Security Center:Onboard Volcengine assets using an AccessKey

Prerequisites

Before you begin, ensure that you have:

• An active Volcengine main account

• Sufficient permissions to create and manage AccessKeys in the Volcengine console

Step 1: Create a main account key

For more information, see API Access Key Management.

1. Log on to the Volcengine console and go to the API Access Keys page. On the AK Leak Detection page, click Create Key.

2. In the Create Key dialog box, click Continue and complete identity authentication as prompted.

3. In the Key Created Successfully dialog box, click Download Credentials.

Save the AccessKey ID and SecretAccessKey from the downloaded file.

Step 2: Submit the main account AK

1. Log on to the Security Center consoleSecurity Center console.Log on to the Security Center console.

2. In the navigation pane, choose System Settings > Feature Settings. In the top-left corner, select the region where your assets reside: Chinese Mainland or Outside Chinese Mainland.

3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission and select Volcano Engine from the drop-down list. Alternatively, go to Assets > Host, hover over the icon in the Add Multi-cloud Asset area, and click Volcano Engine below Add to open the Add Assets Outside Cloud panel.

4. In the Add Assets Outside Cloud panel, select Quick Configuration and click Next

5. On the Submit AccessKey Pair wizard page, enter the AccessKey ID, SecretAccessKey, and an account name, then click Next. Use a descriptive account name to distinguish assets from different accounts of the same cloud provider.

Step 3: Configure the provisioning policy

1. In the Policy Configuration wizard, configure the following settings for the Volcengine assets to be provisioned, then click OK.

   Parameter	Description
   Select region	Select the region where the assets are located. Security Center provisions the asset data to the data management center corresponding to the region you selected in the upper-left corner of the console (China or Outside China).
   Region Management	If selected, when a new region is added to the current Volcengine account, Security Center automatically provisions the asset data from the new region. If not selected, assets in new regions are not provisioned to Security Center.
   Host Asset Synchronization Frequency	The interval at which Security Center automatically synchronizes Volcengine host assets. Select Close to turn off synchronization.
   AK Service Status Check	The interval at which Security Center automatically checks the validity of the Volcengine account's AccessKey. Select Close to turn off the check.

2. Click Synchronize Assets to sync all host assets from the Volcengine account to Security Center.

After the provisioning policy is configured, Security Center automatically creates a user with the prefix AlibabaSas_

Step 4: Delete the main account key

After provisioning completes, delete the main account AccessKey from the Volcengine console to reduce the security risk associated with long-lived main account credentials.

For more information, see API Access Key Management.

1. Log on to the Volcengine console and go to the API Access Keys page. For the AccessKey submitted in Security Center, click Disable in the Actions column.

2. In the Are you sure that the AccessKey pair is disabled? dialog box, click OK and complete identity authentication as prompted.

3. On the AccessKey Leak Detection page, click Delete for the target AccessKey and follow the prompts to complete deletion.

Prerequisites

Before you begin, ensure that you have:

• An active Volcengine main account with permissions to create IAM users and assign access policies

• Sufficient permissions to manage AccessKeys in the Volcengine console

Step 1: Create a sub-account and get an AK

For more information, see User Management.

1. Log on to the Volcengine console and go to the Users page. Click Add.

2. On the Create User page, click Create by Username.

3. Enter a Username. Set Access method to Programmatic Access and click Next.

4. On the Access Policy tab, select the permission policies required for the Security Center features you plan to use, then click Next. These policies grant the sub-account read-only access to your Volcengine resources, allowing Security Center to scan and monitor your assets.

   For CSPM, you can assign the global read-only policy ReadOnlyAccess instead of the individual policies listed above. This ensures CSPM can detect new assets and properties automatically when Volcengine adds new services, without requiring manual permission updates.

   Feature	Required permission policies
   Host	IAMReadOnlyAccess, ECSReadOnlyAccess
   CSPM	ALBReadOnlyAccess, AdvDefenceReadOnly, CLBReadOnlyAccess, CRReadOnlyAccess, CloudFirewallReadOnlyAccess, CloudIdentityReadOnlyAccess, ECSReadOnlyAccess, HBaseReadOnlyAccess, IAMReadOnlyAccess, KMSReadOnlyAccess, MCDNReadOnlyAccess, MongoDBReadOnlyAccess, NATReadOnlyAccess, RDSMSSQLReadOnlyAccess, RDSMySQLReadOnlyAccess, RDSPGReadOnlyAccess, RedisReadOnlyAccess, SecCenterReadOnlyAccess, TOSReadOnlyAccess, VBHReadOnlyAccess, VKEReadOnlyAccess, VPCReadOnlyAccess, VedbMysqlReadOnlyAccess, VeenReadOnlyAccess, WafReadOnlyAccess, AgentKitReadOnlyAccess, IDReadOnlyAccess, ArkReadOnlyAccess

5. After confirming the user information, click Bind Account and Go to Bind Data Source.

6. In the User Information section, click Save and Download CSV or the icon to save the AccessKey ID and SecretAccessKey.

Step 2: Submit the sub-account AK

1. Log on to the Security Center consoleSecurity Center console.Log on to the Security Center console.

2. In the navigation pane, choose System Settings > Feature Settings. In the top-left corner, select the region where your assets reside: Chinese Mainland or Outside Chinese Mainland.

3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission and select Volcano Engine from the drop-down list. Alternatively, go to Assets > Host, hover over the icon in the Add Multi-cloud Asset area, and click Volcano Engine below Add to open the Add Assets Outside Cloud panel.

4. In the Add Assets Outside Cloud panel, keep Manual Configuration selected. In the Permission Description section, select Host and click Next.

5. On the Submit AccessKey Pair wizard page, enter the sub-account AccessKey ID, SecretAccessKey, and an account name, then click Next. Use a descriptive account name to distinguish assets from different accounts of the same cloud provider.

Step 3: Configure the provisioning policy

1. In the Policy Configuration wizard, configure the following settings for the Volcengine assets to be provisioned, then click OK.

   Parameter	Description
   Select region	Select the region where the assets are located. Security Center provisions the asset data to the data management center corresponding to the region you selected in the upper-left corner of the console (China or Outside China).
   Region Management	If selected, when a new region is added to the current Volcengine account, Security Center automatically provisions the asset data from the new region. If not selected, assets in new regions are not provisioned to Security Center.
   Host Asset Synchronization Frequency	The interval at which Security Center automatically synchronizes Volcengine host assets. Select Close to turn off synchronization.
   AK Service Status Check	The interval at which Security Center automatically checks the validity of the Volcengine account's AccessKey. Select Close to turn off the check.

2. Click Synchronize Assets to sync all host assets from the Volcengine account to Security Center.

Host assets

Go to Assets > Host. In the Add Multi-cloud Asset area, click the icon to view the list of provisioned Volcengine assets.

For more information, see Host assets.

To apply protection to your provisioned hosts:

1. Install the Security Center client: The default Free Edition provides only basic security checks. To enable advanced detection capabilities, install the Security Center client on your Volcengine hosts. For more information, see Install the client.

2. Upgrade for advanced protection: To get comprehensive security coverage — including antivirus, vulnerability remediation, and intrusion prevention — attach the Anti-virus Edition or a higher edition to your Volcengine hosts. For more information, see Manage authorizations for hosts and containers.

Cloud Security Posture Management (CSPM)

CSPM is available only for assets onboarded using manual configuration. For more information, see View cloud product information.

In the Security Center console, go to Assets > Cloud Product. In the All Alibaba Cloud Services navigation pane, click Volcengine to view your connected assets.

The following CSPM features are available for connected Volcengine assets:

1. Run a configuration risk check: Identify configuration risks in your Volcengine products. For more information, see Set and execute cloud platform configuration risk check policies.

2. Address risk items: Review and fix failed risk checks to improve the compliance and security of your cloud assets. For more information, see View and address failed cloud platform configuration risk checks.