一、权限说明
云安全中心纳管阿里云账号需要的权限和说明如下：
| 产品 | 参考的系统策略 | 配置项 | 说明 |
| 费用与成本（BSS） | AliyunBSSFullAccess管理费用与成本（BSS）的权限 | { "Action": [ "bss:", "bssapi:" ], "Resource": "*", "Effect": "Deny"} | 拦截所有费用与成本相关的访问，避免访问用户费用清单。 |
| 所有 | ReadOnlyAccess只读访问所有阿里云资源的权限 | { "Action": [ ":Describe", ":List", ":Get", ":Read", ":BatchGet", ":BatchDescribe", ":Query", ":BatchQuery", "actiontrail:Lookup*", "actiontrail:Check*", "dm:Desc*", "dm:SenderStatistics*", "ram:GenerateCredentialReport", "cloudsso:Check*", "notifications:Read*", "selectdb:Check*", "hbr:Search*", "hbr:BrowseFiles", "hbr:BatchCountTables", "hbr:CheckRole", "hbr:PreCheckSourceGroup", "nis:Count*", "nis:Check*", "nis:Is*", "sr:HasRole", "resourcecenter:Search*", "resourcecenter:ExecuteSQLQuery", "resourcecenter:ExecuteMultiAccountSQLQuery", "clickhouse:Check*" ], "Resource": "*", "Effect": "Allow"} | 只读访问所有阿里云资源 |
| 消息队列 RocketMQ 版 | – | { "Action": [ "mq:OnsRegionList", "mq:OnsInstanceInServiceList", "ons:OnsRegionList", "mq:OnsInstanceInServiceList" ], "Resource": "*", "Effect": "Allow"} | 读取消息队列 RocketMQ 版的Region和服务列表 |
| 云安全中心（SAS） | AliyunYundunSASFullAccess管理云安全中心（SAS）的权限 | { "Action": [ "yundun-sas:", "yundun-aegis:", "sasti:" ], "Resource": "", "Effect": "Allow"},{ "Action": "ram:CreateServiceLinkedRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": [ "sas.aliyuncs.com", "cloudsiem.sas.aliyuncs.com", "cspm.sas.aliyuncs.com" ] } }} | 阿里云云安全中心管理权限，未来可能用于漏洞修复、告警确认等场景，变更动作均由用户通过控制台触发，云安全中心仅主动触发查询操作。 |
| 云盾应用防火墙（WAF） | AliyunYundunWAFFullAccess管理云盾应用防火墙（WAF）的权限 | { "Action": "yundun-waf:", "Resource": "", "Effect": "Allow"} | 应用防火墙（WAF）管理，变更动作均由用户通过控制台触发，云安全中心仅主动触发查询操作。 |
| 云盾云防火墙（CloudFirewall） | AliyunYundunCloudFirewallFullAccess管理云盾云防火墙（CloudFirewall）的权限 | { "Action": [ "yundun-cloudfirewall:*", "sasti:Get*", "sasti:Describe*", "sasti:Query*", "sasti:List*", "sasti:Grant*", "bss:QueryAvailableInstances", "bssapi:QuerySavingsPlansInstance" ], "Resource": "*", "Effect": "Allow"} | 云防火墙（CloudFirewall）管理，变更动作均由用户通过控制台触发，云安全中心仅主动触发查询操作。 |
| 云服务器（ECS） | 安全组相关操作 | { "Action": [ "ecs:CreateSecurityGroup", "ecs:ModifySecurityGroupPolicy", "ecs:ModifySecurityGroupAttribute", "ecs:DeleteSecurityGroup", "ecs:AuthorizeSecurityGroup", "ecs:ModifySecurityGroupRule", "ecs:RevokeSecurityGroup", "ecs:AuthorizeSecurityGroupEgress", "ecs:ModifySecurityGroupEgressRule", "ecs:RevokeSecurityGroupEgress", "ecs:JoinSecurityGroup", "ecs:LeaveSecurityGroup", ], "Resource": "*", "Effect": "Allow"} | 安全组操作，用于主机入侵时，进行隔离。由用户通过控制台触发。 |
二、权限脚本配置
{ "Version": "1", "Statement": [ { "Action": [ "bss:*", "bssapi:*" ], "Resource": "*", "Effect": "Deny" }, { "Action": [ "*:Describe*", "*:List*", "*:Get*", "*:Read*", "*:BatchGet*", "*:BatchDescribe*", "*:Query*", "*:BatchQuery*", "actiontrail:Lookup*", "actiontrail:Check*", "dm:Desc*", "dm:SenderStatistics*", "ram:GenerateCredentialReport", "cloudsso:Check*", "notifications:Read*", "selectdb:Check*", "hbr:Search*", "hbr:BrowseFiles", "hbr:BatchCountTables", "hbr:CheckRole", "hbr:PreCheckSourceGroup", "nis:Count*", "nis:Check*", "nis:Is*", "sr:HasRole", "resourcecenter:Search*", "resourcecenter:ExecuteSQLQuery", "resourcecenter:ExecuteMultiAccountSQLQuery", "clickhouse:Check*", "yundun-waf:*", "yundun-cloudfirewall:*", "sasti:Get*", "sasti:Describe*", "sasti:Query*", "sasti:List*", "sasti:Grant*", "ecs:CreateSecurityGroup", "ecs:ModifySecurityGroupPolicy", "ecs:ModifySecurityGroupAttribute", "ecs:DeleteSecurityGroup", "ecs:AuthorizeSecurityGroup", "ecs:ModifySecurityGroupRule", "ecs:RevokeSecurityGroup", "ecs:AuthorizeSecurityGroupEgress", "ecs:ModifySecurityGroupEgressRule", "ecs:RevokeSecurityGroupEgress", "ecs:JoinSecurityGroup", "ecs:LeaveSecurityGroup" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "mq:OnsRegionList", "mq:OnsInstanceInServiceList", "ons:OnsRegionList", "ons:OnsInstanceInServiceList" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "yundun-sas:*", "yundun-aegis:*", "sasti:*" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:CreateServiceLinkedRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": [ "sas.aliyuncs.com", "cloudsiem.sas.aliyuncs.com", "cspm.sas.aliyuncs.com" ] } } } ]}