diff --git a/pkg/compute/guestdrivers/aliyun.go b/pkg/compute/guestdrivers/aliyun.go
index 9477c541f6..a58b046b80 100644
--- a/pkg/compute/guestdrivers/aliyun.go
+++ b/pkg/compute/guestdrivers/aliyun.go
@@ -9,6 +9,7 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/pkg/util/compare"
 	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
@@ -264,13 +265,47 @@ func (self *SAliyunGuestDriver) OnGuestDeployTaskDataReceived(ctx context.Contex
 
 func (self *SAliyunGuestDriver) RequestSyncConfigOnHost(ctx context.Context, guest *models.SGuest, host *models.SHost, task taskman.ITask) error {
 	taskman.LocalTaskRun(task, func() (jsonutils.JSONObject, error) {
-		if fw_only, _ := task.GetParams().Bool("fw_only"); fw_only {
-			if ihost, err := host.GetIHost(); err != nil {
-				return nil, err
-			} else if iVM, err := ihost.GetIVMById(guest.ExternalId); err != nil {
-				return nil, err
-			} else if err := iVM.SyncSecurityGroup(guest.SecgrpId, guest.GetSecgroupName(), guest.GetSecRules()); err != nil {
-				return nil, err
+		if ihost, err := host.GetIHost(); err != nil {
+			return nil, err
+		} else if iVM, err := ihost.GetIVMById(guest.ExternalId); err != nil {
+			return nil, err
+		} else {
+			if fw_only, _ := task.GetParams().Bool("fw_only"); fw_only {
+				if err := iVM.SyncSecurityGroup(guest.SecgrpId, guest.GetSecgroupName(), guest.GetSecRules()); err != nil {
+					return nil, err
+				}
+			} else {
+				iVM.Refresh()
+				if iDisks, err := iVM.GetIDisks(); err != nil {
+					return nil, err
+				} else {
+					disks := make([]models.SDisk, 0)
+					for _, guestdisk := range guest.GetDisks() {
+						disk := guestdisk.GetDisk()
+						disks = append(disks, *disk)
+					}
+
+					added := make([]models.SDisk, 0)
+					commondb := make([]models.SDisk, 0)
+					commonext := make([]cloudprovider.ICloudDisk, 0)
+					removed := make([]cloudprovider.ICloudDisk, 0)
+
+					if err := compare.CompareSets(disks, iDisks, &added, &commondb, &commonext, &removed); err != nil {
+						return nil, err
+					}
+					// for _, disk := range removed {
+					// 	log.Errorf("need remove %v", disk)
+					// 	if err := iVM.DetachDisk(disk.GetId()); err != nil {
+					// 		return nil, err
+					// 	}
+					// }
+					// for _, disk := range added {
+					// 	log.Errorf("need add %v", disk)
+					// 	if err := iVM.AttachDisk(disk.ExternalId); err != nil {
+					// 		return nil, err
+					// 	}
+					// }
+				}
 			}
 		}
 		return nil, nil
diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go
index c12f0e4221..49eef954de 100644
--- a/pkg/compute/models/guests.go
+++ b/pkg/compute/models/guests.go
@@ -1547,6 +1547,17 @@ func (self *SGuest) AllowPerformAttachdisk(ctx context.Context, userCred mcclien
 }
 
 func (self *SGuest) ValidateAttachDisk(ctx context.Context, disk *SDisk) error {
+	storage := disk.GetStorage()
+	if provider := storage.GetCloudprovider(); provider != nil {
+		host := self.GetHost()
+		if provider.Id != host.ManagerId {
+			return httperrors.NewInputParameterError("Disk %s and guest not belong to the same account", disk.Name)
+		} else if storage.ZoneId != host.ZoneId {
+			return httperrors.NewInputParameterError("Disk %s and guest not belong to the same zone", disk.Name)
+		}
+		return nil
+	}
+
 	if disk.isAttached() {
 		return httperrors.NewInputParameterError("Disk %s has been attached", disk.Name)
 	} else if len(disk.GetPathAtHost(self.GetHost())) == 0 {