DocsICP FilingConsole
官方文档
首页

Connecting to Agent Security Center

更新时间：
复制 MD 格式
产品详情
我的收藏

Connect AI platforms such as Model Studio, PAI, Dify, VolcEngine Agent Kit, OpenClaw, and Agent Run to Agent Security Center for AI asset inventory and risk assessment.

Scope

  • Account scope: This feature is in public preview and free for all customers during the preview period.

  • Supported AI platforms: Alibaba Cloud Model Studio, PAI, Dify, OpenClaw, and VolcEngine Agent Kit.

  • Collected asset types: AI Agent, Model Service, Dataset, Application Configurations, and Skill.

Connect AI platforms

Connection methods and collected asset types vary by platform.

Platform

Description

Alibaba Cloud Model Studio

Grant the AliyunServiceRoleForSasCspm service-linked role in Model Studio, then synchronize assets.

PAI

After authorization, assets from all workspaces synchronize automatically once daily.

Dify

Configure an IP whitelist and provide connection details (API endpoint, email, password). Supports public and VPC connections.

VolcEngine Agent Kit

Connect using an AccessKey (AK) with required permission policies such as IAMReadOnlyAccess and AgentKitReadOnlyAccess.

OpenClaw

Install the Security Center client. No separate connection is required.

Agent Run

After service-linked role authorization, Agent assets synchronize from the platform daily.

Connect Alibaba Cloud Model Studio

Step 1: Create and authorize a Model Studio user

  1. Go to the Alibaba Cloud Model Studio console.

  2. Below the top navigation bar, select the target workspace, then click Permission Management.

    Important

    Configure each workspace separately if connecting multiple workspaces.

  3. On the Permission Management page, click Add User.

  4. Configure the user as follows, then click OK.

    • Type: Select RAM role.

    • RAM role: Select the service-linked role AliyunServiceRoleForSasCspm.

      Note

      Agent Security Center uses this role to synchronize Model Studio resources from the selected workspace.

    • Display name: Enter a name for the user, such as agent_user.

Step 2: Synchronize assets

  1. Access the Security Center console - Agent Security Center - Agent Overview. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland..

  2. In the Connected Platforms section, click Asset synchronization in the upper-right corner.

  3. The system synchronizes assets from the platform, including AI Agent, Model Service, toolset, Dataset, and Application Configurations, and performs a risk assessment.

    Note

    Asset synchronization may take some time.

Connect PAI (first time)

Note

If you have not activated PAI, in the Connected Platforms section of Agent Overview, click Activate Now in the PAI panel to go to the activation page.

  1. Role authorization (first time): Create the service-linked roles AliyunServiceRoleForSas and AliyunServiceRoleForSasCspm in the RAM console. Skip this step if these roles already exist.

    Note

    Other Security Center features (such as Host) provide a one-click authorization feature to create service-linked roles. Create service-linked roles.

    1. Log on to the RAM console - Roles page as a RAM administrator, and click Create Role.

    2. In the upper-right corner of the Create Role page, click Create Service Linked Role.

    3. On the Create Service Linked Role page, select the following trusted cloud services from the drop-down list:

      • AliyunServiceRoleForSas

      • AliyunServiceRoleForSasCspm

    4. Click Create Service Linked Role. The system automatically populates the trust and permission policies. No manual modification is required.

  2. Return to the Agent Overview page, and click Asset synchronization in the upper-right corner of the Connected Platforms section, or wait for the system to synchronize automatically.

Important

All workspaces synchronize by default. The system performs an Asset synchronization once daily. You do not need to repeat the connection process.

Connect Dify

  1. Configure the IP whitelist: If your Dify server has access control policies, add the following IP addresses to your outbound whitelist.

    RegionPublic IP addressPrivate IP address
    China (Hangzhou)47.96.166.214100.104.12.64/26
    China (Shanghai)139.224.15.48, 101.132.180.26, 47.100.18.171, 47.100.0.176, 139.224.8.64, 101.132.70.106, 101.132.156.228, 106.15.36.12, 139.196.168.125, 47.101.178.223, and 47.101.220.176100.104.43.0/26
    China (Qingdao)47.104.111.68100.104.87.192/26
    China (Beijing)47.95.202.245100.104.114.192/26
    China (Zhangjiakou)39.99.229.195100.104.187.64/26
    China (Hohhot)39.104.147.68100.104.36.0/26
    China (Shenzhen)120.78.64.225100.104.250.64/26
    China (Guangzhou)8.134.118.184100.104.111.0/26
    China (Hong Kong)8.218.59.176100.104.130.128/26
    Japan (Tokyo)47.74.24.20100.104.69.0/26
    Singapore8.219.240.137100.104.67.64/26
    US (Silicon Valley)47.254.39.224100.104.145.64/26
    US (Virginia)47.252.4.238100.104.36.0/26
    Germany (Frankfurt)47.254.158.71172.16.0.0/20
    UK (London)8.208.14.12172.16.0.0/20
    Indonesia (Jakarta)149.129.238.99100.104.193.128/26

  2. Go to the connection configuration page

    1. Access the Security Center console - Agent Security Center - Agent Overview. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland..

    2. In the Connected Platforms section, click Dify.

    3. In the Dify connection panel:

      • For a first-time connection, click Integrate Now as prompted.

      • If you have connected accounts before, in the Import Account section, click Add Asset.

  3. Enter connection details: Configure the following parameters.

    • Common parameters

      • Username: Enter a name for the account. Maximum: 128 characters.

      • Access Method:

        • Public Access: Select if Dify is publicly accessible over the internet.

        • VPC: Select if Dify is deployed in a private network without public internet access.

          Important

          VPC access requires Dify to be deployed on an Alibaba Cloud ECS instance.

      • Region: The region where your Dify server is deployed.

      • API Address: The Dify platform login URL. Accepts a public IP address (for example, http://192.xx.xx.xx:port), a DNS name (for example, https://dify.test.cn), or a load balancer endpoint (for example, http://alb-04*****5a.cn-beijing.alb.aliyuncsslb.com).

      • Email: The email for your Dify login.

      • Password: The password for your Dify login.

        Note

        The password is encrypted and used only for authentication.

    • VPC parameters:

      Note

      Find this information on the ECS instance details page in the Configuration Information section.

      • VPC ID: The VPC ID of the Dify ECS instance.

      • Internal IP Address: The private IP address of the Dify ECS instance.

      • Port: The Dify service port.

  4. After you complete the configuration, click Next to go to the Test Connection page.

  5. Click Test Connection. If the connection is successful, click Asset synchronization.

Connect VolcEngine Agent Kit

  1. In the Connected Platforms section, click Agent Kit.

  2. In the Agent Kit connection panel, click the connection button to go to Multi-cloud Configuration Management.

    • For a first-time connection, click Configure as prompted.

    • If you have connected accounts before, in the Import Account section, click Configure Asset.

  3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, add an authorization for Volcano Engine. Connect VolcEngine assets by using an AK.

    • Permission Description: Select CSPM.

    • Volcano permission policy: IAMReadOnlyAccess, AgentKitReadOnlyAccess, IDReadOnlyAccess, ECSReadOnlyAccess, ArkReadOnlyAccess.

Connect OpenClaw

  1. Role authorization (first time):

    1. Access the Security Center console - Agent Security Center - Agent Overview. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland..

    2. In the Connected Platforms section, click OpenClaw.

    3. In the OpenClaw connection panel, click Authorize.

      Note

      The system automatically creates the service-linked role AliyunServiceRoleForSasAI for Agent Security Center and configures the AliyunServiceRolePolicyForSasAI permission policy, which allows Agent Security Center to access resources in other cloud services.

  2. Install the client: On the server where OpenClaw is deployed, install the Security Center client. Install the client.

  3. After installation and authorization, the system automatically synchronizes OpenClaw assets.

    Important

    Agent Security Center supports real-time protection for OpenClaw. During the public preview, free defense is available for a limited time. Agent risk detection and protection.

Connect Agent Run

Note

If you have not activated PAI, in the Connected Platforms section of Agent Overview, click Activate Now in the Agent Run panel to go to the activation page.

  1. Role authorization (first time): Create the service-linked roles AliyunServiceRoleForSas and AliyunServiceRoleForSasCspm in the RAM console. Skip this step if these roles already exist.

    Note

    Other Security Center features (such as Host) provide a one-click authorization feature to create service-linked roles. Create service-linked roles.

    1. Log on to the RAM console - Roles page as a RAM administrator, and click Create Role.

    2. In the upper-right corner of the Create Role page, click Create Service Linked Role.

    3. On the Create Service Linked Role page, select the following trusted cloud services from the drop-down list:

      • AliyunServiceRoleForSas

      • AliyunServiceRoleForSasCspm

    4. Click Create Service Linked Role. The system automatically populates the trust and permission policies. No manual modification is required.

  2. Return to the Agent Overview page, and click Asset synchronization in the upper-right corner of the Connected Platforms section, or wait for the system to synchronize automatically.

Important

The system automatically performs an Asset synchronization once daily. You do not need to repeat the connection process.

Manage connected platforms

  • Manage workspaces or accounts:

    • Alibaba Cloud Model Studio: Modify or remove workspaces by following these instructions:

      Important

      If you remove a workspace, the system permanently deletes the related assets and alerts. This action cannot be undone.

      1. You cannot modify or remove a workspace directly in Security Center. Go to the Global Management menu (Beijing | Singapore | Virginia) on the Model Studio console to perform these operations. For more information, see Manage business space permissions.

      2. After you make changes on the Model Studio console, return to the Security Center console and manually trigger an asset synchronization.

    • PAI: You cannot modify or remove workspaces directly in Security Center.

      1. Go to the PAI - Workspace List page. Create and manage a workspace and Delete a workspace.

      2. After making changes on the PAI console, trigger a manual asset synchronization.

    • Dify: You can modify or remove a connected account directly in Security Center.

      1. On the Agent Overview page, go to the Connected Platforms section and click Dify.

      2. In the Dify connection panel, perform one of the following operations:

        • Delete: To delete an account, click the delete icon image next to the target account.

          Important

          Deleting an account permanently deletes its associated assets and alerts. This action cannot be undone.

        • Edit: To edit an account, click the edit icon image below the target account. Reconfigure the connection (Enter connection details), then test the new configuration.

    • Agent Kit: You cannot modify or remove connected accounts directly on the Agent Security console. Go to the Multi-cloud Configuration Management > Multi-cloud Assets tab to manage your accounts.

  • Asset synchronization:

    • When to use: Trigger a manual asset synchronization after data changes on a connected platform, such as adding a PAI workspace or modifying an application configuration or a model.

      Note

      Assets synchronize automatically once daily.

    • Procedure: On the Agent Overview page, go to the Connected Platforms section and click Asset synchronization in the upper-right corner.

Previous：Agent CenterNext：Agent risk