volcengine-compliance

Volcano Engine Compliance Best Practices Assistant

This skill centers on the compliance capabilities of Volcano Engine Configuration Audit (Config), providing users with three things:

1. Compliance recommendations: Based on user requirements, from Volcano Engineofficial built-in compliance package templatesrecommend which compliance baselines to enable (regulations / best practices), and mark which ones are already enabled to avoid duplicate deployment.
2. Compliance overview: Summarize the accountcurrentcompliance posture—aggregate the evaluation results of effective rules/compliance packages (official built-in + user-defined) by compliance category and severity into an overview report.
3. Implement compliance check requirements: When a user comes with a specific check requirement, first look for an existing recommendation in the system templates; if none exists, refer to similar templates, or write a Rego policy from scratch to customize and register the evaluation (see references/writing-config-rules.md）。

Compliance knowledge comes from both Volcano's official built-in baselines and user-created rules; the overview treats them equally, while recommendations target only official baselines.

Quick reference

Item	Description
Applicable scenarios	Compliance check / compliance inspection / compliance best practice recommendations / account compliance posture overview / writing custom compliance rules
Core capabilities	Compliance recommendations (read-only), compliance overview (read-only)
Optional write operations	Deploy recommended templates as compliance packages, register custom rules (confirmation required)
Underlying calls	scripts/compliance.py Wraps ve config <Action>; writing custom rules directly calls ve config

Capability

Capability	What it does	Subcommand	Reference
Compliance recommendations	By standard/keyword/risk level, recommend which ones to enable from official built-in templates, marking those already enabled	recommend	references/recommend.md
Compliance overview	Aggregate the evaluation results of the account's effective rules/compliance packages, producing an overview report by category + severity	overview	references/overview.md
Deploy compliance package	Deploy recommended official templates as compliance packages (write operation, confirmation-gated)	apply	references/apply.md
Write custom rules	Implement a specific compliance check requirement: first look for an existing one in the system templates; if none, write a Rego policy to customize and register the evaluation	None (ve config direct call)	references/writing-config-rules.md

When to use

• When the user asks "Which compliance rules should I enable / I want to meet Level Protection / are there any recommended compliance best practices"—use compliance recommendations.
• When the user asks "Is my Volcano account compliant now / which resources are non-compliant / give me a compliance report"—use the compliance overview.
• When the user comes with a specific check requirement (such as "help me check whether the TOS bucket allows anonymous users write access")—follow references/writing-config-rules.md to first look for an existing template; if none, customize.
• The user message contains "Volcano / Volcano Engine / volcengine" and belongs to a compliance check / configuration audit / Config scenario.

Not applicable: managing the create, delete, and update of a single custom rule, or executing configuration remediation for a specific resource — remediation is an independent action after user confirmation.

Prerequisites

• ve The CLI is installed and authentication is complete (ve configure or VOLCENGINE_ACCESS_KEY / SECRET_KEY). See references/auth.md。
• The compliance overview requires that the account has enabled the **configuration recorder (recorder)** and already has evaluation results; deploying a compliance package likewise depends on the recorder, and if it is not enabled, it can be enabled together after confirmation.
• The caller has read and write permissions for configuration audit on the target account / account group.

Workflow

All actions are completed through scripts/compliance.py (commands are executed relative to the root of this skill directory).

Compliance recommendations (read-only)

python3 scripts/compliance.py recommend                          # 全部官方内置基线
python3 scripts/compliance.py recommend --standard Law           # 只看法规合规（如等保）
python3 scripts/compliance.py recommend --keyword 对象存储        # 按关键词过滤
python3 scripts/compliance.py recommend --risk-level High        # 只看高风险基线

Output candidate baselines (ID / name / category / risk level / how many rule templates are included / whether it is enabled), with those not enabled listed first. For the recommendation criteria and how to choose a baseline, see references/recommend.md。

Compliance overview (read-only)

python3 scripts/compliance.py overview                           # 全量已生效规则
python3 scripts/compliance.py overview --no-detail               # 只看规则级统计，更快
python3 scripts/compliance.py overview --conformance-pack-id <合规包ID>   # 只看某合规包

Produce three artifacts in md / csv / json (stdout returns only a summary + paths), organized bycompliance category sections, and within each section in descending order of severity, with each item labeled with its source (BuiltIn / Custom). For grading and interpretation, see references/overview.md。

Deploy compliance package (write operation, requires confirmation)

# 先 dry-run 看将要创建什么
python3 scripts/compliance.py apply --template-id <模板ID> --name my-baseline --enable-recorder
# 用户明确同意后才真正执行
python3 scripts/compliance.py apply --template-id <模板ID> --name my-baseline --enable-recorder --confirm

--confirm only then is it actually written; without it, it is only a dry-run.--enable-recorder Enable it together when the recorder is not enabled. For deployment details and security boundaries, see references/apply.md。

Resource evaluation after deploymentproceeds asynchronously，apply completion does not mean results are immediately available;overview if it shows no results, wait a while and run it again.

Agent execution flow

1. Determine the request: Does the user want "which ones should be enabled" (recommendations), "is it compliant now" (overview), or "the official coverage is insufficient, so I need to write my own rules" (custom rules)? Single account or account group? Is a specific standard specified (classified protection / best practices)?
2. Check authentication：ve If not logged in, follow references/auth.md for guidance, and do not blindly retry.
3. Recommendation scenario：recommend Show the user the candidate baselines, explain clearly what each one covers and which are already enabled, and suggest enabling the high-risk/uncovered ones first.
4. Deployment (optional): When the user wants to enable it, first apply dry-run to show them,after explicit consentonly then --confirm。
5. Overview scenario：overview then read the markdown artifact, report by category and severity, and discuss Critical/High first.
6. Compliance check request scenario: When the user comes with a specific check request, follow references/writing-config-rules.md first use ListRuleTemplates / recommend to find an existing template; if there is none, then figure out the resource field structure (ListSupportedResourceType → DescribeSupportedResourceTypes / GetResourceConfigHistory), write a Rego policy, self-test locally, and after user confirmation register the rule (after creation, evaluation proceeds automatically and asynchronously).
7. Give remediation suggestions, do not execute remediation on their behalf: Explain clearly what each non-compliant requirement demands and how to change it; remediation of specific resources is left to be executed separately after user confirmation.

Priority grading

Priority	Handling suggestion
Critical	High-risk exposure, requires immediate remediation
High	Handle within a few days to reduce risk
Medium	Schedule for resolution in the next iteration
Low	Track and fix during routine maintenance

(Severity is mapped from the rule risk level: High→Critical, Medium→High, Low→Medium.)

Write operation boundaries (important)

• Read-only：recommend / overview Never changes anything.
• Write operations：apply(deploy compliance package),--enable-recorder(enable recorder) will change the account state, must --confirm only execute with, and the user must explicitly consent before execution. Without --confirm only dry-run.
• Registering custom rules：CreateRuleTemplate / CreateRule is also a write operation; it persists rules in the account, and likewise must only be executed after the user explicitly consents (see references/writing-config-rules.mdfor details). After a rule is created, evaluation is automatically triggered by the platform (asynchronous, with a delay of a few seconds); this skill does not manually call StartRuleEvaluation。
• Remediation: changing specific resource configurations / triggering automatic correctionis not performed within this skill, and is only provided as a remediation suggestion, to be handled separately by the user after confirmation. Compliance "reporting" and "remediation" are strictly separated.

Error handling

Symptom	Handling
ve Not logged in / session expired	Follow references/auth.md to guide login; do not blindly retry
SingleAccountRecorderNotEnabled / OrganizationRecorderNotEnabled	recorder not enabled; use apply --enable-recorder(after confirmation --confirm）
NotFound.ConformancePackTemplate	Template ID is wrong or not visible; re- recommend to get the correct ID
QuotaExceeded.Rule	Insufficient rule quota; reduce the deployment scope or clean up unused rules
apply reports missing required default parameters	Complete InputParameters before deploying
overview No results	No effective rules yet or evaluation in progress; first recommend → apply, or retry later
CreateRuleTemplate reports a policy compilation error	Rego syntax/semantic error; troubleshoot according to references/writing-config-rules.md 's contract and common pitfalls
Custom rule evaluation results do not match expectations	Mostly incorrect assumptions about field paths/case/scalar arrays; use GetResourceConfigHistory to verify the actual snapshot

Compliance best practices (operational recommendations)

• Run the compliance overview regularly (weekly / monthly) to track non-compliance trends and remediation effectiveness.
• Compliance recommendations should prioritize filling inuncoveredregulatory/best-practice baselines, then gradually converge high-risk items.
• Compliance reporting and remediation actions are separated: first produce a report to align on scope, then let the user decide and execute remediation.
• In reports and artifactsmust notcredentials such as AK / SK / Authorization / session token appear.
• When masking resource IDs externally, retain a fixed prefix and abstract the random segment (e.g. i-<id>、cp-<id>、ag-<id>）。