The multi-account security management feature of Security Center enables enterprises to centrally purchase security products, configure protection, and handle security risks across multiple Alibaba Cloud accounts. This topic describes how to set up and use multi-account security management, including adding delegated administrators, configuring account scopes, allocating quotas, and managing member account security.
Scenarios
Centralized security configuration and risk management
Centralized management of security protection configurations and security risks
Member account data and configurations are independent of each other. You can use a Security Center delegated administrator account to centrally manage security protection configurations for multiple member accounts, handle security risks, and perform security hardening. This improves security operations efficiency and resolves the difficulty of managing security across multiple accounts.
Cross-account log ingestion, storage, and threat analysis
Use the Agentic SOC feature of Security Center to ingest data from member accounts into the delegated administrator account for centralized storage and analysis. This helps identify cross-account security risks and provides a global view of security events.
Centralized billing with shared quotas across multiple accounts
A delegated administrator can centrally purchase quotas for multiple Security Center features, and then allocate the corresponding feature quotas to member accounts. Member accounts can use the allocated quotas without making separate purchases. This enables enterprises to centrally purchase Security Center security features and simplifies internal cost accounting.
If a member account has already purchased a Security Center instance, you cannot allocate quotas to it through quota management. To allocate quotas, the member account must first unsubscribe from its subscription instance and disable its pay-as-you-go instance.
To centrally pay for all cloud product costs of member accounts in your enterprise, use the finance trusteeship feature. For more information, see Overview.
For security reasons, use a Security Center delegated administrator account to purchase quotas instead of the management account.
Architecture overview
A security expert uses a dedicated security account (Security Center delegated administrator) to centrally manage Alibaba Cloud accounts across the production environment and testing environment within the enterprise, and performs centralized risk detection, risk handling, and security hardening to improve security operations efficiency. If your enterprise has a complex multi-account scenario, submit a ticket for technical support.
Prerequisites
Resource Directory is activated. For more information, see Enable Resource Directory.
Member accounts are created in Resource Directory or existing Alibaba Cloud accounts are invited. For more information, see Create a member and Invite an Alibaba Cloud account.
Step 1: Add a delegated administrator account
The management account of a Resource Directory can designate a member in the Resource Directory as the delegated administrator account of a trusted service. After the designation, the delegated administrator account is authorized by the management account to access the Resource Directory organization and member information in the corresponding trusted service, and perform service management within the organization scope.
Log on to the Resource Management console
by using the enterprise management account.
On the Trusted Services page, find Security Center, and in the Actions column, click Manage.
In the Add delegated administrator account panel, select the member that you want to designate as a delegated administrator, and then click Confirm.
After the account is added, use the delegated administrator account to access the multi-account security management feature of Security Center to perform management operations within the Resource Directory organization scope.
You can add up to 10 delegated administrator accounts for Security Center.
Step 2: Configure the account management scope
You can use a delegated administrator to centrally manage member accounts. Follow the steps below to configure the scope of member accounts that the delegated administrator can manage.
A delegated administrator can only view and manage member accounts within its scope. It cannot view or manage member accounts under other delegated administrators. If you configure the account management scope by using the management account, only the management account can view and manage the member accounts it has configured. A member account can be managed by only one delegated administrator at a time.
Log on to the Security Center console by using a delegated administrator account. Log on to Security Center console.
In the left-side navigation pane, choose . In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
(Required for first-time use) On the Multi-account Management page, click Enable Management in Security Center.
On the Configure tab, in the Total Monitored Accounts section, click Account Management.
In the Multi-account Management Settings panel, select the member accounts that you want the current account to manage.
Select a node from the Resource Directory tree on the left side of the panel. In the Accounts under the selected node list in the center, select target accounts. Selected accounts appear in the Managed account list on the right. The system automatically creates the AliyunServiceRoleForSasRd and AliyunServiceRoleForSasCloudSiem service-linked roles for the member accounts. To automatically manage accounts added later, turn on the Auto-manage new accounts switch. Click OK after you complete the settings.
(Optional) Turn on Automatic Management of New Accounts to set a control policy for new accounts.
After you turn on this option, click Configure Policy, select the target Resource Directory nodes, and click OK. When a new account is added to a selected Resource Directory node, it is automatically added to the managed accounts list.
Click OK.
You can view the member accounts within the management scope on the Configure tab.
The page displays security metrics for each member account, including Security Score, Alert Handling, Vulnerability Management, CSPM, Attack Count, and AK Exposure Detection. In the Actions column, click Settings or Delete to manage the corresponding account.
Step 3: (Optional) Allocate quotas
Enterprises can use a delegated administrator account to centrally purchase subscription quotas for Security Center features, and then allocate them to member accounts.
Quota allocation limits
Only delegated administrator accounts can allocate subscription quotas of Security Center to member accounts within their management scope. You can allocate quotas only to member accounts that have not purchased a Security Center subscription instance and have not enabled any pay-as-you-go services other than agentless detection and Serverless security. The following table lists the features that support quota allocation.
Feature | Minimum and increment | Description |
Host and container security: Ultimate Edition server quota, Enterprise Edition server quota, Premium Edition server quota, Anti-virus Edition server quota | Minimum: 1 server or 1 core. Increment: 1 server or 1 core | Unified settlement or quota allocation is not supported for pay-as-you-go instances of Security Center. Quota allocation is not supported for the following features: vulnerability remediation, Security Dashboard, agentless detection (pay-as-you-go only), and Serverless security (pay-as-you-go only). If an allocated member account needs to use vulnerability remediation, assign a Premium Edition, Enterprise Edition, or Ultimate Edition quota and bind it to the corresponding servers. These editions provide unlimited vulnerability remediation. Anti-virus Edition does not support vulnerability remediation. Allocated member accounts cannot use the Security Dashboard feature. If an allocated member account needs to use agentless detection and Serverless security, enable the corresponding pay-as-you-go services for that account. |
Anti-ransomware capacity | Minimum: 10 GB. Increment: 10 GB. After you purchase the managed anti-ransomware service, the anti-ransomware capacity allocated to member accounts uses the managed service capabilities by default. | |
Managed anti-ransomware service | ||
Log analysis capacity | Minimum: 10 GB. Increment: 10 GB | |
Container image scan | Minimum: 20. Increment: 20 | |
Application protection | Minimum: 1. Increment: 1 | |
Cloud honeypot | Minimum: 20. Increment: 20 | |
Web Tamper Protection | Minimum: 1 server. Increment: 1 server | |
CSPM | Minimum: 15,000. Increment: 55,000 | |
Malicious file detection | Minimum: 100,000. Increment: 100,000 | |
Agentic SOC - Log ingestion traffic | Minimum: 100 GB. Increment: 100 GB | |
Agentic SOC - Log storage capacity | Minimum: 1,000 GB. Increment: 1,000 GB |
View and purchase quotas
Log on to the Security Center console by using a delegated administrator account. Log on to Security Center console.
On the Overview page, in the Subscription section, view the subscription quotas of your Security Center instance.
This section displays all features and quotas that you have purchased. For example, for the Subscription displayed to the right of Anti-Ransomware, 150 indicates the total anti-ransomware capacity quota (150 GB) purchased by the current Alibaba Cloud account, and 132.9 indicates the capacity that has been used (including regions in and outside mainland China).
When the remaining anti-ransomware capacity drops below 20%, a prompt appears in the corresponding row showing the remaining capacity and suggesting that you click Expand to purchase more capacity.
To purchase more quotas, click Buy Now or Upgrade Now and complete the purchase.
For more information, see Purchase Security Center and Upgrades and downgrades.
Allocate quotas
The multi-account quota allocation management feature is in beta testing. To use this feature, contact technical support.
Log on to the Security Center console by using a delegated administrator account. Log on to Security Center console.
On the System Configuration > Multi-account Management page, on the Configure tab, click Quota Management under Total Monitored Accounts to go to the Multi-account Quota Management page.
On the Multi-account Quota Management page, click Edit.
Click Add Account. In the Add Account dialog box, select the member accounts to which you want to allocate quotas, and click OK.
You can allocate quotas only to member accounts within the current delegated administrator's management scope. You cannot allocate quotas to unmanaged member accounts or member accounts managed by other delegated administrators.
You can select only member accounts that have not purchased a Security Center subscription instance and have not enabled any pay-as-you-go services other than agentless detection and Serverless security.
In the Quota Management section, allocate quotas to member accounts.
In the Purchased Quota section, view the features and quotas purchased for the current account.
The first account in the Quota Management section shows the remaining allocable quota for the current account. This row cannot be edited, and unallocated quotas are automatically assigned to the current account. When allocating a feature quota to member accounts, the total allocation must not exceed the number initially shown in the first row of that column. After you allocate quotas to member accounts, the first-row value decreases accordingly.
Click Save.
After you allocate server quotas to member accounts, the system automatically binds the allocated quotas to servers in the member account randomly, maximizing quota usage. Additional quotas allocated later are not automatically bound. You must switch to the member account and manually bind the additional quotas. For more information, see Configure protection editions or levels.
Step 4: Manage security configurations and risks for member accounts
View risk overview
View a summary of risk information for member accounts
On the System Configuration > Multi-account Management page, on the Overview tab, view security scores, risky asset counts, security alerts, vulnerabilities, baseline issues, and other statistics for managed member accounts. Identify member accounts with high security risk.
The page supports filtering by Default Sort and Paid accounts only, and fuzzy search by account name, UID, or edition. Security scores are displayed as colored bars by severity: high-risk (0-70), medium-risk (71-95), and safe (above 95).
On the Settings > Multi-account Management page, on the Configure tab, view statistics on security risks within member accounts.
The account list includes CSPM, Attack Count, AK Exposure Detection, and other columns. The CSPM column uses color-coded numeric badges to categorize risk counts for each account.
View risk details for a member account
In the upper-left corner of the Security Center console, switch to a member account to view its security operations information on the Member overview page. For more information, see Overview.
After you switch accounts, in the Security Operations area, view the pending count of CSPM risks and Critical function configuration items in the Risk Governance section.
Manage security configurations and risks for member accounts
Log on to the Security Center console by using a delegated administrator account. Log on to Security Center console.
In the left-side navigation pane, choose . In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
On the System Settings > Multi-account Management page, on the Configure tab, click Settings in the Actions column of a member account.
In the Settings panel, configure agent settings, vulnerability and baseline scan settings for the member account, and click OK.
Agent Management: Configure security defense capabilities and alert settings.
Vulnerability Management: Configure vulnerability scanning settings for the member account. For metric description, see Vulnerability scanning.
Baseline Check: Configure baseline check policies for the member account. For metric description, see Configure and run baseline check policies.
On the Host Protection Settings tab, the Proactive Defense area contains the following configuration items: Malicious Host Behavior Defense, Anti-ransomware (Bait Capture), Web Backdoor Connection Defense, Malicious Network Behavior Defense, and Proactive Defense Experience Optimization. You can enable or disable each feature switch and configure the defense scope. The tab also includes the Web Backdoor Removal and Adaptive Threat Detection areas. Click Next after you complete the configuration.
On the Configure tab of the Multi-account Management page, click the member account name to switch to the console of that account.
After the switch, the delegated administrator can perform asset inventory, risk detection, security hardening, real-time protection, and active detection and response. For an overview of Security Center features, see Features.
More operations
Use allocated quotas
After a Security Center delegated administrator allocates quotas to member accounts, the member accounts can use the allocated quotas. If quotas are insufficient, member accounts can contact the management account for additional allocation. Member accounts cannot purchase, renew, or upgrade Security Center instances. The delegated administrator or member accounts can follow the instructions below to use each feature's quota and avoid wasting quotas. Member accounts must complete the service-linked role authorization on their own.
Configure protection editions or levels: On the Overview or Host page, view and manage server protection quotas, including Ultimate Edition server quota, Enterprise Edition server quota, Premium Edition server quota, and Anti-virus Edition server quota.
Anti-ransomware: Create mitigation policies to back up core data files on servers or databases. For instructions, see the following topics:
Log analysis: Delivery of all log types is enabled by default. No manual action is required.
Delegated administrator accounts cannot use the log analysis feature of member accounts by switching accounts in the upper-left corner of the console. Member accounts must log on to their own console to use the log analysis feature.
Container image scan: After you perform an image scan, the corresponding quota is used to detect security risks in the image.
Application protection: You must add your application to application protection.
Cloud honeypot: Deploy cloud honeypots on servers to capture attacks.
File tamper-proofing: Add protection to servers to prevent malicious content from being injected into websites and ensure normal website operation.
CSPM: Configure risk check policies for cloud product configurations, system baseline risk check policies, and attack path scan rules to perform CSPM.
Malicious file detection: Detect malicious files by calling the SDK on servers to scan offline files, or by scanning files stored in OSS from the Security Center console.
Agentic SOC log storage capacity: Enable Security Center log and standardized log delivery. For more information, see Log management.
Agentic SOC log ingestion traffic: Ingest cloud product logs into Agentic SOC. For more information, see Product logs.
Delete a member account
After a member account has been allocated quotas, both deleting the member account and deleting the quota allocation for the member account will remove the allocated quotas. All assets under the member account will lose protection, the system will automatically release all quotas, and logs will be cleared. Proceed with caution.
Log on with the delegated administrator account, go to the System Configuration > Multi-account Management page, on the Configure tab, and click Delete in the Actions column of a member account to remove it.
Delete a quota allocation for a member account
Deleting a quota allocation removes all allocated quotas from the member account. All assets under the account will lose protection, the system will automatically release all quotas, and logs will be cleared. Proceed with caution.
Log on with the delegated administrator account, go to the Overview page, and in the Subscription section, click Multi-account Management. In the Quota Management section, move the pointer over the account name, click the
icon, and click OK in the confirmation dialog box.
References
If you are using the Agentic SOC 1.0 architecture (you set up a delegated administrator for Security Center - Threat Analysis for multi-account management), see Centralized multi-account management for operational guidance.
If you are using the Agentic SOC 2.0 architecture, see Multi-account management for instructions on building a multi-account security management system.
For instructions on how an authorized member account can purchase Security Center independently, see How can an authorized member account independently purchase Security Center?
FAQ
How do I add ECS instances of a member account to the Security Center of the Alibaba Cloud account for centralized management?
Use the multi-account security management feature of Security Center. Log on to the Security Center console with the delegated administrator account and go to System Configuration > Multi-account Management. On the Configure tab, click the target member account name to switch to its console and view its ECS instances and other assets. Unlike Cloud Firewall, Security Center does not require a separate instance purchase for the member account. You can view and manage all assets by switching accounts.