Web Application Firewall:Use the multi-account management feature

Limits

• You must use a Web Application Firewall (WAF) instance that runs the Enterprise or Ultimate edition. Other editions do not support the multi-account management feature.

• A management account and members must belong to the same resource directory and enterprise entity. The enterprise entity must pass the enterprise real-name verification.

• If you use a management account to purchase a WAF instance in the Chinese mainland, members cannot separately purchase a WAF instance in the Chinese mainland. However, members can purchase a WAF instance outside the Chinese mainland. If a running WAF instance belongs to a member, you must release the instance before you can use the multi-account management feature.

• After you add the cloud resources of a member to a WAF instance that belongs to the delegated administrator account, you can view protection configurations, overview data, and security reports in the WAF console only by using the delegated administrator account.

• If you use the delegated administrator account to delete a member, the system automatically removes the cloud resources of the member from WAF.

Configuration process

Before you can use the multi-account management feature to add multiple members for centralized management, you must enable a resource directory, specify a delegated administrator account for WAF, and invite members to join the resource directory. Then, add the members to the feature in the WAF console.

Step 1: Enable a resource directory

Before you can use the multi-account management feature, you must add multiple Alibaba Cloud accounts to a resource directory. For more information, see What is Resource Directory?.

Log on to the Resource Management console by using an Alibaba Cloud account and enable a resource directory. The Alibaba Cloud account is used as the administrator account of the resource directory. For more information, see Enable a resource directory.

Step 2: Invite members

After an Alibaba Cloud account is invited to join a resource directory, the account becomes a member of the resource directory. You can specify the invited member as a delegated administrator account.

Log on to the Resource Management console and use the administrator account to invite members. For more information, see Create a folder and Invite an Alibaba Cloud account to join a resource directory.

Step 3: Add a delegated administrator account

Delegated administrator accounts allow you to separate organization management tasks from business management tasks. The management account of a resource directory is used to perform the organization management tasks of the resource directory. Delegated administrator accounts are used to perform the business management tasks of the related trusted services. This meets security-related requirements. You can use a delegated administrator account to access the multi-account management feature and perform management operations within the resource directory. For more information, see Manage a delegated administrator account.

Step 4: Add members

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, click Multi-account Management.

3. On the Multi-account Management page, click Add Member.

4. In the Add Member dialog box, select the members that you want to add and move the members from the Available Members section to the Selected Members section.

5. In the Selected Members section, select the members and click OK.

   

Step 5: Connect cloud product Assets of member accounts

The method that you can use to add cloud resources to WAF varies based on the cloud service.