Security Center:Activate Security Center with Terraform

Prerequisites

• Using a root account poses a security risk if credentials are leaked. We recommend that you Create a RAM user and Create an AccessKey for the RAM user instead.

• Attach the following minimum IAM policy to the RAM user that runs Terraform commands. This grants the permissions required for this example. Grant permissions to a RAM user.

  This policy allows the RAM user to describe, modify, and create Security Center resources. Adjust the actions and resource scope based on your requirements.

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "sas:Describe*",  // Allows viewing information about Security Center.
                  "sas:CreateInstance",  // Allows creating a Security Center instance.
                  "sas:UpdateInstance",  // Allows upgrading a Security Center instance.
                  "sas:Modify*"          // Add this action if you need to modify other settings.
              ],
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:DescribeInstances"  // May be required to query ECS instances to associate them with Security Center.
              ],
              "Resource": "*"
          }
      ]
  }

alicloud_threat_detection_instance: Provisions and manages a Security Center instance.

Activate a Security Center instance

The following example activates a subscription-based Security Center Enterprise instance in the China (Hangzhou) region.

1. Create and enter a working directory.

   mkdir /usr/local/terraform
   cd /usr/local/terraform

   Note

   You must create a separate working directory for each Terraform project.

2. Create a file named terraform.tf and add the configuration.

   vim terraform.tf

   Add the following content:

   # Configure the Alibaba Cloud provider and set the region to China (Hangzhou).
   provider "alicloud" {
     region = "cn-hangzhou"
   }
   
   # Define the resource name. Default value: "terraform-example".
   variable "name" {
     default = "terraform-example"
   }
   
   # Security Center edition. Default value: "level2" (Enterprise).
   variable "version_code" {
     default = "level2"
   }
   
   # Number of servers to protect. Default value: "30".
   variable "buy_number" {
     default = "30"
   }
   
   # Billing method. Default value: "Subscription".
   variable "payment_type" {
     default = "Subscription"
   }
   
   # Subscription duration. Default value: "1" (in months).
   variable "period" {
     default = "1"
   }
   
   # Renewal mode. Default value: "ManualRenewal" (manual renewal).
   variable "renewal_status" {
     default = "ManualRenewal"
   }
   
   # Log storage capacity. Default value: "100" (in GB).
   variable "sas_sls_storage" {
     default = "100"
   }
   
   # Backup capacity for anti-ransomware. Default value: "100" (in GB).
   variable "sas_anti_ransomware" {
     default = "100"
   }
   
   
   # Web tamper-proofing switch. Default value: "1" (enabled).
   variable "sas_webguard_boolean" {
     default = "1"
   }
   
   # Quota for web tamper-proofing. Default value: "100".
   variable "sas_webguard_order_num" {
     default = "100"
   }
   
   # Cloud honeypot switch. Default value: "1" (enabled).
   variable "honeypot_switch" {
     default = "1"
   }
   
   # Quota for cloud honeypot. Default value: "32".
   variable "honeypot" {
     default = "32"
   }
   
   # Malicious file detection switch. Default value: "1" (enabled).
   variable "sas_sdk_switch" {
     default = "1"
   }
   
   # Quota for malicious file detection. Unit: 10,000 scans. Default value: "1000".
   variable "sas_sdk" {
     default = "1000"
   }
   # Number of container image scans. The value must be a multiple of 20.
   variable "container_image_scan_new" {
     default = "100"
   }
   # Agentic SOC switch.
   variable "threat_analysis_switch" {
     default = "1"
   }
   # Agentic SOC traffic. The value must be a multiple of 100. Default value: "100" (in GB/day).
   variable "threat_analysis_flow" {
     default = "100"
   }
   # Log storage capacity for Agentic SOC. Default value: "1000" (in GB).
   variable "threat_analysis_sls_storage" {
     default = "1000"
   }
   # Define the threat detection instance resource with variables.
   resource "alicloud_threat_detection_instance" "default" {
     version_code                = var.version_code
     buy_number                  = var.buy_number
     payment_type                = var.payment_type
     period                      = var.period
     renewal_status              = var.renewal_status
     sas_sls_storage             = var.sas_sls_storage
     sas_anti_ransomware         = var.sas_anti_ransomware
     container_image_scan_new    = var.container_image_scan_new
     sas_webguard_boolean        = var.sas_webguard_boolean
     sas_webguard_order_num      = var.sas_webguard_order_num
     honeypot_switch             = var.honeypot_switch
     honeypot                    = var.honeypot
     sas_sdk_switch              = var.sas_sdk_switch
     sas_sdk                     = var.sas_sdk
     threat_analysis_switch      = var.threat_analysis_switch
     threat_analysis_flow        = var.threat_analysis_flow
     threat_analysis_sls_storage = var.threat_analysis_sls_storage
   }

   Parameter	Required	Description	Example value
   modify_type	No	Required when you upgrade or downgrade an instance. Add this parameter to the resource block. Valid values: Upgrade Downgrade	Upgrade
   version_code	Yes	The edition of Security Center. Valid values: level7: Anti-virus level3: Advanced level2: Enterprise level8: Ultimate level10: Value-added Plan	level2
   buy_number	No	The number of servers to protect. Note This parameter is required only when version_code is set to level3, level2, or level8.	30
   v_core	No	The total vCPU count of the servers to protect. Note This parameter is required only when version_code is set to level7 or level8.	100
   payment_type	Yes	The billing method. Valid value: Subscription	Subscription
   period	No	The subscription duration, in months. Valid values: 1, 6, 12, 24, 36, and 60.	1
   renewal_status	No	The renewal mode. Valid values: AutoRenewal: The instance is renewed automatically. ManualRenewal (Default): The instance must be renewed manually.	ManualRenewal
   renewal_period	No	The auto-renewal duration, in months. Note This parameter is required when renewal_status is set to AutoRenewal.	12
   sas_sls_storage	No	The log storage capacity, in GB. Value range: 0 to 600,000. The value must be a multiple of 10. Note To comply with the Cybersecurity Law of the People's Republic of China, which requires logs to be stored for at least 180 days, we recommend that you allocate 50 GB of log storage capacity per server.	100
   sas_anti_ransomware	No	The backup capacity for the anti-ransomware feature, in GB. Value range: 10 to 9,999,999,999. The value must be a multiple of 10.	100
   container_image_scan_new	No	The quota for container image scans. Set this to the expected number of monthly scans. Unit: images. Value range: 0 to 200,000. The value must be a multiple of 20. Note A scan is counted against your quota only the first time an image with a unique digest is scanned. If the image digest changes, scanning the updated image consumes another unit of your quota. For example, if you need to scan 10 images and expect their digests to change 20 times in total during the subscription period, set the quota to 30 (10 + 20).	100
   sas_webguard_boolean	No	Enables or disables web tamper-proofing. Valid values: 1: Enables the feature. 0: Disables the feature.	1
   sas_webguard_order_num	No	The quota for web tamper-proofing. Unit: authorizations. Value range: 0 to 9,999. Note This parameter is required only when sas_webguard_boolean is set to 1.	100
   sas_sc	No	Enables or disables the security dashboard. Valid values: Note This feature is not available for purchase in regions outside the Chinese mainland. This parameter does not take effect in these regions. This feature is supported only when version_code is set to level3, level2, or level8. true false	false
   honeypot_switch	No	Enables or disables cloud honeypot. Valid values: 1: Enables the feature. 2: Disables the feature.	1
   honeypot	No	The quota for cloud honeypot. Unit: honeypots. Value range: 20 to 500. Note This parameter is required only when honeypot_switch is set to 1.	20
   sas_sdk_switch	No	Enables or disables malicious file detection. Valid values: 1: Enables the feature. 0: Disables the feature.	1
   sas_sdk	No	The quota for malicious file detection. Unit: 10,000 scans. Value range: 10 to 9,999,999,999. The value must be a multiple of 10.	10
   threat_analysis_switch	No	Enables or disables Agentic SOC. Valid values: 0: Disables the feature. 1: Enables the feature.	1
   threat_analysis_flow	No	The log ingestion traffic for Agentic SOC. Unit: GB/day. Value range: 100 to 9,999,999,999. The value must be a multiple of 100. Note This parameter is required only when threat_analysis_switch is set to 1.	100
   threat_analysis_sls_storage	No	The log storage capacity for Agentic SOC. Unit: GB. Value range: 0 to 9,999,999,999. The value must be a multiple of 1,000.	1000

3. Run the terraform init command to initialize the configuration.

   Successful initialization produces the following output:

   

4. Run the terraform apply command to create the instance. Enter yes when prompted and press Enter.

   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: 

   Successful creation produces the following output:

   Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Related documents

• What is Terraform?

• Purchase Security Center