DocsICP FilingConsole
Documentation
Home Page Security Center Developer Reference Call Security Center APIs with Alibaba Cloud CLI

Call Security Center APIs with Alibaba Cloud CLI

Updated at:
Copy as MD
Product
My Favorites

This topic describes how to call Security Center APIs by using Alibaba Cloud CLI. The DescribeCloudCenterInstances operation is used as an example to query asset information.

Background

  • Alibaba Cloud CLI (Alibaba Cloud Command Line Interface) is a general-purpose command-line tool built on OpenAPI. You can use Alibaba Cloud CLI to automate the management and maintenance of Security Center. For more information, see What is Alibaba Cloud CLI.

  • Alibaba Cloud CLI does not support calling Security Center (Threat Analysis) and Security Center (SOAR). To request this support, submit a ticket.

Step 1: Install Alibaba Cloud CLI

Before you use Alibaba Cloud CLI, install it first. Alibaba Cloud CLI supports Windows, Linux, and macOS. Select the installation method based on your operating system.

You can also debug Alibaba Cloud CLI commands in Cloud Shell. Cloud Shell has Alibaba Cloud CLI pre-installed and regularly updates the software version. For more information, see What is Cloud Shell.

Step 2: Configure Alibaba Cloud CLI

Important

An Alibaba Cloud account (root account) has full management and access permissions on all OpenAPI operations, which poses high security risks. We recommend that you create a RAM user, grant permissions based on the principle of least privilege, and use the RAM user to access OpenAPI. For permission policies supported by Security Center, see Security Center system access policy reference and Custom policies for Security Center.

Before you use Alibaba Cloud CLI, configure the identity credential and region ID. Alibaba Cloud CLI supports multiple identity credentials. For more information, see Configure and manage credentials. You can configure an AK-type identity credential by using the AccessKey of a RAM user. Perform the following steps:

  • Create a RAM user and create an AccessKey for configuring identity credentials. For more information, see Create a RAM user and Create an AccessKey.

  • Grant permissions to the RAM user. This example requires the read-only access permission on Security Center: AliyunYundunSASReadOnlyAccess. For more information, see Manage RAM user permissions.

  • Obtain an available region ID for configuring identity credentials. Alibaba Cloud CLI uses the specified region to initiate OpenAPI calls. For available regions of Security Center, see Endpoints.

    Note

    You can use the --region option to specify a region when running a command. This option overrides the region information in the default identity credential and environment variables. For more information, see Command-line options.

  • Configure an AK-type credential by using the AccessKey of the RAM user. Name the configuration file AkProfile. For more information, see Configure and manage credentials.

Step 3: Generate CLI command examples

  • In the OpenAPI portal, go to DescribeCloudCenterInstances debugging page.

  • In Parameters, specify the request parameters. Click the CLI Sample tab to view the generated CLI example.

  • Copy the CLI example or run it in Cloud Shell:

    • Click Run Command image to open Cloud Shell and debug the command.

    • Click Copy image to copy the CLI example to the clipboard. You can then paste it into a local shell tool to run or write a command-line script.

    Note

    When you copy a CLI example to a local shell tool for debugging, pay attention to the parameter format. For more information about CLI command parameter formats, see Understand command parameters.

    The OpenAPI portal adds the --region option to generated examples by default. When you copy the command to run locally, Alibaba Cloud CLI ignores the region information in the default identity credential and environment variables. It uses the specified region instead. You can delete or keep the option as needed.

Step 4: Call Security Center OpenAPI

Example 1: List Security Center OpenAPI operations supported by Alibaba Cloud CLI

The following example shows how to use the --help option to list Security Center OpenAPI operations supported by Alibaba Cloud CLI. For more information, see API overview.

  1. Run the following command.

    aliyun sas --help

  2. Sample response.

    Product: Sas (Security Center)
Version: 2018-12-03
Available Api List:
    AddAssetSelectionCriteria          Adds assets to an asset selection operation.
    AddBaselineCheckWhiteRecord
    AddCheckInstanceResultWhiteList    Adds instances to the allowlist for a check item.
    AddCheckResultWhiteList            Adds a check item to the allowlist.
    AddClientUserDefineRule            Creates a user-defined defense rule.
    AddCloudVendorAccountAK
    AddContainerDefenseRule            Creates a non-image program defense rule.
    AddContainerPluginRule             Adds a container escape prevention rule.
    AddIdcProbe
    AddImageEventOperation             Adds an image alert handling rule.
    AddImageVulWhiteList               Adds an image vulnerability to the allowlist.
    AddInstallCode                     Creates an agent installation command.

Example 2: Query asset information

The following example shows how to use Alibaba Cloud CLI to call the DescribeCloudCenterInstances operation of Security Center to query Elastic Compute Service (ECS) asset information with risks.

  1. Run the following command.

    aliyun sas DescribeCloudCenterInstances --Criteria '[{"name":"riskStatus","value":"YES"}]' --MachineTypes ecs

  2. Sample response.

    {
  "Success": true,
  "PageInfo": {
    "Count": 10,
    "CurrentPage": 1,
    "PageSize": 20,
    "TotalCount": 10,
    "NextToken": "B604532DEF982B875E8360A6EFA3B***"
  },
  "RequestId": "7D6FD965-745C-5580-A3E8-83FEC3BE1FE8",
  "Instances": [
    {
      "AlarmStatus": "NO",
      "AssetType": "0",
      "AssetTypeName": "ECS Instance",
      "AuthVersionName": "Basic Edition",
      "Bind": false,
      "ClientStatus": "online",
      "Cores": 4,
      "CpuInfo": "Intel(R) Xeon(R) Platinum 8269CY CPU @ 2.50GHz",
      "ExposedStatus": 0,
      "Flag": 0,
      "FlagName": "ALIYUN",
      "GroupId": 1355****,
      "GroupTrace": "Ungrouped",
      "HcStatus": "YES",
      "HealthCheckCount": 0,
      "Importance": 1,
      "InstanceId": "i-bp1b84nxki0g2cyg****",
      "InstanceName": "example",
      "InternetIp": "",
      "IntranetIp": "172.16.****",
      "Ip": "172.16.****",
      "IpListString": "172.16.****",
      "Kernel": "5.10.134-16.3.al8.x86_64",
      "LastLoginTimestamp": 1729840886000,
      "MacListString": "00:16:3e:**:**:**",
      "Mem": 16384,
      "Os": "linux",
      "OsName": "Alibaba Cloud Linux 3.2104 LTS 64-bit",
      "Region": "cn-hangzhou-dg-a01",
      "RegionId": "cn-hangzhou",
      "RegionName": "China (Hangzhou)",
      "RiskCount": "{\"account\":0,\"agentlessAll\":0,\"agentlessBaseline\":0,\"agentlessMalicious\":0,\"agentlessSensitiveFile\":0,\"agentlessVulCve\":0,\"agentlessVulSca\":0,\"agentlessVulSys\":0,\"appNum\":0,\"asapVulCount\":0,\"baselineHigh\":0,\"baselineLow\":0,\"baselineMedium\":0,\"baselineNum\":1,\"cmsNum\":0,\"containerAsap\":0,\"containerLater\":0,\"containerNntf\":0,\"containerRemind\":0,\"containerSerious\":0,\"containerSuspicious\":0,\"cveNum\":4,\"emgNum\":0,\"health\":0,\"imageBaselineHigh\":0,\"imageBaselineLow\":0,\"imageBaselineMedium\":0,\"imageBaselineNum\":0,\"imageMaliciousFileRemind\":0,\"imageMaliciousFileSerious\":0,\"imageMaliciousFileSuspicious\":0,\"imageVulAsap\":0,\"imageVulLater\":0,\"imageVulNntf\":0,\"laterVulCount\":1,\"newSuspicious\":0,\"nntfVulCount\":3,\"remindNum\":0,\"scaNum\":0,\"seriousNum\":0,\"suspNum\":0,\"suspicious\":0,\"sysNum\":0,\"trojan\":0,\"uuid\":\"11c50347-4745-4a7a-b8dd-405f276201ff\",\"vul\":4,\"weakPWNum\":0}",
      "RiskStatus": "YES",
      "SafeEventCount": 0,
      "Status": "Running",
      "Uuid": "11c50347-4745-4a7a-b8dd-405f****",
      "Vendor": 0,
      "VendorName": "ALIYUN",
      "VpcInstanceId": "vpc-bp132a80775r3d7kz****",
      "VulCount": 4,
      "VulStatus": "YES"
    }
  ]
}
    Note

    If calling Security Center OpenAPI returns an error, check the request parameters and their values based on the error code.

    You can also record the RequestID or SDK error message from the response and use Alibaba Cloud OpenAPI Diagnostics for self-service troubleshooting.

Previous：Public error codesNext：Support