Security Center:Best practices to manage permissions of RAM users

Prerequisites

A RAM user is created. For more information, see Create a RAM user.

Attach a system policy to the RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

   

   You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.

4. In the Add Permissions panel, grant permissions to the RAM user.

   1. Configure the Resource Scope parameter.

      • Account: The authorization takes effect on the current Alibaba Cloud account.

      • Resource Group: The authorization takes effect on a specific resource group.

        Important

        If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   2. Configure the Principal parameter.

      The principal is the RAM user to which you want to grant permissions. The current RAM user is automatically selected.

   3. Select a system policy based on the following scenarios and click Grant permissions.

      Scenario	System policy
      Purchase, renew, or unsubscribe from Security Center	AliyunBSSOrderAccess and AliyunBSSRefundAccess
      Access Security Center in read-only mode	AliyunYundunSASReadOnlyAccess
      Manage Security Center	AliyunYundunSASFullAccess

5. Click Close.

Attach a custom policy to the RAM user

To implement fine-grained access control on Security Center, you can perform the following steps to attach a custom policy to the RAM user:

Step 1: Create a custom policy that grants permissions on Security Center

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click the JSON tab.

   Configure a policy based on your business requirements.

   Note

   The policy that specifies the permissions on O&M operations allows a RAM user to use the vulnerability detection, vulnerability fixing, and baseline check features, and perform operations in the Assets module. For more information about the operations that are allowed by the policy, see the actions and descriptions in the Operations that are supported by custom policies table.

   Scenario	Script
   Permissions to query the auto-renewal price (bssapi:QueryAvailableInstances) and configure auto-renewal settings (bssapi:SetRenewal)	{ "Version": "1", "Statement": [ { "Action": [ "bssapi:QueryAvailableInstances", "bssapi:SetRenewal", "bss:ModifyPrepaidInstanceAutoRenew", "bss:PayOrder", "bss:QueryPrice", "bss:RefundBatchRemainRefund" ], "Resource": "*", "Effect": "Allow" } ] }
   Permissions to modify auto-renewal settings (bss:ModifyPrepaidInstanceAutoRenew)
   Permissions to pay for a renewal and configuration change order (bss:PayOrder)
   Permissions to query the discounted price (bss:QueryPrice)
   Permissions to request a refund (bss:RefundBatchRemainRefund)
   Read-only permissions in the Assets module	{ "Version": "1", "Statement": [ { "Action": [ "yundun-sas:DescribeCloudCenterInstances", "yundun-sas:DescribeFieldStatistics", "yundun-sas:DescribeCriteria" ], "Resource": "*", "Effect": "Allow" } ] }
   Permissions to perform security checks in the Assets module	{ "Version": "1", "Statement": [ { "Action": "yundun-sas:ModifyPushAllTask", "Resource": "*", "Effect": "Allow" } ] }
   Read-only permissions on the vulnerability management feature	{ "Version": "1", "Statement": [ { "Action": [ "yundun-sas:DescribeVulList", "yundun-sas:DescribeVulWhitelist" ], "Resource": "*", "Effect": "Allow" } ] }
   Permissions on the vulnerability management feature	{ "Version": "1", "Statement": [ { "Action": "yundun-sas:OperateVul", "Resource": "*", "Effect": "Allow" } ] }
   Permissions on O&M operations	{ "Version": "1", "Statement": [{ "Action": [ "yundun-sas:OperateVul", "yundun-sas:ModifyStartVulScan" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "yundun-sas:FixCheckWarnings", "yundun-sas:IgnoreHcCheckWarnings", "yundun-sas:ValidateHcWarnings" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ecs:RebootInstance", "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "acs:MFAPresent": "true" } } }, { "Action": "ecs:*", "Effect": "Allow", "Resource": [ "acs:ecs:*:*:*" ] }, { "Action": "ecs:CreateSnapshot", "Effect": "Allow", "Resource": [ "acs:ecs:*:*:*", "acs:ecs:*:*:snapshot/*" ] }, { "Action": [ "ecs:Describe*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "yundun-sas:ModifyPushAllTask", "yundun-sas:DeleteTagWithUuid", "yundun-sas:ModifyTagWithUuid", "yundun-sas:CreateOrUpdateAssetGroup", "yundun-sas:DeleteGroup", "yundun-sas:ModifyAssetImportant", "yundun-sas:RefreshAssets" ], "Resource": "*", "Effect": "Allow" } ] }

5. Click Next to edit policy information. On the page that appears, configure the Name and Description parameters for the policy.

6. Click OK.

Step 2: Grant permissions to the RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Permissions > Grants.

3. On the Permission page, click Grant Permission.

   

4. In the Grant Permission panel, grant permissions to the RAM user.

   By default, a newly created RAM user does not have any permissions.

   1. Configure the Resource Scope parameter.

      • Account: The authorization takes effect on the current Alibaba Cloud account.

      • Resource Group: The authorization takes effect on a specific resource group.

        Important

        If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   2. Configure the Principal parameter.

      The principal is the RAM user to which you want to grant permissions. You can select multiple RAM users at a time.

   3. Select a policy.

      • Search for and click the AliyunYundunSASReadOnlyAccess policy. This system policy grants the RAM user read-only permissions on Security Center.

      • Search for and click the policy that you create in Step 1: Create a custom policy that grants permissions on Security Center.

5. Click Grant permissions.

References

Elements: You can refer to this topic to view the elements of policies that are used in RAM to define permissions. The elements are Effect, Action, Resource, Condition, and Principal.

Policy structure and syntax: You can refer to this topic to view the structure and syntax that are used to create or update policies in RAM.

Use RAM to manage permissions of O&M engineers: You can refer to this topic to grant permissions to O&M engineers and manage the permissions.

Use RAM to limit the IP addresses that are allowed to access Alibaba Cloud resources: You can refer to this topic to limit the IP addresses that are allowed to access Alibaba Cloud resources. This ensures a higher level of data security.

Use RAM to limit the period of time in which users are allowed to access Alibaba Cloud resources: You can refer to this topic to limit the period of time in which users are allowed to access Alibaba Cloud resources. This ensures a higher level of data security.