How to obtain an access token and create and authorize a RAM user - Security Center

When you integrate the image security scanning plug-in of Security Center into Jenkins or GitHub, you must enter the token of the CI/CD plug-in and the AccessKey pair of your Alibaba Cloud account or a RAM user. This topic describes how to create a CI/CD plug-in and obtain an access token, and how to create a dedicated RAM user for image security scanning in Security Center.

Obtain an access token

Log on to Security Center console.In the left-side navigation pane, choose Protection Configuration > Container Protection > CI/CD Integration Settings.
On the CI/CD Integration Settings page, click CI/CD Integration Settings to expand the panel.
In the Integration Configuration panel, click Add Token, enter a token name (up to 64 characters in length), and then click OK.
The newly created token is displayed in the plug-in list of the Integration Configuration panel. You can view and obtain the access token in the Token column of the token list.

Create and authorize a RAM user

Create a RAM user for image security scanning in Security Center. For more information, see Create a RAM user.
Note
Set Access Mode to OpenAPI Access when you create the RAM user.

Create a dedicated permission policy for image security scanning in Security Center. For more information, see Create a custom policy by using the script editor.

The following code block shows the policy script:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "yundun-sas:CreateJenkinsImageScanTask",
        "yundun-sas:ListImageAnalysisRuleProject",
        "yundun-sas:SubmitImageAnalysisOutput",
        "yundun-sas:UpdateJenkinsImageScanTaskStatus",
        "yundun-sas:UploadAnalyzerRuntimeLog",
        "yundun-sas:CreateBatchUploadURL"
      ],
      "Resource": "*"
    }
  ]
}

Attach the policy to the new RAM user. For more information, see Manage permissions of a RAM user.