Web Application Firewall:Use the multi-account management feature

Limitations

• A WAF instance of the Enterprise or Ultimate edition must be purchased. Other WAF editions do not support the multi-account management feature.

• A management account and members must belong to the same resource directory and enterprise entity. The enterprise entity must pass the enterprise real-name verification.

• A member cannot be used to purchase a WAF instance. If a running WAF instance belongs to a member, you must release the instance before you can use the multi-account management feature.

• After you add the cloud resources of a member to a WAF instance that belongs to the delegated administrator account, you can view protection configurations, overview data, and security reports in the WAF console only by using the delegated administrator account.

• If you use the delegated administrator account to delete a member, the system automatically removes the cloud resources of the member from WAF.

Procedure

Before you can use the multi-account management feature to add multiple members for centralized management, you must enable a resource directory, specify a delegated administrator account, and invite members to join the resource directory.

Step 1: Enable a resource directory

Before you use the multi-account management feature, you must add multiple Alibaba Cloud accounts to a resource directory. For more information about Resource Directory, see Resource Directory overview.

Log on to the Resource Management console by using an Alibaba Cloud account and enable a resource directory. The Alibaba Cloud account is the management account of the resource directory. For more information, see Enable a resource directory.

Step 2: Invite members

After an Alibaba Cloud account is invited to join a resource directory, the account becomes a member of the resource directory. You can specify the invited member as a delegated administrator account.

Log on to the Resource Management console and use the management account to invite members. For more information, see Create a folder and Invite an Alibaba Cloud account to join a resource directory.

Step 3: Add a delegated administrator account

Delegated administrator accounts allow you to separate organization management tasks from business management tasks. The management account of a resource directory is used to perform the organization management tasks of the resource directory. Delegated administrator accounts are used to perform the business management tasks of the related trusted services. This meets security-related requirements. You can use a delegated administrator account to access the multi-account management feature and perform management operations within the resource directory. For more information, see Manage a delegated administrator account.

Step 4: Add members

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and the region in which the WAF instance is deployed. You can select Chinese Mainland or Outside Chinese Mainland for the region.

2. In the left-side navigation pane, choose Security Operations > Multi-account Management.

3. On the Multi-account Management page, click Add Member.

4. In the Add Member dialog box, select the members that you want to add and move the members from the Available Members section to the Selected Members section.

5. In the Selected Members section, select the members and click OK.

   

Step 5: Add the cloud resources of members to WAF

The method that you can use to add cloud resources to WAF varies based on the cloud service.