Create custom policies and attach the policies to RAM users

Step 1: Create custom policies that define a set of permissions on Security Center

1. Log on to the RAM console by using an Alibaba Cloud account.
2. In the left-side navigation pane, choose Permissions > Policies.
3. On the Policies page, click Create Policy.
4. On the page that appears, specify the Policy Name and Note parameters.
5. In Configuration Mode, select Script and edit the policy content.
   Common custom policies:

   • Assets
     • Create custom policies that define read-only permissions on the Assets page

       The following custom policy defines permissions to view assets and server statistics on the Assets page. In the Action field, yundun-sas:DescribeCloudCenterInstances, yundun-sas:DescribeFieldStatistics, and yundun-sas:DescribeCriteria are added to grant permissions. To attach the policy to RAM users, perform the operations described in Step 2.

       {
           "Version": "1",
           "Statement": [
               {
                  "Action": [
                            "yundun-sas:DescribeCloudCenterInstances",
                            "yundun-sas:DescribeFieldStatistics",
                            "yundun-sas:DescribeCriteria"
                            ],
                   "Resource": "*",
                   "Effect": "Allow"
               }
           ]
       }

     • Create a custom policy that defines permissions to start security checks on the Assets page

       The following custom policy defines permissions to start security checks on the Assets page. In the Action field, yundun-sas:ModifyPushAllTask is added to grant permissions. To attach the policy to RAM users, perform the operations described in Step 2.

       {
           "Version": "1",
           "Statement": [
               {
                   "Action": "yundun-sas:ModifyPushAllTask",
                   "Resource": "*",
                   "Effect": "Allow"
               }
           ]
       }

   • Vulnerabilities
     • Create a custom policy that defines read-only permissions on the Vulnerabilities page

       The following custom policy defines permissions to view vulnerabilities and a whitelist of vulnerabilities on the Vulnerabilities page. In the Action field, yundun-sas:DescribeVulList and yundun-sas:DescribeVulWhitelist are added to grant permissions. To attach the policy to RAM users, perform the operations described in Step 2.

       {
           "Version": "1",
           "Statement": [
               {
                  "Action": [
                            "yundun-aegis:DescribeVulList",
                            "yundun-sas:DescribeVulWhitelist"
                            ],
                   "Resource": "*",
                   "Effect": "Allow"
               }
           ]
       }

     • Create a custom policy that defines permissions to fix vulnerabilities

       The following custom policy defines permissions to fix vulnerabilities. In the Action field, yundun-aegis:OperateVul is added to grant permissions. To attach the policy to RAM users, perform the operations described in Step 2.

       {
           "Version": "1",
           "Statement": [
               {
                  "Action": "yundun-aegis:OperateVul",
                   "Resource": "*",
                   "Effect": "Allow"
               }
           ]
       }

6. Click OK.

Step 2: Attach custom policies to RAM users

1. Log on to the RAM console by using an Alibaba Cloud account.
2. In the left-side navigation pane, choose Permissions > Grants.
3. On the Grants page, click Grant Permission.
4. In the Principal column, select a RAM user to which you want to attach a policy.
   By default, a RAM user that you newly create has no permissions. For information about how to create a RAM user, see Create a RAM user.
5. In the Select Policy section, select Custom Policy, and then select custom policies that you have created in Step 1: Create custom policies that define a set of permissions on Security Center.
6. Click OK.
7. Click Complete.

Operations supported by custom policies

The following tables list custom policies that define permissions on the Assets and Vulnerabilities pages of Security Center.

References

Policy elements

Policy structure and syntax

Use RAM to limit the IP addresses used to access Alibaba Cloud resources

Use RAM to limit the time of access to Alibaba Cloud resources