API reference for management and O&M operations - Bastionhost - Alibaba Cloud - Bastionhost

API standards and multilingual preset SDKs

The OpenAPI of this product (Yundun-bastionhost/2019-12-09) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.

Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.

Custom signature scenarios

If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.

Account and security preparation

Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.

Bastionhost instances (supported only in V3.2.X)

API	Title	Description
DescribeInstanceAttribute	DescribeInstanceAttribute	Returns all instance attributes, such as its instance ID and description.
DescribeInstances	DescribeInstances	Retrieves a list of Bastionhost instances.
ConfigInstanceSecurityGroups	ConfigInstanceSecurityGroups	Configures the security groups that control inbound and outbound network traffic for a Bastionhost instance.
ConfigInstanceWhiteList	ConfigInstanceWhiteList	After enabling public network access for a Bastionhost instance, you can add IP addresses to a whitelist to control access.
StartInstance	StartInstance	Starts a specified Bastionhost instance.
EnableInstancePublicAccess	Enable the public access switch for a specified Bastionhost instance	Enables the public access switch for a specified Bastionhost instance.
DisableInstancePublicAccess	DisableInstancePublicAccess	Disables public network access for a Bastionhost instance.
ModifyInstanceAttribute	Modify the information of a specified bastion host instance	Modifies the information of a specified bastion host instance.
MoveResourceGroup	MoveResourceGroup	Moves a Bastionhost instance to a specified resource group.
AddInstanceRdMember	AddInstanceRdMember	Adds a Resource Directory (RD) member account to a Bastionhost instance so that you can import and manage the cloud assets of the member account through Bastionhost.
ListInstanceRdMembers	ListInstanceRdMembers	Lists the member accounts in a Resource Directory (RD).
RemoveInstanceRdMember	RemoveInstanceRdMember	Removes a Resource Directory (RD) member account from a Bastionhost instance. You must remove all assets of the member account from Bastionhost before you call this operation.

Tags (supported only in V3.2.X)

API	Title	Description
ListTagKeys	ListTagKeys	Queries the tag keys on resources.
ListTagResources	ListTagResources	Lists the tags that are attached to one or more Bastionhost instances.
UntagResources	UntagResources	Removes tags from one or more Bastionhost instances. You can remove specific tag key-value pairs or all tags at once.
TagResources	TagResources	Creates and attaches tags to one or more Bastionhost instances.

Regions (supported only in V3.2.X)

API	Title	Description
DescribeRegions	DescribeRegions	Queries the Alibaba Cloud regions that support Bastionhost instances.

Hosts (supported only in V3.2.17 and later)

API	Title	Description
CreateHost	CreateHost	Creates a host in a Bastionhost instance. You can import Elastic Compute Service (ECS) instances, on-premises servers, and third-party cloud servers as hosts for centralized O&M management.
GetHost	GetHost	Retrieves the details of a host, such as the name, source, address, protocol, and service port.
ListHosts	ListHosts	Queries the hosts in a bastion host.
DeleteHost	DeleteHost	Deletes a host.
ModifyHostsPort	ModifyHostsPort	Changes the port for the O\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\&M protocol on one or more hosts.
ModifyHostsActiveAddressType	ModifyHostsActiveAddressType	Changes the endpoint type of one or more hosts for O\\\\\\\\\\\\&M. Public and private IP addresses are supported.
ModifyHost	ModifyHost	Modifies information about a host. The information includes the address, name, and description of the host and the operating system that the host runs.

Databases (supported only in V3.2.40 and later)

API	Title	Description
CreateDatabase	CreateDatabase	Imports a database into a Bastionhost instance for centralized O&M management. Supported databases include ApsaraDB RDS, PolarDB, and self-managed MySQL, SQL Server, PostgreSQL, and Oracle databases.
ModifyDatabase	ModifyDatabase	Modifies the basic information about a database.
GetDatabase	GetDatabase	Queries the detailed information about a database.
ListDatabases	ListDatabases	Queries the databases that are managed by a bastion host.
DeleteDatabase	DeleteDatabase	Deletes a database.

Network domains (supported only in V3.2.40 and later)

API	Title	Description
CreateNetworkDomain	CreateNetworkDomain	If you want to perform O\\\\\\\\\\\\&M operations on assets that reside in different networks or assets that cannot communicate with the virtual private cloud (VPC) of your bastion host in a centralized manner, we recommend that you use the network domain feature of Bastionhost. You can configure a proxy server for these assets, create a network domain for a bastion host, and then connect the network domain to the proxy server. This way, you can perform O\\\\\\\\\\\\&M operations on the assets by using the bastion host.
GetNetworkDomain	GetNetworkDomain	Retrieves the details of a specified network domain.
ListNetworkDomains	ListNetworkDomains	Lists the network domains configured in a Bastionhost instance. Network domains define the connectivity between Bastionhost and the hosts or databases that it manages.
DeleteNetworkDomain	DeleteNetworkDomain	Deletes a network domain.
ModifyNetworkDomain	ModifyNetworkDomain	Modifies the basic information about a network domain.
MoveHostsToNetworkDomain	MoveHostsToNetworkDomain	Adds multiple hosts to a network domain at a time.
MoveDatabasesToNetworkDomain	MoveDatabasesToNetworkDomain	Adds multiple databases to a network domain at a time.

Host accounts (supported only in V3.2.17 and later)

API	Title	Description
CreateHostAccount	CreateHostAccount	Creates a host account for a host managed by a Bastionhost instance. After you create the host account, Operations and Maintenance (O&M) engineers can use it to log on to the host through Bastionhost.
GetHostAccount	GetHostAccount	Retrieves the details of a host account on a host managed by a Bastionhost instance, such as the protocol type and account name.
ListHostAccounts	ListHostAccounts	Lists the host accounts that are configured for a host in a Bastionhost instance. Host accounts are the credentials used by O&M engineers to log on to the host.
ModifyHostAccount	ModifyHostAccount	Modifies a host account on a host managed by a Bastionhost instance. You can update the account name, password, or SSH private key used for host logon.
DeleteHostAccount	DeleteHostAccount	Removes a host account.
ResetHostAccountCredential	ResetHostAccountCredential	Clears the credential (password or SSH private key) for a specified host account.
ListImportableKMSSecretsForHost	ListImportableKMSSecretsForHost	Lists all importable KMS secrets for a specified host.
ImportKMSSecretsForHost	ImportKMSSecretsForHost	Imports KMS secrets for a specified host.

Database accounts (supported only in V3.2.40 and later)

API	Title	Description
CreateDatabaseAccount	CreateDatabaseAccount	After a database is created, you can create a database account for the database. After the account is created, O\\\\\\&M engineers can use the account to log on to and perform O\\\\\\&M operations on the database.
ModifyDatabaseAccount	ModifyDatabaseAccount	Modifies the basic information about a database account.
GetDatabaseAccount	GetDatabaseAccount	Queries the detailed information about a database account.
ListDatabaseAccounts	ListDatabaseAccounts	Queries the database accounts of a database.
ListDatabaseAccountsForUserGroup	ListDatabaseAccountsForUserGroup	Queries the database accounts of a database and whether a user group is authorized to manage each database account.
DeleteDatabaseAccount	DeleteDatabaseAccount	Deletes a database account.

Users (supported only in V3.2.17 and later)

API	Title	Description
CreateUser	CreateUser	Adds a user to a bastion host.
GetUser	GetUser	Retrieves the details of a user of a bastion host.
ListUsers	ListUsers	Queries a list of users of a bastion host.
ModifyUser	ModifyUser	Modifies the information about a user of a bastion host.
DeleteUser	DeleteUser	Deletes a bastion host user.
CreateUserPublicKey	CreateUserPublicKey	Creates a public key for a bastion host user and hosts the public key in the bastion host. This way, O\\\\\\\\\\\\\\\\\\\\\\\\&M engineers can use the private key that corresponds to the public key to log on to the bastion host from an O\\\\\\\\\\\\\\\\\\\\\\\\&M client.
ListUserPublicKeys	ListUserPublicKeys	Lists the SSH public keys that are configured for a Bastionhost user. Users can use these public keys for key-based authentication when logging on to hosts through Bastionhost.
ModifyUserPublicKey	ModifyUserPublicKey	Modifies the public key of the user.
DeleteUserPublicKey	DeleteUserPublicKey	Deletes a public key from the specified user.
LockUsers	LockUsers	Locks one or more users of a bastion host.
UnlockUsers	UnlockUsers	Unlocks one or more users of a bastion host.

User groups (supported only in V3.2.17 and later)

API	Title	Description
CreateUserGroup	CreateUserGroup	Creates a user group for a bastion host.
GetUserGroup	GetUserGroup	Retrieves the details of a user group in a bastion host.
ListUserGroups	ListUserGroups	Queries a list of user groups on a bastion host.
ModifyUserGroup	ModifyUserGroup	Modifies the information about a user group.
DeleteUserGroup	DeleteUserGroup	Deletes a user group from a bastion host.
AddUsersToGroup	AddUsersToGroup	Add one or more users to a user group.
RemoveUsersFromGroup	RemoveUsersFromGroup	Removes one or more users from a user group.

Asset groups (supported only in V3.2.17 and later)

API	Title	Description
CreateHostGroup	CreateHostGroup	You can create asset groups based on your business requirements and add assets of the same type to an asset group. This allows you to classify assets and manage multiple assets at a time.
AddDatabasesToGroup	AddDatabasesToGroup	Adds multiple databases to a specified asset group.
AddHostsToGroup	AddHostsToGroup	Adds one or more hosts to the specified host group.
RemoveDatabasesFromGroup	RemoveDatabasesFromGroup	Removes multiple databases from an asset group at a time.
DeleteHostGroup	DeleteHostGroup	Deletes a host group.
RemoveHostsFromGroup	RemoveHostsFromGroup	Removes multiple hosts from an asset group at a time.
ModifyHostGroup	ModifyHostGroup	Modifies the name or description of the specified host group.
GetHostGroup	GetHostGroup	Retrieves the details of a host group.
ListHostGroups	ListHostGroups	Queries a list of asset groups that are managed by a bastion host.

Host authorization (supported only in V3.2.17 and later)

API	Title	Description
AttachHostAccountsToUser	AttachHostAccountsToUser	After you add a user to your bastion host, you must authorize the user to manage assets. Only authorized users can log on to the bastion host to perform O\\\\\\\\\\\\&M operations on the assets.
ListHostsForUser	ListHostsForUser	Queries the hosts that a user group is authorized or not authorized to manage.
ListHostAccountsForUser	ListHostAccountsForUser	Queries the host accounts of a host and whether a user is authorized to manage each host account.
DetachHostAccountsFromUser	DetachHostAccountsFromUser	Revokes permissions on hosts and host accounts from a user.
DetachHostAccountsFromUserGroup	DetachHostAccountsFromUserGroup	Revokes the permissions on one or more hosts and host accounts from a user group.
DetachHostGroupAccountsFromUser	DetachHostGroupAccountsFromUser	Removes host groups and host accounts from the list of host groups and host accounts that a user is authorized to manage.
AttachHostAccountsToUserGroup	AttachHostAccountsToUserGroup	Authorizes a user group to manage one or more hosts and host accounts.
DetachHostGroupAccountsFromUserGroup	DetachHostGroupAccountsFromUserGroup	Revokes permissions on one or more host groups and host accounts from a user group.
AttachHostGroupAccountsToUser	AttachHostGroupAccountsToUser	Authorizes a user to manage one or more host groups and host accounts.
AttachHostGroupAccountsToUserGroup	AttachHostGroupAccountsToUserGroup	Authorizes a user to manage one or more host groups and host accounts.
ListHostAccountsForUserGroup	ListHostAccountsForUserGroup	Queries the host accounts of a host and whether a user group is authorized to manage each host account.
ListHostGroupAccountNamesForUser	ListHostGroupAccountNamesForUser	Queries the names of the host accounts that a specified user is authorized to manage in a specified host group.
ListHostGroupAccountNamesForUserGroup	ListHostGroupAccountNamesForUserGroup	Queries the names of the host accounts that a user group is authorized to manage in a host group.
ListHostGroupsForUser	ListHostGroupsForUser	Queries a list of host groups that a bastion host user is authorized or is not authorized to manage.
ListHostGroupsForUserGroup	ListHostGroupsForUserGroup	Queries the hosts that a specified user group is authorized or not authorized to manage.
ListHostsForUserGroup	ListHostsForUserGroup	Lists the authorized or unauthorized hosts for a bastion host user group.

Database authorization (supported only in V3.2.40 and later)

API	Title	Description
AttachDatabaseAccountsToUser	AttachDatabaseAccountsToUser	Authorizes a user to manage databases and database accounts.
ListDatabasesForUser	ListDatabasesForUser	Queries the databases that a user is authorized to manage.
DetachDatabaseAccountsFromUserGroup	DetachDatabaseAccountsFromUserGroup	Revokes permissions on databases and database accounts from a user group.
ListDatabaseAccountsForUser	ListDatabaseAccountsForUser	Queries the database accounts of a database and whether a user is authorized to manage each database account.
DetachDatabaseAccountsFromUser	DetachDatabaseAccountsFromUser	Revokes permissions on databases and database accounts from a user.
AttachDatabaseAccountsToUserGroup	AttachDatabaseAccountsToUserGroup	Grants permissions on databases and database accounts to a user group.
ListDatabasesForUserGroup	ListDatabasesForUserGroup	Lists the databases that a user group is authorized to manage through a Bastionhost instance.

O&M tokens (supported only in V3.2.40 and later)

API	Title	Description
ListOperationDatabases	ListOperationDatabases	Lists the databases that the current Resource Access Management (RAM) user is authorized to access.
ListOperationHosts	ListOperationHosts	Lists the hosts that the current Resource Access Management (RAM) user is authorized to perform O&M operations on through a Bastionhost instance.
ListOperationHostAccounts	ListOperationHostAccounts	Queries a list of host accounts that the current Resource Access Management (RAM) user is authorized to manage.
ListOperationDatabaseAccounts	ListOperationDatabaseAccounts	Queries a list of database accounts that the current Resource Access Management (RAM) user is authorized to manage.
GenerateAssetOperationToken	GenerateAssetOperationToken	Call this operation to request O&M tokens for bastions or databases, which allows you to manage assets.
RenewAssetOperationToken	RenewAssetOperationToken	Renews an O\\\\\\&M token for one hour.
CreateOperationTicket	CreateOperationTicket	Creates an O&M ticket for a host or database that requires approval before access. If a control policy requires O&M approval, you must create and get a ticket approved before you can perform O&M operations.

Authorization rules (supported only in V3.2.40 and later)

API	Title	Description
CreateRule	CreateRule	You can create authorization rules to authorize multiple users to manage assets. You can also specify a validity period for an authorization rule. This way, you can manage users and assets in a more efficient manner and limit the time periods during which users can access assets.
ModifyRule	ModifyRule	Modifies the basic information of an authorization rule.
GetRule	GetRule	Queries the detailed information about an authorization rule.
ListRules	ListRules	Queries a list of authorization rules of a bastion host.
EnableRule	EnableRule	Enables an authorization rule.
DisableRule	DisableRule	Disables an authorization rule.
DeleteRule	DeleteRule	Deletes an authorization rule.

Control policies (supported only in V3.2.40 and later)

API	Title	Description
CreatePolicy	CreatePolicy	Configures a command control, command approval, protocol control, or access control policy to manage O\\\\\\\\\\\\&M operations. This effectively prevents users from performing high-risk operations or accidental operations to ensure O\\\\\\\\\\\\&M security.
ModifyPolicy	ModifyPolicy	Modifies the basic information about a control policy.
GetPolicy	GetPolicy	Gets the details of a specified control policy.
ListPolicies	ListPolicies	Queries a list of control policies.
GetPolicyAssetScope	GetPolicyAssetScope	Queries the assets to which a control policy applies.
SetPolicyProtocolConfig	SetPolicyProtocolConfig	Sets the Remote Desktop Protocol (RDP), Secure Shell (SSH), and SSH File Transfer Protocol (SFTP) options for a control policy.
SetPolicyCommandConfig	SetPolicyCommandConfig	Specifies the commands that can or cannot be run by the users or on the assets associated with the policy and the commands that must be reviewed.
SetPolicyIPAclConfig	SetPolicyIPAclConfig	Specifies whether a source IP address can access the assets to which a control policy applies.
GetPolicyUserScope	GetPolicyUserScope	Queries the scope of users to whom a control policy applies.
SetPolicyAccessTimeRangeConfig	SetPolicyAccessTimeRangeConfig	Configures the logon period limits in a control policy.
SetPolicyAssetScope	SetPolicyAssetScope	Specifies the assets to which a control policy applies.
SetPolicyUserScope	SetPolicyUserScope	Specifies the users to whom a control policy applies.
SetPolicyApprovalConfig	SetPolicyApprovalConfig	Configures the O\\&M approval setting in a control policy.
DeletePolicy	DeletePolicy	Deletes a control policy.

Approvals (supported only in V3.2.37 and later)

API	Title	Description
ListApproveCommands	ListApproveCommands	Queries commands to be reviewed.
AcceptApproveCommand	AcceptApproveCommand	If an O\\\\\\&M engineer attempts to run a command specified in the Command Approval field on the Create Control Policy page, the administrator is notified to review the command in the Bastionhost console. The command can be run only after it is approved by the administrator.
RejectApproveCommand	RejectApproveCommand	If an O\\\\\\&M engineer attempts to run a command specified in the Command Approval section of the Create Control Policy page, the administrator is notified to review the command in the Bastionhost console. The command can be run only after it is approved by the administrator.
ListOperationTickets	Retrieve the list of O&M applications pending approval	Retrieves the list of O&M applications that require approval.
AcceptOperationTicket	AcceptOperationTicket	Approves an O\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\&M application.
RejectOperationTicket	RejectOperationTicket	If a Bastionhost administrator enables O\\\\\\\\\\\\&M Approval on the Create Control Policy page, O\\\\\\\\\\\\&M engineers can log on to assets to perform O\\\\\\\\\\\\&M operations only after the administrator approves their O\\\\\\\\\\\\&M applications.

Shared keys (supported only in V3.2.X)

API	Title	Description
CreateHostShareKey	CreateHostShareKey	Bastionhost provides the shared key feature. This feature allows you to manage the private key that is used to log on to a host in a bastion host. This way, you can associate the private key with multiple accounts of the host to make host account management more efficient.
GetHostShareKey	GetHostShareKey	Queries the information about a shared key.
ListHostShareKeys	ListHostShareKeys	Queries the shared keys that are associated with a host.
ListHostAccountsForHostShareKey	ListHostAccountsForHostShareKey	Queries the host accounts that are associated with a shared key.
ModifyHostShareKey	ModifyHostShareKey	Modifies a shared key.
AttachHostAccountsToHostShareKey	AttachHostAccountsToHostShareKey	Associates host accounts with a shared key.
DetachHostAccountsFromHostShareKey	DetachHostAccountsFromHostShareKey	Disassociate host accounts from a shared key.
DeleteHostShareKey	DeleteHostShareKey	Deletes a shared key.

System settings (supported only in V3.2.X)

API	Title	Description
GetInstanceADAuthServer	GetInstanceADAuthServer	Queries the settings of Active Directory (AD) authentication on a bastion host.
ModifyInstanceADAuthServer	ModifyInstanceADAuthServer	Updates the settings of the Active Directory (AD) authentication server of a bastion host.
GetInstanceTwoFactor	GetInstanceTwoFactor	Queries the settings of two-factor authentication on a bastion host.
ModifyInstanceTwoFactor	ModifyInstanceTwoFactor	Modifies the two-factor authentication settings of a bastion host.
ModifyInstanceLDAPAuthServer	ModifyInstanceLDAPAuthServer	Updates the settings of the Lightweight Directory Access Protocol (LDAP) authentication server of a bastion host.
GetInstanceLDAPAuthServer	GetInstanceLDAPAuthServer	Queries the settings of Lightweight Directory Access Protocol (LDAP) authentication on a bastion host.
GetInstanceStoreInfo	GetInstanceStoreInfo	Queries the storage usage of a Bastionhost instance.
CreateExportConfigJob	CreateExportConfigJob	Creates a configuration backup export task. Only one configuration backup export task can run at a time for a Bastionhost instance.
GetExportConfigJob	GetExportConfigJob	Retrieves the details of a configuration export task for a Bastionhost instance.

Others

API	Title	Description
VerifyInstanceLDAPAuthServer	VerifyInstanceLDAPAuthServer	Tests the connectivity to the Lightweight Directory Access Protocol (LDAP) authentication server configured for a Bastionhost instance. Use this operation to validate your LDAP settings before you save them.
VerifyInstanceADAuthServer	VerifyInstanceADAuthServer	Tests the connectivity to the Active Directory (AD) authentication server configured for a Bastionhost instance. Use this operation to validate your AD settings before you save them.
AllowOperationTaskApproval	Approves an O&M task execution request	Approves an O&M task execution request.
GetAutoOpsTask	Queries the details of a specified O&M task (supported only in V3.2.50 and later)	Queries the details of a specified O&M task.
ListTodoOpsTaskApprovals	Retrieve pending O&M approval tasks	Retrieves the list of pending automated O&M approval requests.
RejectOperationTaskApproval	Reject an O&M task execution request	Rejects an O&M task execution request.