":{\\"PrivateIpAddress\\":{\\"IpAddress\\":[\\"192.168.XX.XX\\"]},\\"VpcId\\":\\"vpc-t4nmwd0l9a7aj09yr****\\",\\"VSwitchId\\":\\"vsw-t4njclm0dlz2szayi****\\",\\"NatIpAddress\\":\\"\\"},\\"SecurityGroupIds\\":{\\"SecurityGroupId\\":[\\"sg-t4n5pulxj2lvechw****\\"]},\\"InternetChargeType\\":\\"PayByTraffic\\",\\"InstanceName\\":\\"zs-test-peer****\\",\\"DeploymentSetId\\":\\"\\",\\"InternetMaxBandwidthOut\\":0,\\"SerialNumber\\":\\"8c3fadf7-2ea1-4486-84ce-7784aeb7****\\",\\"OSType\\":\\"linux\\",\\"CreationTime\\":\\"2023-08-18T09:02Z\\",\\"AutoReleaseTime\\":\\"\\",\\"Description\\":\\"\\",\\"InstanceTypeFamily\\":\\"ecs.c7\\",\\"DedicatedInstanceAttribute\\":{\\"Tenancy\\":\\"\\",\\"Affinity\\":\\"\\"},\\"PublicIpAddress\\":{\\"IpAddress\\":[]},\\"GPUSpec\\":\\"\\",\\"NetworkInterfaces\\":{\\"NetworkInterface\\":[{\\"Type\\":\\"Primary\\",\\"PrimaryIpAddress\\":\\"192.168.XX.XX\\",\\"MacAddress\\":\\"00:16:3e:04:XX:XX\\",\\"NetworkInterfaceId\\":\\"eni-t4n16tmnpp794y1o****\\",\\"PrivateIpSets\\":{\\"PrivateIpSet\\":[{\\"PrivateIpAddress\\":\\"192.168.XX.XX\\",\\"Primary\\":true}]}}]},\\"SpotPriceLimit\\":0.0,\\"SaleCycle\\":\\"\\",\\"DeviceAvailable\\":true,\\"InstanceType\\":\\"ecs.c7.large\\",\\"OSNameEn\\":\\"Alibaba Cloud Linux  3.2104 LTS 64 bit\\",\\"SpotStrategy\\":\\"NoSpot\\",\\"IoOptimized\\":true,\\"ZoneId\\":\\"ap-southeast-1a\\",\\"ClusterId\\":\\"\\",\\"EcsCapacityReservationAttr\\":{\\"CapacityReservationPreference\\":\\"\\",\\"CapacityReservationId\\":\\"\\"},\\"DedicatedHostAttribute\\":{\\"DedicatedHostId\\":\\"\\",\\"DedicatedHostName\\":\\"\\",\\"DedicatedHostClusterId\\":\\"\\"},\\"GPUAmount\\":0,\\"OperationLocks\\":{\\"LockReason\\":[]},\\"InternetMaxBandwidthIn\\":-1,\\"Recyclable\\":false,\\"RegionId\\":\\"ap-southeast-1\\",\\"CreditSpecification\\":\\"\\"}",
              "captureTime":1695786337959,
              "resourceCreateTime":1692349320000,
              "resourceId":"i-t4n0vr6x7v54jdbu****",
              "resourceName":"zs-test-peer****",
              "resourceGroupId":"rg-acfmw3ty5y7****",
              "resourceType":"ACS::ECS::Instance",
              "tags":"{}"
          }
      },
      "ruleParameters":{
          "CpuCount":"2"
      },
      "resultToken":"HLQr3BZx/C+DLjwudFcYdXxZFPF2HnGqlg1uHceZ5kDEFeQF2K5LZGofyhn+GE4NP5VgkwANUH3qcdeSjWwODk1ymtmLWLzFV4JForVWYIKdbwwhbDBOgVwF7Ov9c3uVCNz/KpxNElwhTzMkZB95U1vmLs4vUYXuB/Txw4jiCYBYZZnVumhwXWswTLvAhIe5Y451FckObyM3I47AaB+4KtDW3I5q8O+Kx7eSYkqqGTawmJEYjvWXz9CHHMLFtNYyJX54a35mpVdxFSvgeXYDJTStxqb+d9UH/162fZh7T78OHxpQZgl8bcXzZhml****"
  }

  當(dāng)推送的資源配置信息大于等于100 KB時，配置審計只推送資源的摘要信息，不包含資源配置的configuration字段，JSON示例如下：

  說明

  當(dāng)您需要獲取完整的資源配置信息時，可調(diào)用接口GetDiscoveredResource。

  {
      "orderingTimestamp":1695786337959,
      "invokingEvent":{
          "accountId":120886317861****,
          "messageType":"Manual",
          "notificationCreationTimestamp":1695786337959,
          "configurationType":"OVERSIZE",
          "configurationItem":{
              "accountId":120886317861****,
              "arn":"acs:ecs:ap-southeast-1:120886317861****:instance/i-t4n0vr6x7v54jdbu****",
              "availabilityZone":"ap-southeast-1a",
              "regionId":"ap-southeast-1",
              "captureTime":1695786337959,
              "resourceCreateTime":1692349320000,
              "resourceId":"i-t4n0vr6x7v54jdbu****",
              "resourceName":"zs-test-peer****",
              "resourceGroupId":"rg-acfmw3ty5y7****",
              "resourceType":"ACS::ECS::Instance",
              "tags":"{}"
          }
      },
      "ruleParameters":{
          "CpuCount":"2"
      },
      "resultToken":"HLQr3BZx/C+DLjwudFcYdXxZFPF2HnGqlg1uHceZ5kDEFeQF2K5LZGofyhn+GE4NP5VgkwANUH3qcdeSjWwODk1ymtmLWLzFV4JForVWYIKdbwwhbDBOgVwF7Ov9c3uVCNz/KpxNElwhTzMkZB95U1vmLs4vUYXuB/Txw4jiCYBYZZnVumhwXWswTLvAhIe5Y451FckObyM3I47AaB+4KtDW3I5q8O+Kx7eSYkqqGTawmJEYjvWXz9CHHMLFtNYyJX54a35mpVdxFSvgeXYDJTStxqb+d9UH/162fZh7T78OHxpQZgl8bcXzZhml****"
  }

函數(shù)入?yún)⒌姆诸惣捌渲饕獏?shù)說明如下表所示。