How to create a scan task in Data Security Center-Data Management-阿里云帮助中心

Data Security Guard periodically assesses the security of your data assets from multiple perspectives and generates security reports. You can use these reports to resolve issues or make optimizations to improve the security of your data assets. This topic describes how to create scan tasks and security templates in Data Security Guard.

Prerequisites

The instances that you want to scan must be ApsaraDB RDS instances.

Create a scan task

Note

The following steps use the Data Management (DMS) console as an example. Alternatively, you can log on to the ApsaraDB RDS console. In the navigation pane on the left, choose Data Security. On the Security Assessment > Scan Tasks tab, create a scan task.

Log in to DMS 5.0.
Click the icon in the upper-left corner of the console and select All Features > Security and Specifications (DBS) > Database Security Center.

Note
If you are using the console in non-simple mode, select Security and Specifications (DBS) > Database Security Center from the top navigation bar.
On the Data Security Guard page, go to the Scan Tasks tab and click Create Task.

On the Create Task page, configure the following parameters.

Configuration item	Required	Description
Task Name	Yes	The name of the scan task. This helps you find the task later.
Select Instances	Yes	The instances to be scanned by the task. Valid values: All Instances: All instances that are in the Running state under your Alibaba Cloud account. Custom (multiple selections supported): Select the instances to be scanned. Single Instance:
Security Template	Yes	A security template is a collection of check items. Check items define the perspectives from which to assess the security of instance resources, such as IP address whitelists and whether SSL encryption in transit is enabled. You can select a built-in template, such as Engine Security Template, Compliance/Cryptography Assessment Template, or Single-instance Engine Security Template, or a custom security template. For more information about security templates, see Security templates.
Scan Schedule	Yes	When to start the scan task. Valid values: Scan Now: The scan starts immediately after the task is created. Scheduled Scan: Select a specific date and time to start the scan. Periodic Scan: Select a weekly or monthly cycle to scan the instances repeatedly.
Remarks	No	A description of the scan task.

Click Create Task.
For Scan Now or Scheduled Scan tasks, the scan is considered successful when the task Status changes to Completed.
A Periodic Scan task scans instances multiple times. The task Status remains Pending before and after each scan. In this case, a scan is considered successful if a security report is generated.
Note
- A scan of a single instance takes approximately 5 seconds. The actual duration may vary.
- The scan duration is proportional to the number of instances being scanned.
- The scan operation does not affect the scanned instances.

Security templates

DMS provides three built-in security templates. You can also create custom security templates.

Built-in templates

Security Template Name	Security Features	Scan Scope
Engine Security Template	IP address whitelist, security group, DDoS attack protection, instance release protection, SSL encryption in transit, and storage encryption.	Multiple instances
Compliance/Cryptography Assessment Template	IP address whitelist, security group, DDoS attack protection, instance release protection, SSL encryption in transit, storage encryption, DBAudit, and Database Backup.	Multiple instances
Single-instance Engine Template	IP address whitelist, security group, DDoS attack protection, instance release protection, SSL encryption in transit, storage encryption, and account protection.	Single instance

Create a template

On the Data Security Guard page in DMS, go to the Security Templates tab and click Create Template.
Enter parameters such as Template Name and Template Scan Items, and then click Create.
The new security template appears in the list of templates.
(Optional) You can edit or delete a custom security template.
To do so, click Edit or Delete on the template card.

View or download reports

View a report: On the Scan Tasks or Scan Reports tab, find the desired task and click View Report in the Actions column to view the scan results.
Download a report: On the Report Details page, you can download the scan report in PDF or PNG format.