Security Center:Onboard Huawei Cloud assets

1. Create a user group and grant permissions

For details, see Create a User Group and Grant Permissions.

1. Log on to the Huawei Cloud console and go to the User Groups page. In the upper-right corner of the User Groups page, click Create User Group.

2. On the Create User Group page, enter a user group name and description, and click OK.

3. On the User Groups page, click Authorize in the Actions column for the newly created user group.

4. Grant the corresponding permissions based on the features you want to use, and click Next.

   • Host assets:

     • ECS ReadOnlyAccess: read-only permission for Elastic Cloud Server.

     • IAM ReadOnlyAccess: read-only permission for Identity and Access Management (IAM).

   • Cloud Security Posture Management:

     • Tenant Guest: read-only permission for all cloud services (excluding IAM permissions).

     • IAM ReadOnlyAccess: read-only permission for Identity and Access Management (IAM).

   • Agentic SOC: Click Create Policy to create two custom policies named siemBasePolicy and siemNormalPolicy. Then grant these policies to the current user group. For details, see Create a Custom Policy.

     Note

     To create a custom policy in Huawei Cloud, you need to create both a global-level and a project-level policy to facilitate minimum permission scoping during authorization.

     • The siemBasePolicy corresponds to global-level cloud service permissions. The policy content is as follows:

       {
           "Version": "1.1",
           "Statement": [
               {
                   "Effect": "Allow",
                   "Action": [
                       "iam:roles:listRoles",
                       "iam:roles:getRole",
                       "iam:groups:listGroupsForUser",
                       "iam:groups:listGroups",
                       "iam:users:getUser",
                       "iam:groups:getGroup"
                   ]
               },
               {
                   "Effect": "Allow",
                   "Action": [
                       "rms:resources:list",
                       "rms:resources:summarize"
                   ]
               },
               {
                   "Effect": "Allow",
                   "Action": [
                       "obs:object:GetObject",
                       "obs:bucket:GetBucketLocation",
                       "obs:bucket:HeadBucket",
                       "obs:object:GetObjectVersionAcl",
                       "obs:bucket:ListAllMyBuckets",
                       "obs:bucket:ListBucket",
                       "obs:object:GetObjectVersion",
                       "obs:object:GetObjectAcl"
                   ]
               }
           ]
       }

     • The siemNormalPolicy corresponds to project-level cloud service permissions. The policy content is as follows:

       {
           "Version": "1.1",
           "Statement": [
               {
                   "Effect": "Allow",
                   "Action": [
                       "cfw:ipGroup:list",
                       "cfw:acl:list",
                       "cfw:ipMember:put",
                       "cfw:ipMember:create",
                       "cfw:ipGroup:create",
                       "cfw:instance:get",
                       "cfw:ipGroup:put",
                       "cfw:ipMember:list",
                       "cfw:ipGroup:get",
                       "cfw:ipMember:delete"
                   ]
               },
               {
                   "Effect": "Allow",
                   "Action": [
                       "waf:whiteBlackIpRule:list",
                       "waf:whiteBlackIpRule:put",
                       "waf:ipgroup:get",
                       "waf:whiteBlackIpRule:get",
                       "waf:ipgroup:list",
                       "waf:whiteBlackIpRule:create",
                       "waf:whiteBlackIpRule:delete"
                   ]
               }
           ]
       }

5. In the Select Authorization Scope Plan section, select All Resources and click OK.

2. Create an IAM user and obtain an AK

For details, see Create an IAM User.

1. In the Huawei Cloud console, go to the Users page. In the upper-right corner of the Users page, click Create User.

2. On the Create User page, enter a username, select Programmatic Access for Access Mode, and click Next.

   Set the username to AccessToAliSAS and select Access Key for the credential type.

3. On the Add to User Group (Optional) wizard page, select the user group created in the previous step and click Create User.

4. In the Download Access Key dialog box, click OK.

   Save the Access Key Id and Secret Access Key from the credentials file.

3. Permission description and submit sub-account AK

1. Log on to the Security Center console.

2. In the navigation pane on the left, select System Settings > Feature Settings. In the upper-left corner of the console, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission and select Huawei Cloud from the drop-down list.

   You can also open the Add Assets Outside Cloud panel from any of the following entry points:

   • On the Assets > Host page, move the pointer over the Add Multi-cloud Asset area icon, and click Add below Huawei Cloud.

   • On the Cloud Service Configuration Risk tab of the Risk Governance > Cloud Security Posture Management page, move the pointer over the Multi-cloud Service Integration area icon, and click Add below Huawei Cloud.

   • On the Agentic SOC > Service Integration page, move the pointer over the Multi-cloud Service Access area icon, and click Grant Permission below Huawei Cloud.

4. In the Add Assets Outside Cloud panel, keep the default selection Manual Configuration. Based on the Security Center capabilities you need, select the corresponding features in Permission Description and click Next.

   • Host: Select this option if you want Security Center to automatically synchronize Huawei Cloud host assets. After selecting this option, you need to grant the sub-account used for onboarding the read permission for cloud servers in subsequent steps.

   • CSPM: Select this option if you need to use Cloud Security Posture Management to scan Huawei Cloud product configurations and manage cloud product configuration risks.

   • Agentic SOC: Select this option if you need to use Agentic SOC to coordinate with Huawei Cloud assets for response actions such as malicious IP blocking.

5. On the Submit AccessKey Pair wizard page, enter the obtained sub-account AK and SK, and click Next.

   The account name is used to distinguish different accounts under the same cloud provider. We recommend that you set a name with a clear meaning based on its purpose.

   Important

   Do not delete or disable the sub-account or its AK, as this may affect onboarding.

4. Complete onboarding policy configuration

1. In the Add Assets Outside Cloud panel of the Security Center console, configure the region, data synchronization frequency, and other parameters for the Huawei Cloud assets to be onboarded in the Policy Configuration wizard, and click OK.

   Parameter	Description
   Select region	Select the region to which the assets to be onboarded belong. Security Center onboards the asset data under the current account to the corresponding data center based on the data center you select in the upper-left corner of the console (China or Outside China).
   Region Management	After you select this option, if new regions are added under the current Huawei Cloud account, Security Center automatically onboards the asset data from the new regions to the current data center. If you do not select this option, assets from new regions will not be onboarded to Security Center.
   Host Asset Synchronization Frequency	Select the interval at which Security Center automatically synchronizes Huawei Cloud host assets. If you select Disable, synchronization is turned off. Note This parameter must be configured when Permission Description is set to Host.
   Cloud Service Synchronization Frequency	Select the interval at which Security Center automatically synchronizes Huawei Cloud cloud products. If you select Disable, synchronization is turned off. Note This parameter must be configured when Permission Description is set to CSPM.
   AK Service Status Check	Select the interval at which Security Center automatically checks the validity of the Huawei Cloud account API key. If you select Disable, the check is not performed.

2. Click Synchronize Assets to synchronize all assets from your Huawei Cloud account to Security Center.

1. Create a primary account access key

For details, see Add an Access Key.

1. Log on to the Huawei Cloud console and go to the Access Keys page.

2. Click Add Access Key. In the dialog box, select I understand the risks that creating an access key may bring to my account and click Continue.

3. In the Created dialog box, click Download Now.

   Save the Access Key Id and Secret Access Key from the credentials file.

2. Submit primary account AK

1. Log on to the Security Center console.

2. In the navigation pane on the left, select System Settings > Feature Settings. In the upper-left corner of the console, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission and select Huawei Cloud from the drop-down list.

   You can also open the Add Assets Outside Cloud panel from any of the following entry points:

   • On the Assets > Host page, move the pointer over the Add Multi-cloud Asset area icon, and click Add below Huawei Cloud.

   • On the Cloud Service Configuration Risk tab of the Risk Governance > Cloud Security Posture Management page, move the pointer over the Multi-cloud Service Integration area icon, and click Add below Huawei Cloud.

   • On the Agentic SOC > Service Integration page, move the pointer over the Multi-cloud Service Access area icon, and click Grant Permission below Huawei Cloud.

4. In the Add Assets Outside Cloud panel, select Quick Configuration and click Next.

5. On the Submit AccessKey Pair wizard page, enter the obtained account AccessKeyId, SecretAccessKey, and account name, and click Next.

   The account name is used to distinguish different accounts under the same cloud provider. We recommend that you set a name with a clear meaning based on its purpose.

After completing the preceding operations, Security Center automatically creates a user and user group with the prefix AlibabaCloudGroup_ in the Huawei Cloud console to complete the authorization for onboarding to Security Center. We recommend that you do not delete or disable this user and its AK, as this may affect the onboarding of Huawei Cloud assets.

3. Complete onboarding policy configuration

1. In the Add Assets Outside Cloud panel of the Security Center console, configure the region, data synchronization frequency, and other parameters for the Huawei Cloud assets to be onboarded in the Policy Configuration wizard, and click OK.

   Parameter	Description
   Select region	Select the region to which the assets to be onboarded belong. Security Center onboards the asset data under the current account to the corresponding data center based on the data center you select in the upper-left corner of the console (Chinese Mainland or Outside Chinese Mainland).
   Region Management	After you select this option, if new regions are added under the current Huawei Cloud account, Security Center automatically onboards the asset data from the new regions to the current data center. If you do not select this option, assets from new regions will not be onboarded to Security Center.
   Host Asset Synchronization Frequency	Select the interval at which Security Center automatically synchronizes Huawei Cloud host assets. If you select Disable, synchronization is turned off.
   AK Service Status Check	Select the interval at which Security Center automatically checks the validity of the Huawei Cloud primary account AccessKey. If you select Disable, the check is not performed.

2. Click Synchronize Assets to synchronize all host assets from your Huawei Cloud account to Security Center.

4. Delete the primary account access key

For details, see Delete an Access Key.

1. Log on to the Huawei Cloud console and go to the Access Keys page.

2. Click Disable in the Actions column for the access key, and click OK in the dialog box.

3. Click Delete in the Actions column for the access key, and click OK in the dialog box.

Host

In the Security Center console, go to the Assets > Host page. In the multi-cloud asset onboarding area, click the icon to view the onboarded Huawei Cloud hosts. For more information, see Server assets.

CSPM

In the Security Center console, go to the Assets > Overview > Cloud Product page to view the list of Huawei Cloud products that have been onboarded via sub-account. For more information, see View cloud service information.

Agentic SOC

In the Security Center console, go to the System Settings > Feature Settings page. On the Multi-cloud Configuration Management tab, check the service status of Agentic SOC. If the service status shows Normal, the onboarding is successful. On the Multi-cloud Configuration page, select the Multi-cloud Assets tab to view the list of authorized cloud accounts (including cloud provider, account name, key ID, service status, usage status, and other columns). Click Add Authorization to add a cloud account. Expand a Huawei Cloud account record to view permission details: the service status for Read-only Access to Services and Resources Under Account shows Abnormal, while the service status for Threat Analysis - Read and Partial Write Permissions for All Cloud Products shows Normal. You can manage authorizations using the Modify and Delete links in the Actions column.

Install the Agent and bind a license for host

1. Install the Security Center agent on your Huawei Cloud assets. For more information, see Install the agent.

   Important

   When generating the installation command, you must select Huawei Cloud for Service Provider.

2. The Free edition supports only basic security scanning and has no protection capabilities. You can bind a paid edition of Security Center (such as Anti-virus, Advanced, Enterprise, or Ultimate) to your onboarded Huawei Cloud servers to use the security protection capabilities of Security Center. For more information, see Manage host and container security quotas.

Run CSPM Check

1. Set and run a cloud platform configuration risk check policy to check whether configuration risks exist in your Huawei Cloud products.

2. View and handle failed cloud platform configuration risk check items.

Ingest logs into Agentic SOC

You need to ingest logs from Huawei Cloud Web Application Firewall and Cloud Firewall to use the threat detection, security event response, and other capabilities provided by Agentic SOC. The steps to ingest logs are as follows:

1. Ingest Huawei Cloud logs into Agentic SOC.

   1. Transfer logs to be ingested to a specified cloud product.

   2. Bind a third-party cloud account and configure a data source.

   3. Ingest logs from third-party cloud products.

2. Use Agentic SOC capabilities such as threat detection and security event response.