DocsICP FilingConsole
官方文档
首页

Onboard Ucloud assets

更新时间：
复制 MD 格式
产品详情
我的收藏

Security management in a multi-cloud environment is often fragmented, making it hard to respond to threats quickly. By connecting Ucloud assets to Security Center through access keys (AK), you can centrally monitor cross-cloud assets, detect security events, and unify policy management. To set up the connection, create IAM credentials in Ucloud, configure the connection in Security Center, and sync your assets.

Step 1: Create connection credentials

Connect with a sub-account

  1. Create a sub-account :

    1. Log on to the Ucloud console and click the profile icon in the upper-right corner.

    2. On the account information panel, click IAM.

    3. In the left-side navigation pane, select User Management and click Invite Sub Account.

    4. In the Invite Sub User dialog box, enter a User Name and Display Name , and click Confirm.

  2. Configure permissions:

    1. On the sub-user list page, click Add Policy in the Operation column next to the new sub-user.

    2. On the Add Permissions page, configure the authorization as described in the following table.

      1. Configure policy: Select the corresponding permission policy based on the features you plan to use in Security Center.

        Note

        If fine-grained permission control is not required, you can attach only the global read-only policy ReadOnlyAccess.

        Feature

        Ucloud policy

        Host

        IAMReadOnlyAccess

        UHostReadOnlyAccess

        CSPM (CSPM)

        1. UHostReadOnlyAccess

        2. UMongoDBReadOnlyAccess

        3. UDBReadOnlyAccess

        4. KafkaSinkerReadOnlyAccess

        5. UMemReadOnlyAccess

        6. URocketMQReadOnlyAccess

        7. UFileReadOnlyAccess

        8. ULogReadOnlyAccess

        9. IAMReadOnlyAccess

        10. VPCReadOnlyAccess

        11. UCDNReadOnlyAccess

        12. IPSecVPNReadOnlyAccess

      2. Project-level policy application scope: Select the projects that the sub-account can access and click Confirm.

  3. Create an API key

    1. Return to the sub-user list page and click the name of the new sub-user to go to its details page.

    2. In the API Keys section, click A New Key.

    3. After the key pair is created, view and save the Public Key and Private Key from the list.

Connect with the primary account

  1. Log on to the Ucloud console and click the profile icon in the upper-right corner.

  2. On the account information panel, click UAccount.

  3. In the left-side navigation pane, select API Keys and click A New Key.

  4. After the key pair is created, view and save the Public Key and Private Key from the list.

Step 2: Connect in Security Center

  1. Go to the authorization page:

    1. Log on to the Security Center console.

    2. In the navigation pane on the left, select System Settings > Feature Settings. In the upper-left corner of the console, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

    3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission and select Ucloud.

  2. Configure connection credentials:

    1. In the Add Assets Outside Cloud panel, select Quick Configuration, select the features you want to connect, and click Next.

      • Host: Automatically discovers and syncs your Ucloud UHost assets.

      • CSPM: Scans Ucloud cloud product configurations with Cloud Security Posture Management (CSPM) to identify configuration risks.

    2. On the Submit AccessKey Pair page, enter the credentials you created in Ucloud.

      • Enter Sub-account Secret ID: Enter the Public Key obtained in Step 1.

      • Enter Sub-account Secret Key: Enter the Private Key obtained in Step 1.

      • Domain: Select "China Edition" for the China proxy or "International Edition" for other regions.

    3. After you enter the credentials, click Next. The system automatically validates the credentials and permissions.

      Note

      After successful validation, the page automatically redirects to the sync policy configuration step. If validation fails, see FAQ.

  3. Configure sync policies:

    • Select region: Select the region where the Ucloud assets reside.

      Note

      Synced asset data is assigned to the data center corresponding to the region selected in the upper-left corner of the Security Center console.

      • Chinese Mainland: Mainland China data center.

      • Outside Chinese Mainland: Singapore data center.

    • Region Management: Recommended. After you select this option, assets in new regions under the Ucloud account are automatically synced without manual configuration.

    • Host Asset Synchronization Frequency: Set the frequency at which Security Center automatically syncs Ucloud host (UHost) assets. Select "Disabled" if syncing is not needed.

    • AK Service Status Check: Set the interval at which Security Center automatically checks the validity of the Ucloud account API keys. Select "Disabled" to skip this check.

  4. After you complete the configuration, click Synchronize Assets. Security Center automatically syncs the host assets from the Ucloud account.

Note

After the connection is set up, go to the Assets > Host page to verify that the Ucloud host assets appear in the asset list.

View and manage connected assets

Host

Go to the Assets > Host page. In the Add Multi-cloud Asset section, click the image icon to view connected Ucloud hosts. Complete the following steps to enable advanced protection for the connected Ucloud UHost hosts.

Note

For more information, see Server assets.

  1. Install the client: Install the Security Center agent on the Ucloud host. When running the installation command, select Service Provider as Ucloud. For detailed steps, see Install the agent.

  2. Upgrade to a paid edition: The free edition provides only basic security detection. For full protection capabilities (such as antivirus, vulnerability fixing, and intrusion prevention), bind a paid edition (Anti-Virus edition or higher) to your Ucloud hosts. For detailed steps, see Manage host and container security quotas.

CSPM

In the Security Center console, go to the Assets > Overview > Cloud Product page. In the left-side navigation pane under All Alibaba Cloud Services, select Ucloud to view connected Ucloud assets. The following CSPM features are available:

Note

For more information, see View cloud service information.

  1. Run configuration risk checks: Check whether configuration risks exist in your Ucloud products. For detailed steps, see Configure and run cloud configuration risk check policies.

  2. Handle risks: View and remediate failed check items to improve the compliance and security of your cloud assets. For detailed steps, see View and handle failed cloud configuration risk check items.

Operations management

Key rotation

To ensure account security, rotate access keys (AKs) regularly.

  1. Create a new AccessKey for the dedicated IAM user in the Ucloud console.

  2. In the Security Center console, go to the System Settings > Feature Settings > Multi-cloud Configuration Management > Multi-cloud Assets page, find the corresponding Ucloud account, and click Modify to update the AK/SK to the newly created credentials.

  3. After verifying that the new key syncs assets correctly, return to the Ucloud IAM console and delete the old AccessKey.

Update authorization scope

To bring new Ucloud products under Security Center management, update the authorization scope.

  1. In the Ucloud console, find the user and attach the permission policy corresponding to the new product.

  2. Security Center automatically discovers and manages newly authorized assets during the next sync cycle.

    Note

    You can also manually trigger Sync Latest Assets on the System Settings > Feature Settings > Multi-cloud Configuration Management > Multi-cloud Assets page.

Remove a connection

When you no longer need Security Center to manage a Ucloud account, remove the connection.

  1. On the System Settings > Feature Settings > Multi-cloud Configuration Management > Multi-cloud Assets page in the Security Center console, find the Ucloud account you want to remove and click Delete.

  2. After removal, Security Center stops monitoring and scanning all assets under the account, and the asset information is no longer displayed.

Note

After removal, delete or disable the corresponding dedicated sub-user in the Ucloud console to prevent credential leakage.

FAQ

  • Why are some connected Ucloud resources not visible in Security Center?

    • Region not selected: Check whether the region where the resource resides is selected during connection configuration.

    • Sync delay: Asset syncing may be delayed after initial connection or configuration changes. Wait for the sync to complete.

    • Insufficient permissions: Make sure the access key has sufficient read-only permissions to query cloud resource information.

  • What should I do if credential and permission validation fails after entering the AK?

    • Permission issue: The access key has insufficient permissions. Refer to "Step 1: Create connection credentials" and attach the relevant user permission policies in Ucloud.

    • Account issue: Make sure the access key is valid and has not expired.

    • Region issue: The selected domain does not match the account region. Switch to another available domain and resubmit.

Previous：Onboard Kingsoft Cloud assetsNext：Add data center assets