Onboard AWS assets via access key

Step 1: Create root account credentials in AWS

1. Sign in to the AWS Management Console

   Sign in to the AWS IAM console. On the dashboard, click My security credentials.

   Important

   Only the root account can configure security credentials.

2. Create an access key

   On the My security credentials page, complete the configuration as described below, and then click Create access key.

   • Use case: Select a use case based on your business scenario. If none are suitable, select Other.

   • Set description tag (optional): Up to 256 characters. Allowed characters include letters, digits, UTF-8 spaces, and the following special characters: _ . : / = + - @.

3. Save the access key

   After creation, go to the Retrieve access keys page to view and save the Access key ID and Secret access key.

   Note

   You can click Download .csv file to save the access key to your local device.

Step 2: Complete onboarding in Security Center

1. Go to the authorization page:

   You can start the AWS asset onboarding process through any of the following paths:

   • Recommended path:

     1. Log on to Security Center console.

     2. In the left-side navigation pane, choose System Configuration > Feature Settings. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

     3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission, and then select AWS.

   • Other entry points:

     On the following pages, in the Multi-cloud Service Access or Add Multi-cloud Asset section, find and click the Onboard or Authorize button below the icon:

     • Asset Center > Host

     • Risk Governance > CSPM > Cloud Service Configuration Risk

     • Agentic SOC > Service Integration

     • Protection Configuration > Host Protection > Agentless Detection

2. Configure access credentials:

   1. In the Add Assets Outside Cloud panel, select Quick Configuration, select the features you want to onboard, and then click Next.

   2. On the Submit AccessKey Pair page, accurately enter the credential information you created in AWS.

      • Enter Master Account Secret ID and SecretKey: Enter the root account access key credentials (Access key ID and Secret access key) created in Step 1: Create root account credentials in AWS.

      • Region to Obtain Cloud Service Information: Select the available AWS region. The system will verify asset accessibility in the selected region.

      • Domain: Configure based on the selected onboarding region. For AWS China, select "China Edition"; for all others, select "International Edition".

   3. After filling in the information, click Next. The system will automatically verify the credentials and permissions.

3. Configure synchronization policy:

   • Select region: Select the AWS region where the assets you want to onboard are located.

     Note

     The synchronized asset data will be attributed to the data center corresponding to the region selected in the upper-left corner of the Security Center console.

     • Chinese Mainland: Chinese mainland data center.

     • Outside Chinese Mainland: Singapore data center.

   • Region Management: Recommended. After selected, assets in new regions under this AWS account will be automatically synchronized without manual configuration.

   • Host Asset Synchronization Frequency: Set the synchronization interval for AWS host (EC2) assets. If you do not need synchronization, set it to "Off".

   • AK Service Status Check: Set the interval for Security Center to automatically check the validity of the AWS account API key. You can select "Off" to disable detection.

4. After completing the configuration, click Synchronize Assets. The system will automatically synchronize host assets from the AWS account to Security Center.

   Important

   After completing the above operations, Security Center will automatically create a sub-user in AWS with the prefix AlibabaSasSubAccount_ to authorize the connection. Do not delete or disable the automatically created sub-user account or its API key; otherwise, asset onboarding and security monitoring will be interrupted.

Step 3: Delete the AWS root account access key

After successfully onboarding your assets, immediately delete the root account access key used for initial authorization to reduce security risks.

1. Sign in to the AWS IAM console as the root account, and on the dashboard, click My security credentials.

2. In the AccessKey Pair section, locate the access key used for this authorization, and click Delete under Actions to confirm the deletion.

Step 1: Create sub-account authorization credentials in AWS

Create an IAM sub-user with minimum required permissions for Security Center integration, and obtain its access key.

1. Sign in to the AWS Management Console

   Sign in to the AWS IAM console. In the left-side navigation pane, click Users. On the Users page, click Create user.

2. Configure user details

   • User name: Enter a custom name that is easy to identify (for example, aliyun-security-center-user).

   • Provide user access to the AWS Management Console: Do not select. This user is for API access only.

3. Set user permissions

   • Select Attach policies directly.

   • Based on the features you plan to use in Security Center, select the corresponding permission policies.

     Feature	AWS Policy	Notes
     Host	AmazonEC2ReadOnlyAccess IAMReadOnlyAccess	None
     CSPM (CSPM)	ReadOnlyAccess IAMReadOnlyAccess	If you need comprehensive risk detection based on log auditing, see Configure AWS service audit logs for CSPM to configure audit logs for relevant services in AWS.
     Agentless Detection	You need to manually create a custom policy.	You need to establish a log delivery pipeline in AWS consisting of CloudTrail, S3, and SQS. For specific steps, see Create a custom policy for Agentless Detection.

     In Permission options, select Attach policies directly, enter the policy name in the search box to filter, select the target policy, and then click Next.

4. Review and create

   After confirming that the user information and permission policies are correct, click Create user.

5. Create and save API keys

   1. After the user is created successfully, return to the Users list, and click the name of the newly created user to go to its details page.

   2. In the Summary section, click Create access key, and complete the key configuration as described below.

      1. Use case: Select a use case based on your business scenario. If none are suitable, select Others.

      2. Description tag: Leave it blank or customize a tag (for example, for-aliyun-sasc).

   3. Click Create access key to go to the Retrieve access keys page, then view and save the Access key ID and Secret access key.

   The secret access key is displayed only once at creation time and cannot be recovered if lost. Click Download .csv file to save the key information, and then click Done.

Step 2: Complete onboarding configuration in Security Center

After successfully creating the sub-user API key for authorization in AWS, return to the Security Center console to complete the onboarding configuration.

1. Go to the authorization page

   Note

   For more entry points, see other entry points.

   1. Log on to Security Center console.

   2. In the left-side navigation pane, choose System Configuration > Feature Settings. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

   3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission, and then select AWS.

2. Configure access credentials

   1. In the Add Assets Outside Cloud panel, select Manual Configuration, select the features you want to onboard, and then click Next.

      • Host: Allows Security Center to automatically discover and synchronize your AWS EC2 host assets.

      • CSPM: Use Cloud Security Posture Management to scan AWS cloud product configurations for configuration risk management.

      • Agentless Detection: Use agentless detection to scan AWS assets for vulnerabilities and risks.

   2. On the Submit AccessKey Pair page, accurately enter the credential information you created in AWS.

      • Sub-account SecretID and Sub-account SecretKey: Enter the credentials from Step 1: Create sub-account authorization credentials in AWS.

      • Region to Obtain Cloud Service Information: Select the available AWS region. The system will verify asset accessibility in the selected region.

      • Domain: Configure based on the selected onboarding region. For AWS China, select "China Edition"; for all others, select "International Edition".

   3. After filling in the information, click Next. The system will automatically verify the credentials and permissions.

3. Configure audit logs (optional)

   If you need to use the log auditing feature of Cloud Platform Configuration Check (CSPM), configure it here. Otherwise, click Skip.

   Important

   First complete all configurations in the AWS console as described in What should I do if the automatic credential and permission verification fails after filling in the access key?.

   • AWS Region: Enter the region ID where the AWS queue is located. For region ID reference, see AWS Region IDs .

   • SQS Queue Name: Enter the name of the SQS queue you created.

4. Configure synchronization policy

   On the Policy Configuration page, configure the settings as needed:

   • Select region: Select the AWS region where the assets you want to onboard are located.

     Note

     Asset data is automatically attributed to the data center corresponding to the region selected in the upper-left corner of the Security Center console.

     • Chinese Mainland: Chinese mainland data center.

     • Outside Chinese Mainland: Singapore data center.

   • Region Management: Recommended. After selected, assets in new regions under this AWS account will be automatically synchronized without manual configuration.

   • Host Asset Synchronization Frequency: Set the synchronization interval for AWS host (EC2) assets. If you do not need synchronization, set it to "Off".

     Note

     This parameter needs to be configured only when the onboarded feature includes Host.

   • Cloud Service Synchronization Frequency: Set the synchronization interval for AWS cloud product configurations. If you do not need synchronization, set it to "Off".

     Note

     This parameter needs to be configured only when the onboarded feature includes Cloud Platform Configuration Check.

   • AK Service Status Check: Set the interval for Security Center to automatically check the validity of the AWS account API key. You can select "Off" to disable detection.

5. After completing the configuration, click Synchronize Assets. The system will automatically synchronize data from the AWS account to Security Center.

Host

Go to the Asset Center > Host page. In the Add Multi-cloud Asset section, click the icon to view the onboarded AWS hosts. You can follow the steps below for in-depth protection and management of onboarded AWS EC2 hosts.

1. Install the client: Install the Security Center client on your AWS hosts. When running the installation command, select AWS for Service Provider. For details, see Install the agent.

2. Upgrade your edition for protection: The default free edition provides only basic security detection. For comprehensive security capabilities (such as anti-virus, vulnerability remediation, and intrusion prevention), bind a paid edition (Anti-virus edition or higher) to your AWS hosts. For details, see Manage host and container security quotas.

Cloud Security Posture Management (CSPM)

In the Security Center console, go to the Asset Center > Overview > Cloud Product page. In the left-side All Alibaba Cloud Services navigation pane, click AWS to view your onboarded AWS assets. The following CSPM features are available for onboarded AWS assets:

1. Run configuration risk checks: Check for configuration risks in your AWS products. For details, see Set up and run cloud platform configuration risk check policies.

2. Handle risk items: Based on the check results, view and remediate failed risk check items to improve the compliance and security of your cloud assets. For details, see View and handle failed cloud platform configuration risk check items.

Agentless detection

In the Security Center console, go to the Protection Configuration > Host Protection > Agentless Detection page. In the Add Multi-cloud Asset section, click the icon to view the number of onboarded AWS assets. After onboarding, you can use agentless detection to scan AWS hosts for vulnerabilities, baselines, and more.