Grant system and custom RAM policies to Security Center users-Security Center(Security Center)-阿里云帮助中心

To implement fine-grained permission management for RAM users who use Security Center features, you can grant system policies or custom policies to the RAM users. This topic describes how to grant system policies and custom policies to RAM users to implement fine-grained permission management.

Policy types

Alibaba Cloud Resource Access Management (RAM) provides default system policies for cloud services and supports custom policies. System policies are created by Alibaba Cloud and cannot be modified. You can use custom policies to precisely control RAM user access to and operations on Security Center.

Note

The default policies supported by Security Center are AliyunYundunSASFullAccess (allows RAM users to perform operations on all Security Center features) and AliyunYundunSASReadOnlyAccess (allows RAM users read-only access to all Security Center data).

Create a RAM user

For more information, see Create a RAM user.

Grant a system policy to a RAM user

Alibaba Cloud provides system policies for User Center and for accessing or managing Security Center. If a RAM user is prompted with No Permission when the RAM user purchases, renews, or unsubscribes from Security Center instances, or with No Permission. Check Your Permissions. when the RAM user accesses Security Center, you can grant the corresponding system policies to the RAM user by following these steps.

Important

User Center system policies apply to all cloud products. After you grant User Center-related system policies to a RAM user, the RAM user has the permissions to purchase, renew, and unsubscribe from all cloud products.

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the RAM user that you created, and in the Actions column, click Attach Policy.
You can also select multiple RAM users and click Attach Policy below the user list to grant permissions to multiple RAM users at a time.

In the Attach Policy panel, grant permissions to the RAM user.

Resource scope:
1. Account level: The permissions take effect on all resources within the current Alibaba Cloud account. This option is suitable for general scenarios that do not require permission isolation by resource group.
2. Resource group level: The permissions take effect only within the specified resource group. This option is suitable for scenarios in which multiple teams share an Alibaba Cloud account and permissions must be isolated by resource group. If a RAM user is granted resource group-level permissions, the RAM user must switch the resource scope to the authorized resource group in the top navigation bar after the RAM user logs on to the console. This way, the RAM user can properly access and manage resources in the resource group.
  Note
  1. The system automatically marks high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. These policies typically contain full control permissions on all cloud resources or full management permissions on Resource Access Management (RAM). Grant these policies with caution.
  2. For more information about resource group authorization, see Control RAM user access to specific ECS instances.
Principal: The principal is the RAM user to which you want to add permissions. The system automatically selects the current RAM user.

Select the system policy based on the scenario and click Confirm.

Scenario	System policy
Purchase, renew, or unsubscribe from Security Center instances	AliyunBSSOrderAccess、AliyunBSSRefundAccess
Read-only access to Security Center	AliyunYundunSASReadOnlyAccess
Manage Security Center	AliyunYundunSASFullAccess

Review the authorization result and click Close.

Grant a custom policy to a RAM user

Perform the following steps to use custom policies to precisely control RAM user access to and operations on Security Center.

Step 1: Create a custom policy for Security Center

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.

On the Create Policy page, click the JSON tab. Common script examples are as follows:

Renewal and refund

Scenario	Script configuration
Query the prices for auto-renewal (`bssapi:QueryAvailableInstances`) and configure auto-renewal settings (bssapi:SetRenewal)	`{ "Version": "1", "Statement": [ { "Action": [ "bssapi:QueryAvailableInstances", "bssapi:SetRenewal", "bss:ModifyPrepaidInstanceAutoRenew", "bss:PayOrder", "bss:QueryPrice", "bss:RefundBatchRemainRefund" ], "Resource": "*", "Effect": "Allow" } ] }`
Modify auto-renewal settings (`bss:ModifyPrepaidInstanceAutoRenew`)
Pay for renewal and upgrade/downgrade orders (`bss:PayOrder`)
Display discounted prices (`bss:QueryPrice`)
Request a refund (`bss:RefundBatchRemainRefund`)

Read-only access to Asset Center

{
    "Version": "1",
    "Statement": [
        {
           "Action": [
                     "yundun-sas:DescribeCloudCenterInstances",
                     "yundun-sas:DescribeFieldStatistics",
                     "yundun-sas:DescribeCriteria"
                     ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Security check in Asset Center

{
    "Version": "1",
    "Statement": [
        {
            "Action": "yundun-sas:ModifyPushAllTask",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Read-only access to vulnerability management

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "yundun-sas:DescribeVulFixStatistics",
                "yundun-sas:DescribeVulDefendCountStatistics",
                "yundun-sas:DescribeVulMetaCountStatistics",
                "yundun-sas:DescribeVulListPage",
                "yundun-sas:DescribeVulNumStatistics",
                "yundun-sas:DescribeVulConfig",
                "yundun-sas:DescribeGroupedVul",
                "yundun-sas:DescribeVulDetails",
                "yundun-sas:DescribeVulList",
                "yundun-sas:DescribeVulWhitelist",
                "yundun-sas:DescribeAppVulScanCycle",
                "yundun-sas:ListVulAutoRepairConfig",
                "yundun-sas:DescribeEmgUserAgreement",
                "yundun-sas:DescribeEmgVulItem",
                "yundun-sas:DescribeUuidsByVulNames",
                "yundun-sas:DescribeTarget",
                "yundun-sas:DescribeVulTargetStatistics",
                "yundun-sas:DescribeConcernNecessity",
                "yundun-sas:DescribeOnceTask",
                "yundun-sas:GetOnceTaskResultInfo",
                "yundun-sas:DescribeCycleTaskList",
                "yundun-sas:DescribeVulExportInfo",
                "yundun-sas:DescribeInstanceRebootStatus",
                "yundun-sas:DescribeMachineCanReboot"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Vulnerability management

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "yundun-sas:OperateVuls",
                "yundun-sas:ModifyCreateVulWhitelist",
                "yundun-sas:DeleteVulWhitelist",
                "yundun-sas:ModifyVulWhitelistTarget",
                "yundun-sas:ModifyOperateVul",
                "yundun-sas:ModifyStartVulScan",
                "yundun-sas:ModifyVulConfig",
                "yundun-sas:ModifyEmgVulSubmit",
                "yundun-sas:ModifyVulTarget",
                "yundun-sas:ModifyCycleTask",
                "yundun-sas:ModifyAppVulScanCycle",
                "yundun-sas:ModifyAutoDelConfig",
                "yundun-sas:ModifyConcernNecessity",
                "yundun-sas:DeleteVulAutoRepairConfig",
                "yundun-sas:CreateVulAutoRepairConfig",
                "yundun-sas:ExportVul",
                "yundun-sas:RebootMachine",
                "yundun-sas:DescribeVulFixStatistics",
                "yundun-sas:DescribeVulDefendCountStatistics",
                "yundun-sas:DescribeVulMetaCountStatistics",
                "yundun-sas:DescribeVulListPage",
                "yundun-sas:DescribeVulNumStatistics",
                "yundun-sas:DescribeVulConfig",
                "yundun-sas:DescribeGroupedVul",
                "yundun-sas:DescribeVulDetails",
                "yundun-sas:DescribeVulList",
                "yundun-sas:DescribeVulWhitelist",
                "yundun-sas:DescribeAppVulScanCycle",
                "yundun-sas:ListVulAutoRepairConfig",
                "yundun-sas:DescribeEmgUserAgreement",
                "yundun-sas:DescribeEmgVulItem",
                "yundun-sas:DescribeUuidsByVulNames",
                "yundun-sas:DescribeTarget",
                "yundun-sas:DescribeVulTargetStatistics",
                "yundun-sas:DescribeConcernNecessity",
                "yundun-sas:DescribeOnceTask",
                "yundun-sas:GetOnceTaskResultInfo",
                "yundun-sas:DescribeCycleTaskList",
                "yundun-sas:DescribeVulExportInfo",
                "yundun-sas:DescribeInstanceRebootStatus",
                "yundun-sas:DescribeMachineCanReboot"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

O&M engineer permissions

Note

In the O&M engineer permission scenario, this policy script allows RAM users to use the vulnerability scan, vulnerability fix, baseline check, and Asset Center features and perform related operations. After you attach this policy, for the specific operations that the RAM user can perform, see the actions and descriptions in the Appendix: Common custom permission policies table.

{
    "Version": "1",
    "Statement": [{
            "Action": [
                "yundun-sas:OperateVul",
                "yundun-sas:ModifyStartVulScan"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "yundun-sas:FixCheckWarnings",
                "yundun-sas:IgnoreHcCheckWarnings",
                "yundun-sas:ValidateHcWarnings"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ecs:RebootInstance",
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "acs:MFAPresent": "true"
                }
            }
        },
        {
            "Action": "ecs:*",
            "Effect": "Allow",
            "Resource": [
                "acs:ecs:*:*:*"
            ]
        },
        {
            "Action": "ecs:CreateSnapshot",
            "Effect": "Allow",
            "Resource": [
                "acs:ecs:*:*:*",
                "acs:ecs:*:*:snapshot/*"
            ]
        },
        {
            "Action": [
                "ecs:Describe*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }, {
            "Action": [
                "yundun-sas:ModifyPushAllTask",
                "yundun-sas:DeleteTagWithUuid",
                "yundun-sas:ModifyTagWithUuid",
                "yundun-sas:CreateOrUpdateAssetGroup",
                "yundun-sas:DeleteGroup",
                "yundun-sas:ModifyAssetImportant",
                "yundun-sas:RefreshAssets"

            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Click Continue To Edit Basic Information, and then enter a Name and Note for the policy.
Click OK.

Step 2: Grant permissions to the RAM user

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the RAM user that you created, and in the Actions column, click Attach Policy.
You can also select multiple RAM users and click Attach Policy below the user list to grant permissions to multiple RAM users at a time.
In the Attach Policy panel, grant permissions to the RAM user.
1. Resource scope:
  1. Account level: The permissions take effect on all resources within the current Alibaba Cloud account. This option is suitable for general scenarios that do not require permission isolation by resource group.
  2. Resource group level: The permissions take effect only within the specified resource group. This option is suitable for scenarios in which multiple teams share an Alibaba Cloud account and permissions must be isolated by resource group. If a RAM user is granted resource group-level permissions, the RAM user must switch the resource scope to the authorized resource group in the top navigation bar after the RAM user logs on to the console. This way, the RAM user can properly access and manage resources in the resource group.
    Note
    The system automatically marks high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. These policies typically contain full control permissions on all cloud resources or full management permissions on Resource Access Management (RAM). Grant these policies with caution.
    For more information about resource group authorization, see Control RAM user access to specific ECS instances.
2. Principal: The principal is the RAM user to which you want to add permissions. The system automatically selects the current RAM user.
3. Select policies.
  - Search for and select the AliyunYundunSASReadOnlyAccess policy. This system policy grants O&M engineers read-only access to Security Center.
  - Search for and select the custom policy that you created in Step 1: Create a custom policy for Security Center.
Click Confirm.

Appendix: Common custom permission policies

When RAM users use specific Security Center features, you must grant the RAM users the custom permissions for the corresponding features. The following content describes the custom permission policy scripts supported by common Security Center feature modules.

Note

In most cases, each action in a RAM custom permission policy corresponds to an API operation of the cloud service.

Asset Center

Action in RAM policy	Description	Supported API
yundun-sas:DescribeCloudCenterInstances	Queries assets, including asset type, security alert status, and client online status.	DescribeCloudCenterInstances
yundun-sas:DescribeFieldStatistics	Queries server statistics for your assets.	DescribeFieldStatistics
yundun-sas:DescribeCriteria	Queries search criteria for asset fuzzy search.	DescribeCriteria - Queries the criteria for assets
yundun-sas:ModifyPushAllTask	Performs a security check task on servers.	ModifyPushAllTask
yundun-sas:DeleteGroup	Deletes an asset group.	DeleteGroup
yundun-sas:DescribeSearchCondition	Queries filter conditions for assets.	DescribeSearchCondition
yundun-sas:DescribeImageStatistics	Queries risk statistics of container image assets.	DescribeImageStatistics
yundun-sas:DescribeGroupedTags	Queries asset tag statistics.	DescribeGroupedTags
yundun-sas:DescribeDomainCount	Queries the number of domain name assets.	DescribeDomainCount
yundun-sas:DescribeCloudProductFieldStatistics	Queries statistics of Alibaba Cloud services.	DescribeCloudProductFieldStatistics
yundun-sas:DescribeCloudCenterInstances	Queries asset information.	DescribeCloudCenterInstances
yundun-sas:DescribeAllGroups	Queries all server groups.	DescribeAllGroups
yundun-sas:CreateOrUpdateAssetGroup	Creates a server group or modifies servers in a group.	CreateOrUpdateAssetGroup
yundun-sas:DescribeInstanceStatistics	Queries risk statistics of assets.	DescribeInstanceStatistics
yundun-sas:PauseClient	Enables or pauses the agent client.	PauseClient - Pauses or resumes the Agent client
yundun-sas:ModifyTagWithUuid	Modifies an asset tag name or updates associated assets.	ModifyTagWithUuid - Modify the name or associated assets of an asset tag
yundun-sas:RefreshAssets	Synchronizes the latest assets.	RefreshAssets
yundun-sas:ExportRecord	Exports check results from Asset Center, Cloud Security Posture Management, Image Security Scan, Attack Analysis, and AccessKey Pair Leakage Detection to an Excel file.	ExportRecord
yundun-sas:DescribeExportInfo	Queries the progress of an asset export task.	DescribeExportInfo - Describes the progress of an asset list export
yundun-sas:DescribeDomainList	Queries a list of domain name assets.	DescribeDomainList
yundun-sas:DescribeDomainDetail	Queries the details of a domain name asset.	DescribeDomainDetail
yundun-sas:DescribeAssetDetailByUuid	Queries asset details by UUID.	DescribeAssetDetailByUuid

Vulnerability management

Action in RAM policy	Description	Supported API
yundun-sas:DescribeVulWhitelist	Queries the vulnerability whitelist with pagination.	DescribeVulWhitelist
yundun-sas:ModifyOperateVul	Fixes, verifies, or ignores vulnerabilities.	ModifyOperateVul
yundun-sas:ModifyVulTargetConfig	Configures vulnerability detection for a single server.	ModifyVulTargetConfig
yundun-sas:DescribeConcernNecessity	Queries fix necessity for tracked vulnerabilities.	DescribeConcernNecessity
yundun-sas:DescribeVulList	Queries vulnerability information by type.	DescribeVulList
yundun-sas:ModifyOperateVul	Fixes, verifies, or ignores vulnerabilities.	ModifyOperateVul
yundun-sas:DescribeImageVulList	Lists vulnerabilities detected by image security scans and affected container images.	DescribeImageVulList
yundun-sas:ExportVul	Exports a list of vulnerabilities.	ExportVul
yundun-sas:DescribeVulExportInfo	Queries the progress of a vulnerability export task.	DescribeVulExportInfo

Cloud Security Posture Management

Action in RAM policy	Description	Supported API
yundun-sas:FixCheckWarnings	Fixes baseline check risks.	FixCheckWarnings
yundun-sas:IgnoreHcCheckWarnings	Ignores or stops ignoring baseline check risks.	IgnoreHcCheckWarnings - Ignore or unignore threats in a baseline in batches
yundun-sas:ValidateHcWarnings	Verifies baseline check risks.	ValidateHcWarnings

References

Permission policy elements: RAM uses policies to describe the specific content of authorization. A policy consists of basic elements such as Effect, Action, Resource, Condition, and Principal.
Policy structure and syntax: Understand the syntax and structure of policies before you create or update a policy.
Manage permissions for O&M engineers: If your enterprise has multiple O&M requirements, use RAM to control the permissions of each type of O&M engineer for easier management and control.
Use RAM to restrict the IP addresses that can be used to access Alibaba Cloud resources: RAM can restrict users to access your cloud resources only from specified IP addresses to enhance access security.
Use RAM to restrict the period of time during which RAM users can access Alibaba Cloud resources: RAM can restrict users to access your cloud resources only within a specified period of time to enhance access security.