Onboard Baidu Cloud assets

Step 1: Create an access key in Baidu AI Cloud

Create an IAM sub-user in Baidu AI Cloud with the minimum permissions required for Security Center integration, and obtain its access key (SecretID and SecretKey).

1. Log on to the Baidu AI Cloud Sub-User Management console and click Create IAM User.

2. Configure the user information:

   • Username: Enter a descriptive name, such as aliyun-security-center-user.

   • Access Mode: Select Programmatic Access.

   • Quick Authorization: We recommend that you do not select this option to avoid granting excessive permissions.

3. Set user permissions:

   1. In the user list, click Add Permission in the Operation column for the target user.

   2. Select the required permission policies based on the features you plan to use in Security Center.

      Feature	Policy option	Description
      CSPM	Option 1 (Recommended): IAMReadAccessPolicy + GlobalReadPolicy Option 2: IAMReadAccessPolicy + BCCReadAccessPolicy + Baidu AI Cloud product permission policies	GlobalReadPolicy grants read-only access to all Baidu AI Cloud products. Use this for quick setup. Use this for fine-grained authorization. Add only the policies for the products you need.

4. Create and save the access key:

   1. In the user list, click the target user name to go to the user details page.

   2. On the user details page, in the AccessKey section, click Create AccessKey.

   3. After passing security verification, click Download AccessKey in the dialog box to save the AccessKeyID and AccessKeySecret.

      Warning

      After you close the dialog box, the AK can no longer be downloaded. Download and securely store your AK immediately.

Step 2: Configure security center onboarding

After you have created the access key in Baidu AI Cloud, go to the Security Center console to complete the onboarding configuration.

1. Navigate to the authorization page.

   You can initiate the Baidu AI Cloud asset onboarding process through either of the following paths:

   • Recommended path:

     1. Access the Security Center console - System Settings - Feature Settings. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

     2. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission, and then select Baidu Cloud.

   • Alternative path:

     On the Assets > Overview > Cloud Product page, click Add below the icon in the Multi-cloud Service Integration section.

2. Configure the onboarding credentials:

   1. In the Add Assets Outside Cloud panel, select the features to onboard in the Select the modules to authorize section, and then click Next.

      Note

      Currently, only CSPM is supported.

   2. On the Submit AccessKey Pair page, enter the SecretID and SecretKey that you saved in Step 1.

   3. Click Next. Security Center automatically validates the credentials and permissions.

      Note

      If validation fails, see Why can't I see some onboard Baidu AI Cloud resources in Security Center?.

3. Configure the sync policies:

   • Select region: Select the region where your Baidu AI Cloud assets are located.

     Note

     The synced asset data will be attributed to the data center corresponding to the region selected in the upper-left corner of the Security Center console.

     • Chinese Mainland: Mainland China data center.

     • Outside Chinese Mainland: Singapore data center.

   • Region Management: Recommended. Select this option so that new Baidu AI Cloud products in future regions under this account are automatically synced without manual configuration.

   • Cloud Service Synchronization Frequency: Set the frequency for automatically syncing Baidu AI Cloud products. Set to Disabled if you do not need automatic syncing.

   • AK Service Status Check: Set the interval at which Security Center checks the validity of the Baidu AI Cloud account API key. Set to Disabled to skip this check.

4. Click Synchronize Assets. Security Center automatically syncs the Baidu AI Cloud products under your account.

Step 3: View onboarded assets

On the Assets > Overview > Cloud Product page of the Security Center console, in the left-side navigation of All Alibaba Cloud Services, click Baidu Cloud to view the onboarded Baidu AI Cloud assets. For more information, see View cloud service information.

Appendix: Baidu AI Cloud product permission policies

Security Center continues to update the supported Baidu AI Cloud products. For the latest information, see the console.

FAQ

• Why can't I see some onboard Baidu AI Cloud resources in Security Center?

  • Region not selected: In the onboarding configuration of Security Center, check whether the Baidu AI Cloud region where the resource is located is selected.

  • Sync delay: After initial onboarding or configuration changes, asset syncing may experience a delay. Wait for the sync to complete.

• What should I do if automatic credential and permission validation fails after entering the AccessKey?

  This is usually caused by insufficient sub-user permissions. Refer to Set user permissions: and go to the Baidu AI Cloud console to modify or add the required permission policies.