Security Center:Add cloud assets for configuration checks

Step 1: Create access credentials on the third-party cloud platform

• AWS

  1. Create an IAM user and grant permissions: Log on to the AWS IAM console, create a new IAM user, and attach the ReadOnlyAccess and IAMReadOnlyAccess system policies to the user.

  2. Create and record the access key: Generate an access key for the new user, and properly record the Access Key ID and Secret Access Key.

• Huawei Cloud

  1. Create a user group and grant permissions: Log on to the Huawei Cloud console, go to the User Group page, create a new user group, and attach the Tenant Guest and IAM ReadOnlyAccess system policies to the user group.

  2. Create a user and record the access key: Create a new IAM user, add the user to the user group created in the previous step, create an access key for the user, and properly record the Access Key Id and Secret Access Key.

• Tencent Cloud

  1. Create a sub-account and grant permissions: Log on to the Tencent Cloud console, go to the User List page, create a new sub-account, and associate the CloudResourceReadOnlyAccess and QcloudCamReadOnlyAccess system policies with the sub-account.

  2. Create and record the API key: On the API Key management page of the sub-account details, create a new API key, and properly record the SecretId and SecretKey.

• Azure

  1. Register an application: Log on to the Azure portal, go to the App registrations service, register a new application, and record its Application (client) ID and Directory (tenant) ID.

  2. Create a client secret: In the newly registered application, go to the Certificates & secrets page, create a new client secret, and properly record its Value.

  3. Assign a role: Go to the Subscriptions service, select your subscription, and then assign the Reader role to the newly registered application on the Access control (IAM) page.

• Volcano Engine

  1. Create a sub-account and grant permissions: Log on to the Volcano Engine console, go to the Users page, create a new sub-account, and attach the IAMReadOnlyAccess and ECSReadOnlyAccess system policies to the user.

  2. Create and record the access key: When you create the user, make sure that Programmatic access is enabled. After the user is created, properly record the Access Key ID and Secret Access Key.

Step 2: Complete the integration in Security Center

1. Access the Security Center console - System Settings - Feature Settings. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.

2. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission.

3. In the Add Assets Outside Cloud panel, select a configuration plan and enter the access credentials obtained in the previous step into the corresponding input fields based on the prompts.

4. Configure audit logs (optional): If you want to use the CSPM (CSPM) log auditing feature, you also need to configure related settings.

   Note

   The third-party platform must provide the corresponding Kafka service. Currently, only Tencent Cloud and AWS support audit log configuration.

Step 1: Add the cluster

This step creates the necessary authentication and service accounts in the cluster so that the Security Center agent can securely communicate with the cluster.

1. On the Risk Governance > CSPM page, click Policy Management in the upper-right corner. In the Policy Management panel, click the Configure Container Cluster tab, and then click Self-built cluster access.

   Note

   If the current instance is the Ultimate edition, you can also go to Asset Center > Container > Cluster and click Self-built cluster access.

2. In the Access Self-built K8s cluster panel, complete the K8s access configuration, and click Generate Command.

3. Log on to the server where the cluster is deployed, create a text-001.yaml file, and copy the generated command into the file.

4. Run the following command:

   # Apply the access configuration
   kubectl apply -f text-001.yaml

Step 2: Install the check component

This step deploys the check component agent in the cluster to perform configuration scan tasks.

1. Return to the cluster list on the Configure Container Cluster tab, find the cluster that you just added. The Component Status of the cluster is Not Installed. Click Component Access.

2. In the Scan Component Access panel, copy the generated command. Then, log on to the server where the cluster is deployed, and copy the generated command into the deploy.yaml file.

3. Run the following command:

   # Deploy the check component
   kubectl apply -f deploy.yaml

4. (Optional) Enable Webhook for incremental checks: If you want to automatically trigger incremental checks when cluster resources (such as pods) change, you can enable the Webhook feature.

   Warning

   After the Webhook feature is enabled, only incremental checks for pods are supported. If the Webhook feature is not correctly configured or an exception occurs, the creation of cluster resources may be affected.

   1. In the Scan Component Access panel, copy the Webhook-related command. Then, log on to the server where the cluster is deployed, and copy the generated command into the webhook.yaml file.

   2. Run the following command to deploy the component:

      # Deploy the check component
      kubectl apply -f webhook.yaml

Step 3: Verify the installation

1. On the cluster server, run the following command to check whether the agent pod is running.

   Note

   The expected result is that the status of the agent-related pod is Running.

   # Replace <agent-namespace> with the actual namespace where the agent is deployed.
   kubectl get pods -n <agent-namespace>

2. In the Configure Container Cluster list in the Security Center console, check that the Component Status of the cluster in the cluster list is Online, which indicates that the component is installed.