Security Center:Accessing AWS assets using an access key

Step 1: Create credentials for your AWS root user

1. Log on to the AWS IAM console

   Log in to the AWS IAM console. On the dashboard, click My Security Credentials.

   Important

   Only the root user can configure security credentials.

2. Create an access key

   On the My Security Credentials page, after you complete the configuration as described below, click Create Access Key.

   • Use case: Select a use case based on your business scenario. If no option is suitable, select Other.

   • The tag can contain up to 256 characters, including letters, numbers, spaces, and the following symbols: _ . : / = + - @.

3. Save the key

   After the creation is complete, go to the Retrieve Access Key page to view and save the Access Key (Access Key ID) and Secret Access Key (Secret Access Key).

   Note

   You can click Download .csv file to save the key locally.

Step 2: Onboard your assets in Security Center

1. Go to the authorization page:

   Navigate to the AWS asset onboarding page in one of the following ways:

   • Recommended path:

     1. Log on to the Security Center console.

     2. In the left-side navigation pane, choose System Settings > Feature Settings. In the upper-left corner of the console, select the region where the assets you want to protect are located: Chinese Mainland or Outside Chinese Mainland.

     3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission, and then select AWS.

   • Other paths:

     In the Multi-cloud Service Access or Add Multi-cloud Asset area on the following page, find and click the Access or Authorize button below the icon:

     • Assets > Host

     • Risk Governance > CSPM > Cloud Service Configuration Risk

     • Agentic SOC > Service Integration

     • Protection Configuration > Host Protection > Agentless Detection

2. Configure access credentials:

   1. In the Add Assets Outside Cloud panel, select the Quick Configuration, select the features you want to use, and then click Next.

   2. On the Submit AccessKey Pair page, enter the credential information that you created in AWS.

      • Sub-user SecretID and Sub-user SecretKey: Enter the credentials from Step 1: Create root user authorization credentials in AWS.

      • Provisioning Region: Select an available AWS Region. The system will use the selected region to verify that your assets are accessible.

      • Domain: Set this parameter based on the selected Provisioning Region. Select "China version" for AWS China agents and "International version" for all other users.

   3. After you enter the information, click Next. The system automatically checks the credentials and permissions.

      Note

      If the check fails, see What do I do if the automatic credential and permission check fails after I enter the access key?

3. Configure the synchronization policy:

   • Select region: Select the regions containing the AWS assets that you want to onboard.

     Note

     Synchronized asset data is stored in the data center corresponding to the region selected in the Security Center console.

     • Chinese Mainland: Data centers in the Chinese mainland.

     • Outside Chinese Mainland: The data center in Singapore.

   • Region Management: This option is recommended. If you select this option, assets in new regions under this AWS account are automatically synchronized without manual intervention.

   • Host Asset Synchronization Frequency: Set the interval for automatically synchronizing AWS host (EC2) assets. To disable synchronization, select Off.

   • AK Service Status Check: Set the interval at which Security Center automatically checks the validity of the API key for the AWS account. You can set this to Off to disable the check.

4. After you complete the configuration, click Synchronize Assets. The system automatically synchronizes the host assets from your AWS account to Security Center.

   Important

   After you complete these operations, Security Center automatically creates an IAM user in AWS with a username prefixed with AlibabaSasSubAccount_ for authorization. Do not delete or disable the automatically created IAM user account or its API key. Otherwise, asset onboarding and security monitoring will be interrupted.

Step 3: Delete the root user access key

After the assets are successfully onboarded, immediately delete the root user's access key used for the initial authorization to reduce security risks.

1. Sign in to the AWS IAM console as a root user, and on the dashboard, click My Security Credentials.

2. In the AccessKey Pair section, locate the key used for this authorization. In the Actions column, click the Delete button and confirm the deletion.

Step 1: Create IAM credentials in AWS

Create an IAM user with least-privilege permissions for Alibaba Cloud Security Center integration and obtain its access key.

1. Log on to the AWS IAM console

   Sign in to the AWS IAM console. In the left navigation bar, click Users. On the User list page, click Create user.

2. Specify user details

   • Username: Enter a custom name that is easy to identify (for example, aliyun-security-center-user).

   • Provide user access to the AWS Management Console: Do not select. This user is for API access only.

3. Set user permissions

   • Select Attach policies directly.

   • Select the permission policies for the Security Center features you want to use.

     Feature	AWS policy	Notes
     Host	AmazonEC2ReadOnlyAccess IAMReadOnlyAccess	None
     CSPM (CSPM)	ReadOnlyAccess IAMReadOnlyAccess	To perform comprehensive risk detection based on audit logs, see Configure AWS service audit logs for CSPM to configure the relevant service audit logs in AWS.
     Agentless Detection	You must create a custom policy.	You must create a log delivery pipeline in AWS that consists of CloudTrail, S3, and SQS. For more information, see Create a custom policy for agentless detection.

     

4. Review and create

   Confirm that the user information and permission policy are correct, and then click Create User.

5. Create and save the API key

   1. After the user is successfully created, return to the User list and click the username that you just created to open its details page.

   2. In the Summary section, click Create Access Key and configure the key as described below.

      1. Use Cases: Select a use case based on your business scenario. If none of the use cases are suitable, select Others.

      2. Description tag: You can leave this blank or specify a custom tag (such as for-aliyun-sasc).

   3. Click Create Access Key. On the Retrieve Access Key page, view and save the Access Key ID and Secret Access Key.

   

Step 2: Complete configuration in Security Center

After you create an API key for the IAM user in AWS, return to the Security Center console to complete the onboarding configuration.

1. Go to the authorization page

   Note

   For information about other entry points, see Other paths.

   1. Log on to the Security Center console.

   2. In the left-side navigation pane, choose System Settings > Feature Settings. In the upper-left corner of the console, select the region where the assets you want to protect are located: Chinese Mainland or Outside Chinese Mainland.

   3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission, and then select AWS.

2. Configure access credentials

   1. In the Add Assets Outside Cloud panel, select the Manual Configuration, select the features you want to use, and then click Next.

      • Host: Allows Security Center to automatically discover and synchronize your AWS EC2 host assets.

      • CSPM: Uses the cloud security posture management feature to scan the configurations of your AWS cloud products to discover and manage configuration risks.

      • Agentless Detection: Uses the agentless detection feature to scan your AWS assets for vulnerabilities and risks.

   2. On the Submit AccessKey Pair page, enter the credential information that you created in AWS.

      • Sub-account SecretID and Sub-account SecretKey: Enter the credentials that you obtained in Step 1: Create sub-account authorization credentials in AWS.

      • Provisioning Region: Select an available AWS Region. The system will use the selected region to verify that your assets are accessible.

      • Domain: Set this parameter based on the selected Provisioning Region. Select "China version" for AWS China agents and "International version" for all other users.

   3. After you enter the information, click Next. The system automatically checks the credentials and permissions.

      Note

      If the check fails, see What do I do if the automatic credential and permission check fails after I enter the access key?

3. Configure audit logs (optional)

   If you need to use the log audit feature of Cloud Security Posture Management (CSM), configure it here. Otherwise, click Skip.

   Important

   Before you proceed, you must complete all the required configurations in the AWS console. For more information, see Configure AWS service audit logs for CSPM.

   • AWS Region: Enter the Region ID of the AWS queue. For a list of Region IDs, see AWS Region IDs.

   • SQS Queue Name: Enter the name of the created SQS queue.

4. Configure the synchronization policy

   On the Policy Configuration page, configure the following settings based on your needs:

   • Select region: Select the regions containing the AWS assets you want to onboard.

     Note

     Synchronized asset data is stored in the data center corresponding to the region selected in the Security Center console.

     • Chinese Mainland: Data centers in the Chinese mainland.

     • Outside Chinese Mainland: The data center in Singapore.

   • Region Management: This option is recommended. If you select this option, assets in new regions under this AWS account are automatically synchronized without manual intervention.

   • Host Asset Synchronization Frequency: Set the interval for automatically synchronizing AWS host (EC2) assets. To disable synchronization, select Off.

     Note

     This parameter is required only if you chose to onboard Host.

   • Cloud Service Synchronization Frequency: Set the interval for automatically synchronizing AWS cloud product configurations. To disable synchronization, select Off.

     Note

     This parameter is required only if you chose to onboard Cloud Security Posture Management.

   • AK Service Status Check: Set the interval at which Security Center automatically checks the validity of the API key for the AWS account. You can select Off to disable this check.

5. After you complete the configuration, click Synchronize Assets. The system automatically synchronizes data from your AWS account to Security Center.

Host assets

Go to the Assets > Host page. In the Add Multi-cloud Asset section, click the icon to view the onboarded AWS hosts. You can manage the onboarded AWS EC2 hosts and enhance their protection as follows.

1. Install the client: Install the Security Center client on your AWS hosts. When you run the installation command, you must select AWS as the Service Provider. For more information, see Install the client.

2. Upgrade to a paid edition for enhanced protection: The default Free edition provides only basic security checks. To get comprehensive security capabilities, such as anti-virus, vulnerability fixing, and intrusion prevention, upgrade the protection for your AWS hosts to a paid edition (Anti-virus or higher). For more information, see Manage security authorizations for hosts and containers.

Cloud security posture management (CSPM)

In the Security Center console, go to the Assets > Cloud Product page. In the All Alibaba Cloud Services navigation pane, click AWS to view your onboarded AWS assets. You can use the following CSPM features for the onboarded AWS assets:

1. Perform a configuration risk check: Check your AWS products for configuration risks. For more information, see Configure and run a cloud platform configuration risk check policy.

2. Handle risk items: View and fix failed risk items based on the check results to improve the compliance and security of your cloud assets. For more information, see View and handle failed cloud platform configuration risk check items.

Agentless detection

In the Security Center console, go to the Protection Configuration > Host Protection > Agentless Detection page. In the Add Multi-cloud Asset section, click the icon to view the number of onboarded AWS assets. After the assets are onboarded, you can use the agentless detection feature to scan AWS hosts for vulnerabilities and baselines.